Class SpnegoTokenHelper


  • public class SpnegoTokenHelper
    extends java.lang.Object
    SpnegoTokenHelper - utilities to help create a SPNEGO Token as Authorization header for outbound authentication purposes
    Since:
    1.0
    • Method Summary

      All Methods Static Methods Concrete Methods 
      Modifier and Type Method Description
      static java.lang.String buildSpnegoAuthorizationFromCallerSubject​(java.lang.String spn, int lifetime, boolean delegate)
      Build a SPNEGO Authorization string using a Kerberos credential within the current caller Java Subject.
      static java.lang.String buildSpnegoAuthorizationFromNativeCreds​(java.lang.String spn, int lifetime, boolean delegate)
      Build a SPNEGO Authorization string using the Native Kerberos credentials of the Operating System account that the Java process is running as.
      static java.lang.String buildSpnegoAuthorizationFromSubject​(java.lang.String spn, javax.security.auth.Subject subject, int lifetime, boolean delegate)
      Build a SPNEGO Authorization string using a Kerberos credential within the supplied Java Subject.
      static java.lang.String buildSpnegoAuthorizationFromUpn​(java.lang.String spn, java.lang.String upn, java.lang.String jaasLoginContextEntry, int lifetime, boolean delegate)
      Build a SPNEGO Authorization string using a key for a UserPrincipalName from the Kerberos cache or from a key in the Kerberos keytab file used by the process.
      static java.lang.String buildSpnegoAuthorizationFromUseridPassword​(java.lang.String spn, java.lang.String userid, java.lang.String password, int lifetime, boolean delegate)
      Build a SPNEGO Authorization string using Kerberos credentials for a user based on userid and password provided.
      static java.lang.String buildSpnegoAuthorizationFromUseridPassword​(java.lang.String spn, java.lang.String userid, java.lang.String password, java.lang.String jaasLoginContextEntry, int lifetime, boolean delegate)
      Build a SPNEGO Authorization string using Kerberos credentials for a user based on userid and password provided.
      • Methods inherited from class java.lang.Object

        equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
    • Constructor Detail

      • SpnegoTokenHelper

        public SpnegoTokenHelper()
    • Method Detail

      • buildSpnegoAuthorizationFromCallerSubject

        public static java.lang.String buildSpnegoAuthorizationFromCallerSubject​(java.lang.String spn,
                                                                                 int lifetime,
                                                                                 boolean delegate)
                                                                          throws com.ibm.websphere.security.WSSecurityException,
                                                                                 org.ietf.jgss.GSSException,
                                                                                 java.security.PrivilegedActionException
        Build a SPNEGO Authorization string using a Kerberos credential within the current caller Java Subject. The method will use that credential to request a SPNEGO token for a ServicePrincipalName (SPN) for the target service system.
        Parameters:
        spn - - ServicePrincipalName of system for which SPNEGO token will be targeted.
        lifetime - - Lifetime for the context, for example GSSCredential.INDEFINITE_LIFETIME
        delegate - - Whether the token includes delegatable GSSCredentials.
        Returns:
        - String "Negotiate " + Base64 encoded version of SPNEGO Token
        Throws:
        com.ibm.websphere.security.WSSecurityException - - thrown when no caller Subject exists.
        org.ietf.jgss.GSSException - - thrown when SPNEGO token generation fails, when Subject is null, when the Subject does not contain Kerberos credentials, or when SPN is invalid.
        java.security.PrivilegedActionException - - unexpected - thrown when Java 2 security is misconfigured.
      • buildSpnegoAuthorizationFromSubject

        public static java.lang.String buildSpnegoAuthorizationFromSubject​(java.lang.String spn,
                                                                           javax.security.auth.Subject subject,
                                                                           int lifetime,
                                                                           boolean delegate)
                                                                    throws org.ietf.jgss.GSSException,
                                                                           java.security.PrivilegedActionException
        Build a SPNEGO Authorization string using a Kerberos credential within the supplied Java Subject. The method will use that credential to request a SPNEGO token for a ServicePrincipalName (SPN) for the target service system.
        Parameters:
        spn - - ServicePrincipalName of system for which SPNEGO token will be targeted.
        subject - - Subject containing Kerberos credentials
        lifetime - - Lifetime for the context, for example GSSCredential.INDEFINITE_LIFETIME
        delegate - - whether the token includes delegatable GSSCredentials.
        Returns:
        - String "Negotiate " + Base64 encoded version of SPNEGO Token
        Throws:
        org.ietf.jgss.GSSException - - thrown when SPNEGO token generation fails, when Subject is null, when the Subject does not contain Kerberos credentials, or when SPN is invalid.
        java.security.PrivilegedActionException - - unexpected - thrown when Java 2 security is misconfigured.
        javax.security.auth.login.LoginException - - thrown when the Login fails with the supplied SPN.
      • buildSpnegoAuthorizationFromNativeCreds

        public static java.lang.String buildSpnegoAuthorizationFromNativeCreds​(java.lang.String spn,
                                                                               int lifetime,
                                                                               boolean delegate)
                                                                        throws org.ietf.jgss.GSSException,
                                                                               java.security.PrivilegedActionException
        Build a SPNEGO Authorization string using the Native Kerberos credentials of the Operating System account that the Java process is running as. When the WebSphere java process is running on a Windows system under a userid which has Kerberos credentials, the Windows OS maintains a Kerberos Ticket Granting Ticket (TGT) for that user and will use that TGT to request a SPNEGO token can be requested for a ServicePrincipalName (SPN) for the target service system.
        Parameters:
        spn - - ServicePrincipalName of system for which SPNEGO token will be targeted.
        lifetime - - Lifetime for the context, for example GSSCredential.INDEFINITE_LIFETIME
        delegate - - Whether the token includes delegatable GSSCredential credentials.
        Returns:
        - String "Negotiate " + Base64 encoded version of SPNEGO Token
        Throws:
        org.ietf.jgss.GSSException - - thrown when SPNEGO token generation fails, or when SPN is invalid.
        java.security.PrivilegedActionException - - unexpected - thrown when Java 2 security is misconfigured.
      • buildSpnegoAuthorizationFromUpn

