public class

Credentials

extends Object
java.lang.Object
   ↳ sun.security.mule.krb5.Credentials

Class Overview

This class encapsulates the concept of a Kerberos service credential. That includes a Kerberos ticket and an associated session key.

Summary

Fields
private static boolean DEBUG
static boolean alreadyLoaded
private static boolean alreadyTried
KerberosTime authTime
HostAddresses cAddr
private static CredentialsCache cache
PrincipalName client
KerberosTime endTime
TicketFlags flags
EncryptionKey key
KerberosTime renewTill
PrincipalName server
EncryptionKey serviceKey
KerberosTime startTime
Ticket ticket
Public Constructors
Credentials(Ticket new_ticket, PrincipalName new_client, PrincipalName new_server, EncryptionKey new_key, TicketFlags new_flags, KerberosTime authTime, KerberosTime new_startTime, KerberosTime new_endTime, KerberosTime renewTill, HostAddresses cAddr)
Credentials(byte[] encoding, String client, String server, byte[] keyBytes, int keyType, boolean[] flags, Date authTime, Date startTime, Date endTime, Date renewTill, InetAddress[] cAddrs, Config kerberosConfig)
Public Methods
synchronized static Credentials acquireDefaultCreds()
Acquires default credentials.
static Credentials acquireServiceCreds(String service, Credentials ccreds, Config kerberosConfig)
Acquires credentials for a specified service using initial credential.
static Credentials acquireTGT(PrincipalName princ, EncryptionKey[] secretKeys, char[] password, Config kerberosConfig)
Returns a TGT for the given client principal via an AS-Exchange.
static Credentials acquireTGTFromCache(PrincipalName princ, String ticketCache)
Returns a TGT for the given client principal from a ticket cache.
boolean checkDelegate()
Checks if the service ticket returned by the KDC has the OK-AS-DELEGATE flag set
final Date getAuthTime()
CredentialsCache getCache()
final PrincipalName getClient()
Acquires a service ticket for the specified service principal.
final InetAddress[] getClientAddresses()
final byte[] getEncoded()
final Date getEndTime()
final boolean[] getFlags()
final Date getRenewTill()
final PrincipalName getServer()
static Credentials getServiceCreds(String serviceName, File keyTabFile, Config kerberosConfig)
Gets service credential from key table.
EncryptionKey getServiceKey()
final EncryptionKey getSessionKey()
final Date getStartTime()
Ticket getTicket()
TicketFlags getTicketFlags()
boolean isForwardable()
boolean isRenewable()
static void printDebug(Credentials c)
Credentials renew(Config kerberosConfig)
String toString()
[Expand]
Inherited Methods
From class java.lang.Object

Fields

private static boolean DEBUG

static boolean alreadyLoaded

private static boolean alreadyTried

KerberosTime authTime

HostAddresses cAddr

private static CredentialsCache cache

PrincipalName client

KerberosTime endTime

TicketFlags flags

EncryptionKey key

KerberosTime renewTill

PrincipalName server

EncryptionKey serviceKey

KerberosTime startTime

Ticket ticket

Public Constructors

public Credentials (Ticket new_ticket, PrincipalName new_client, PrincipalName new_server, EncryptionKey new_key, TicketFlags new_flags, KerberosTime authTime, KerberosTime new_startTime, KerberosTime new_endTime, KerberosTime renewTill, HostAddresses cAddr)

Parameters
new_ticket
new_client
new_server
new_key
new_flags
authTime
new_startTime
new_endTime
renewTill
cAddr

public Credentials (byte[] encoding, String client, String server, byte[] keyBytes, int keyType, boolean[] flags, Date authTime, Date startTime, Date endTime, Date renewTill, InetAddress[] cAddrs, Config kerberosConfig)

Parameters
encoding
client
server
keyBytes
keyType
flags
authTime
startTime
endTime
renewTill
cAddrs
kerberosConfig
Throws
IOException
KrbException

Public Methods

public static synchronized Credentials acquireDefaultCreds ()

Acquires default credentials.
The possible locations for default credentials cache is searched in the following order:

  1. The directory and cache file name specified by "KRB5CCNAME" system. property.
  2. The directory and cache file name specified by "KRB5CCNAME" environment variable.
  3. A cache file named krb5cc_{user.name} at {user.home} directory.

Returns
  • a KrbCreds object if the credential is found, otherwise return null.

public static Credentials acquireServiceCreds (String service, Credentials ccreds, Config kerberosConfig)

Acquires credentials for a specified service using initial credential. When the service has a different realm from the initial credential, we do cross-realm authentication - first, we use the current credential to get a cross-realm credential from the local KDC, then use that cross-realm credential to request service credential from the foreigh KDC.

Parameters
service The name of service principal using format components@realm
ccreds Client's initial credential.
kerberosConfig
Returns
  • a Credentials object.
Throws
IOException if an error occurs in reading the credentials cache
KrbException if an error occurs specific to Kerberos

public static Credentials acquireTGT (PrincipalName princ, EncryptionKey[] secretKeys, char[] password, Config kerberosConfig)

Returns a TGT for the given client principal via an AS-Exchange. This method causes pre-authentication data to be sent in the AS-REQ.

Parameters
princ The client principal. This value cannot be null.
secretKeys
password
kerberosConfig
Throws
IOException
KrbException

public static Credentials acquireTGTFromCache (PrincipalName princ, String ticketCache)

Returns a TGT for the given client principal from a ticket cache.

Parameters
princ The client principal. A value of null means that the default principal name in the credentials cache will be used.
ticketCache The path to the tickets file. A value of null will be accepted to indicate that the default path should be searched
Throws
IOException
KrbException

public boolean checkDelegate ()

Checks if the service ticket returned by the KDC has the OK-AS-DELEGATE flag set

Returns
  • true if OK-AS_DELEGATE flag is set, otherwise, return false.

public final Date getAuthTime ()

public CredentialsCache getCache ()

public final PrincipalName getClient ()

Acquires a service ticket for the specified service principal. If the service ticket is not already available, it obtains a new one from the KDC.

public final InetAddress[] getClientAddresses ()

public final byte[] getEncoded ()

public final Date getEndTime ()

public final boolean[] getFlags ()

public final Date getRenewTill ()

public final PrincipalName getServer ()

public static Credentials getServiceCreds (String serviceName, File keyTabFile, Config kerberosConfig)

Gets service credential from key table. The credential is used to decrypt the received client message and authenticate the client by verifying the client's credential.

Parameters
serviceName The name of service, using format component@realm
keyTabFile The file of key table.
kerberosConfig
Returns
  • a KrbCreds object.

public EncryptionKey getServiceKey ()

public final EncryptionKey getSessionKey ()

public final Date getStartTime ()

public Ticket getTicket ()

public TicketFlags getTicketFlags ()

public boolean isForwardable ()

public boolean isRenewable ()

public static void printDebug (Credentials c)

Parameters
c

public Credentials renew (Config kerberosConfig)

Parameters
kerberosConfig
Throws
IOException
KrbException

public String toString ()