Examples with KerberosPrincipal javax.security.auth.kerberos.KerberosPrincipal used on opensource projects

Example 16 with KerberosPrincipal

use of javax.security.auth.kerberos.KerberosPrincipal in project calcite-avatica by apache.

the class AvaticaJaasKrbUtil method loginUsingKeytab.

public static Subject loginUsingKeytab(String principal, File keytabFile) throws LoginException {
    Set<Principal> principals = new HashSet<Principal>();
    principals.add(new KerberosPrincipal(principal));
    Subject subject = new Subject(false, principals, new HashSet<Object>(), new HashSet<Object>());
    Configuration conf = useKeytab(principal, keytabFile);
    String confName = "KeytabConf";
    LoginContext loginContext = new LoginContext(confName, subject, null, conf);
    loginContext.login();
    return loginContext.getSubject();
}

Example 17 with KerberosPrincipal

use of javax.security.auth.kerberos.KerberosPrincipal in project zm-mailbox by Zimbra.

the class GssAuthenticator method initialize.

@Override
public boolean initialize() throws IOException {
    Krb5Keytab keytab = getKeytab(LC.krb5_keytab.value());
    if (keytab == null) {
        sendFailed("mechanism not supported");
        return false;
    }
    debug("keytab file = %s", keytab.getFile());
    final String host;
    if (LC.krb5_service_principal_from_interface_address.booleanValue()) {
        String localSocketHostname = localAddress.getCanonicalHostName().toLowerCase();
        if (localSocketHostname.length() == 0 || Character.isDigit(localSocketHostname.charAt(0)))
            localSocketHostname = LC.zimbra_server_hostname.value();
        host = localSocketHostname;
    } else {
        host = LC.zimbra_server_hostname.value();
    }
    KerberosPrincipal kp = new KerberosPrincipal(getProtocol() + '/' + host);
    debug("kerberos principal = %s", kp);
    Subject subject = getSubject(keytab, kp);
    if (subject == null) {
        sendFailed();
        return false;
    }
    debug("subject = %s", subject);
    final Map<String, String> props = getSaslProperties();
    if (DEBUG && props != null) {
        String qop = props.get(Sasl.QOP);
        debug("Sent QOP = " + (qop != null ? qop : "auth"));
    }
    try {
        mSaslServer = (SaslServer) Subject.doAs(subject, new PrivilegedExceptionAction<Object>() {

            @Override
            public Object run() throws SaslException {
                return Sasl.createSaslServer(getMechanism(), getProtocol(), host, props, new GssCallbackHandler());
            }
        });
    } catch (PrivilegedActionException e) {
        sendFailed();
        getLog().warn("Could not create SaslServer", e.getCause());
        return false;
    }
    return true;
}

Example 18 with KerberosPrincipal

use of javax.security.auth.kerberos.KerberosPrincipal in project wildfly by wildfly.

the class ElytronSubjectFactory method createSubject.

/**
 * Create a {@link Subject} with the principal and password credential obtained from the authentication configuration
 * that matches the target {@link URI}.
 *
 * @param authenticationContext the {@link AuthenticationContext} used to select a configuration that matches the
 *                              target {@link URI}.
 * @return the constructed {@link Subject}. It contains a single principal and a {@link PasswordCredential}.
 */
private Subject createSubject(final AuthenticationContext authenticationContext) {
    final AuthenticationConfiguration configuration = AUTH_CONFIG_CLIENT.getAuthenticationConfiguration(this.targetURI, authenticationContext);
    final CallbackHandler handler = AUTH_CONFIG_CLIENT.getCallbackHandler(configuration);
    final NameCallback nameCallback = new NameCallback("Username: ");
    final PasswordCallback passwordCallback = new PasswordCallback("Password: ", false);
    final CredentialCallback credentialCallback = new CredentialCallback(GSSKerberosCredential.class);
    try {
        handler.handle(new Callback[] { nameCallback, passwordCallback, credentialCallback });
        Subject subject = new Subject();
        // if a GSSKerberosCredential was found, add the enclosed GSSCredential and KerberosTicket to the private set in the Subject.
        if (credentialCallback.getCredential() != null) {
            GSSKerberosCredential kerberosCredential = GSSKerberosCredential.class.cast(credentialCallback.getCredential());
            this.addPrivateCredential(subject, kerberosCredential.getKerberosTicket());
            this.addPrivateCredential(subject, kerberosCredential.getGssCredential());
            // use the GSSName to build a kerberos principal and set it in the Subject.
            GSSName gssName = kerberosCredential.getGssCredential().getName();
            subject.getPrincipals().add(new KerberosPrincipal(gssName.toString()));
        }
        // use the name from the callback, if available, to build a principal and set it in the Subject.
        if (nameCallback.getName() != null) {
            subject.getPrincipals().add(new NamePrincipal(nameCallback.getName()));
        }
        // use the password from the callback, if available, to build a credential and set it as a private credential in the Subject.
        if (passwordCallback.getPassword() != null) {
            this.addPrivateCredential(subject, new PasswordCredential(nameCallback.getName(), passwordCallback.getPassword()));
        }
        return subject;
    } catch (Exception e) {
        throw new SecurityException(e);
    }
}

Example 19 with KerberosPrincipal

use of javax.security.auth.kerberos.KerberosPrincipal in project zeppelin by apache.