        public static java.lang.String buildSpnegoAuthorizationFromUpn​(java.lang.String spn,
                                                                       java.lang.String upn,
                                                                       java.lang.String jaasLoginContextEntry,
                                                                       int lifetime,
                                                                       boolean delegate)
                                                                throws org.ietf.jgss.GSSException,
                                                                       javax.security.auth.login.LoginException,
                                                                       java.security.PrivilegedActionException
        Build a SPNEGO Authorization string using a key for a UserPrincipalName from the Kerberos cache or from a key in the Kerberos keytab file used by the process. On a system where a user has logged in, typically using tools such as Java kinit tool, the user's Kerberos credentials are stored in a cache file named krb5cc_userid. Alternatively, a keytab file containing a user's key can be created using a number of tools such as Microsoft's ktpass tool, or the Java ktab tool. These files contain a copy of the user's Kerberos key which can be used to get a Ticket Granting Ticket (TGT) for that userid. The method will use that TGT to request a SPNEGO token can be requested for a ServicePrincipalName (SPN) for the target service system.
        Parameters:
        spn - - ServicePrincipalName of system for which SPNEGO token will be targeted.
        upn - - UserPrincipalName of the user for which the SPNEGO token will be generated.
        jaasLoginContextEntry - - JAAS login context entry to use.
        lifetime - - Lifetime for the context, for example GSSCredential.INDEFINITE_LIFETIME
        delegate - - whether the token includes delegatable GSSCredential credentials.
        Returns:
        - String "Negotiate " + Base64 encoded version of SPNEGO Token
        Throws:
        org.ietf.jgss.GSSException - - thrown when SPNEGO token generation fails, when UPN is invalid, or when SPN is invalid.
        javax.security.auth.login.LoginException - - thrown when the Login fails with the supplied UPN.
        java.security.PrivilegedActionException - - unexpected - thrown when Java 2 security is misconfigured.
      • buildSpnegoAuthorizationFromUseridPassword

        public static java.lang.String buildSpnegoAuthorizationFromUseridPassword​(java.lang.String spn,
                                                                                  java.lang.String userid,
                                                                                  java.lang.String password,
                                                                                  int lifetime,
                                                                                  boolean delegate)
                                                                           throws org.ietf.jgss.GSSException,
                                                                                  javax.security.auth.login.LoginException,
                                                                                  java.security.PrivilegedActionException
        Build a SPNEGO Authorization string using Kerberos credentials for a user based on userid and password provided. The method will login to the Kerberos Key Distribution (KDC) with the supplied userid and password to get a Ticket Granting Ticket (TGT) then will request the SPNEGO token with that TGT for the specified ServicePrincipalName.
        Parameters:
        spn - - ServicePrincipalName of system for which SPNEGO token will be targeted.
        userid - - Userid for the Login
        password - - Password for the Login
        lifetime - - Lifetime for the context, for example GSSCredential.INDEFINITE_LIFETIME
        delegate - - whether the token includes delegatable GSScredentials.
        Returns:
        - String "Negotiate " + Base64 encoded version of SPNEGO Token
        Throws:
        org.ietf.jgss.GSSException - - thrown when SPNEGO token generation fails, when userid or password is null, or when SPN is invalid.
        javax.security.auth.login.LoginException - - thrown when the Login fails with the supplied userid and password.
        java.security.PrivilegedActionException
      • buildSpnegoAuthorizationFromUseridPassword

        public static java.lang.String buildSpnegoAuthorizationFromUseridPassword​(java.lang.String spn,
                                                                                  java.lang.String userid,
                                                                                  java.lang.String password,
                                                                                  java.lang.String jaasLoginContextEntry,
                                                                                  int lifetime,
                                                                                  boolean delegate)
                                                                           throws org.ietf.jgss.GSSException,
                                                                                  javax.security.auth.login.LoginException,
                                                                                  java.security.PrivilegedActionException
        Build a SPNEGO Authorization string using Kerberos credentials for a user based on userid and password provided. The method will login to the Kerberos Key Distribution (KDC) with the supplied userid and password to get a Ticket Granting Ticket (TGT) then will request the SPNEGO token with that TGT for the specified ServicePrincipalName.
        Parameters:
        spn - - ServicePrincipalName of system for which SPNEGO token will be targeted.
        userid - - Userid for the Login
        password - - Password for the Login
        jaasLoginContextEntry - - JAAS login context entry to use.
        lifetime - - Lifetime for the context, for example GSSCredential.INDEFINITE_LIFETIME
        delegate - - whether the token includes delegatable GSSCredentials.
        Returns:
        - String "Negotiate " + Base64 encoded version of SPNEGO Token
        Throws:
        org.ietf.jgss.GSSException - - thrown when SPNEGO token generation fails, when userid or password is null, or when SPN is invalid.
        javax.security.auth.login.LoginException - - thrown when the Login fails with the supplied userid and password.
        java.security.PrivilegedActionException - - unexpected - thrown when Java 2 security is misconfigured.