Package org.elasticsearch.xpack.security.authc.kerberos

Class KerberosAuthenticationToken

java.lang.Object

org.elasticsearch.xpack.security.authc.kerberos.KerberosAuthenticationToken

All Implemented Interfaces:

org.elasticsearch.xpack.core.security.authc.AuthenticationToken

public final class KerberosAuthenticationToken
extends Object
implements org.elasticsearch.xpack.core.security.authc.AuthenticationToken

This class represents an AuthenticationToken for Kerberos authentication using SPNEGO. The token stores base 64 decoded token bytes, extracted from the Authorization header with auth scheme 'Negotiate'.

Example Authorization header "Authorization: Negotiate YIIChgYGKwYBBQUCoII..."

If there is any error handling during extraction of 'Negotiate' header then it throws ElasticsearchSecurityException with RestStatus.UNAUTHORIZED and header 'WWW-Authenticate: Negotiate'

Field Summary

Fields

Modifier and Type	Field	Description
static final String	AUTH_HEADER
static final String	NEGOTIATE_AUTH_HEADER_PREFIX
static final String	NEGOTIATE_SCHEME_NAME
static final String	WWW_AUTHENTICATE

Constructor Summary

Constructors

Constructor	Description
KerberosAuthenticationToken(byte[] decodedToken)

Method Summary

Modifier and Type	Method	Description
void	clearCredentials()
Object	credentials()
boolean	equals(Object other)
static KerberosAuthenticationToken	extractToken(String authorizationHeader)	Extract token from authorization header and if it is valid "Negotiate " then returns KerberosAuthenticationToken
int	hashCode()
String	principal()

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, toString, wait, wait, wait

Field Details

WWW_AUTHENTICATE

public static final String WWW_AUTHENTICATE

See Also:

• Constant Field Values

AUTH_HEADER

public static final String AUTH_HEADER

See Also:

• Constant Field Values

NEGOTIATE_SCHEME_NAME

public static final String NEGOTIATE_SCHEME_NAME

See Also:

• Constant Field Values

NEGOTIATE_AUTH_HEADER_PREFIX

public static final String NEGOTIATE_AUTH_HEADER_PREFIX

See Also:

• Constant Field Values

Constructor Details

KerberosAuthenticationToken

public KerberosAuthenticationToken(byte[] decodedToken)

Method Details

extractToken

public static KerberosAuthenticationToken extractToken(String authorizationHeader)

Extract token from authorization header and if it is valid "Negotiate " then returns KerberosAuthenticationToken

Parameters:

authorizationHeader - Authorization header from request

Returns:

returns null if AUTH_HEADER is empty or does not start with "Negotiate " else returns valid KerberosAuthenticationToken

Throws:

org.elasticsearch.ElasticsearchSecurityException - when negotiate header is invalid.

principal

public String principal()

Specified by:

principal in interface org.elasticsearch.xpack.core.security.authc.AuthenticationToken

credentials

public Object credentials()

Specified by:

credentials in interface org.elasticsearch.xpack.core.security.authc.AuthenticationToken

clearCredentials

public void clearCredentials()

Specified by:

clearCredentials in interface org.elasticsearch.xpack.core.security.authc.AuthenticationToken

hashCode

public int hashCode()

Overrides:

hashCode in class Object

equals

public boolean equals(Object other)

Overrides:

equals in class Object