the class YarnClient method callRestUrl.

public HttpResponse callRestUrl(final String url, final String userId, HTTP operation) {
    if (LOGGER.isDebugEnabled()) {
        LOGGER.debug(String.format("Calling YarnClient %s %s %s", this.principal, this.keytab, url));
    }
    javax.security.auth.login.Configuration config = new javax.security.auth.login.Configuration() {

        @SuppressWarnings("serial")
        @Override
        public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
            return new AppConfigurationEntry[] { new AppConfigurationEntry("com.sun.security.auth.module.Krb5LoginModule", AppConfigurationEntry.LoginModuleControlFlag.REQUIRED, new HashMap<String, Object>() {

                {
                    put("useTicketCache", "false");
                    put("useKeyTab", "true");
                    put("keyTab", keytab);
                    // Krb5 in GSS API needs to be refreshed so it does not throw the error
                    // Specified version of key is not available
                    put("refreshKrb5Config", "true");
                    put("principal", principal);
                    put("storeKey", "true");
                    put("doNotPrompt", "true");
                    put("isInitiator", "true");
                    if (LOGGER.isDebugEnabled()) {
                        put("debug", "true");
                    }
                }
            }) };
        }
    };
    Set<Principal> principals = new HashSet<Principal>(1);
    principals.add(new KerberosPrincipal(userId));
    Subject sub = new Subject(false, principals, new HashSet<Object>(), new HashSet<Object>());
    try {
        // Authentication module: Krb5Login
        LoginContext loginContext = new LoginContext("Krb5Login", sub, null, config);
        loginContext.login();
        Subject serviceSubject = loginContext.getSubject();
        return Subject.doAs(serviceSubject, new PrivilegedAction<HttpResponse>() {

            HttpResponse httpResponse = null;

            @Override
            public HttpResponse run() {
                try {
                    HttpUriRequest request = null;
                    switch(operation) {
                        case DELETE:
                            request = new HttpDelete(url);
                            break;
                        case POST:
                            request = new HttpPost(url);
                            break;
                        default:
                            request = new HttpGet(url);
                            break;
                    }
                    HttpClient spengoClient = buildSpengoHttpClient();
                    httpResponse = spengoClient.execute(request);
                    return httpResponse;
                } catch (IOException e) {
                    LOGGER.error(e.getMessage(), e);
                }
                return httpResponse;
            }
        });
    } catch (Exception e) {
        LOGGER.error(e.getMessage(), e);
    }
    return null;
}

Example 20 with KerberosPrincipal

use of javax.security.auth.kerberos.KerberosPrincipal in project zeppelin by apache.

the class KerberosRealm method onInit.

/**
 * Initializes the KerberosRealm by 'kinit'ing using principal and keytab.
 * <p>
 * It creates a Kerberos context using the principal and keytab specified in
 * the Shiro configuration.
 * <p>
 * This method should be called only once.
 *
 * @throws RuntimeException thrown if the handler could not be initialized.
 */
@Override
protected void onInit() {
    super.onInit();
    config = getConfiguration();
    try {
        if (principal == null || principal.trim().length() == 0) {
            throw new RuntimeException("Principal not defined in configuration");
        }
        if (keytab == null || keytab.trim().length() == 0) {
            throw new RuntimeException("Keytab not defined in configuration");
        }
        File keytabFile = new File(keytab);
        if (!keytabFile.exists()) {
            throw new RuntimeException("Keytab file does not exist: " + keytab);
        }
        // use all SPNEGO principals in the keytab if a principal isn't
        // specifically configured
        final String[] spnegoPrincipals;
        if (principal.equals("*")) {
            spnegoPrincipals = KerberosUtil.getPrincipalNames(keytab, Pattern.compile("HTTP/.*"));
            if (spnegoPrincipals.length == 0) {
                throw new RuntimeException("Principals do not exist in the keytab");
            }
        } else {
            spnegoPrincipals = new String[] { principal };
        }
        KeyTab keytabInstance = KeyTab.getInstance(keytabFile);
        serverSubject = new Subject();
        serverSubject.getPrivateCredentials().add(keytabInstance);
        for (String spnegoPrincipal : spnegoPrincipals) {
            Principal krbPrincipal = new KerberosPrincipal(spnegoPrincipal);
            LOG.info("Using keytab {}, for principal {}", keytab, krbPrincipal);
            serverSubject.getPrincipals().add(krbPrincipal);
        }
        if (nameRules == null || nameRules.trim().length() == 0) {
            LOG.warn("No auth_to_local rules defined, DEFAULT will be used.");
            nameRules = "DEFAULT";
        }
        KerberosName.setRules(nameRules);
        if (null == gssManager) {
            try {
                gssManager = Subject.doAs(serverSubject, (PrivilegedExceptionAction<GSSManager>) GSSManager::getInstance);
                LOG.trace("SPNEGO gssManager initialized.");
            } catch (PrivilegedActionException ex) {
                throw ex.getException();
            }
        }
        if (null == signer) {
            initializeSecretProvider();
        }
        Configuration hadoopConfig = new Configuration();
        hadoopGroups = new Groups(hadoopConfig);
    } catch (Exception ex) {
        throw new RuntimeException(ex);
    }
}