Package com.ibm.wsspi.security.token
Class SpnegoTokenHelper
- java.lang.Object
-
- com.ibm.wsspi.security.token.SpnegoTokenHelper
-
public class SpnegoTokenHelper extends java.lang.Object
SpnegoTokenHelper - utilities to help create a SPNEGO Token as Authorization header for outbound authentication purposes- Since:
- 1.0
-
-
Constructor Summary
Constructors Constructor Description SpnegoTokenHelper()
-
Method Summary
All Methods Static Methods Concrete Methods Modifier and Type Method Description static java.lang.String
buildSpnegoAuthorizationFromCallerSubject(java.lang.String spn, int lifetime, boolean delegate)
Build a SPNEGO Authorization string using a Kerberos credential within the current caller Java Subject.static java.lang.String
buildSpnegoAuthorizationFromNativeCreds(java.lang.String spn, int lifetime, boolean delegate)
Build a SPNEGO Authorization string using the Native Kerberos credentials of the Operating System account that the Java process is running as.static java.lang.String
buildSpnegoAuthorizationFromSubject(java.lang.String spn, javax.security.auth.Subject subject, int lifetime, boolean delegate)
Build a SPNEGO Authorization string using a Kerberos credential within the supplied Java Subject.static java.lang.String
buildSpnegoAuthorizationFromUpn(java.lang.String spn, java.lang.String upn, java.lang.String jaasLoginContextEntry, int lifetime, boolean delegate)
Build a SPNEGO Authorization string using a key for a UserPrincipalName from the Kerberos cache or from a key in the Kerberos keytab file used by the process.static java.lang.String
buildSpnegoAuthorizationFromUseridPassword(java.lang.String spn, java.lang.String userid, java.lang.String password, int lifetime, boolean delegate)
Build a SPNEGO Authorization string using Kerberos credentials for a user based on userid and password provided.static java.lang.String
buildSpnegoAuthorizationFromUseridPassword(java.lang.String spn, java.lang.String userid, java.lang.String password, java.lang.String jaasLoginContextEntry, int lifetime, boolean delegate)
Build a SPNEGO Authorization string using Kerberos credentials for a user based on userid and password provided.
-
-
-
Method Detail
-
buildSpnegoAuthorizationFromCallerSubject
public static java.lang.String buildSpnegoAuthorizationFromCallerSubject(java.lang.String spn, int lifetime, boolean delegate) throws com.ibm.websphere.security.WSSecurityException, org.ietf.jgss.GSSException, java.security.PrivilegedActionException
Build a SPNEGO Authorization string using a Kerberos credential within the current caller Java Subject. The method will use that credential to request a SPNEGO token for a ServicePrincipalName (SPN) for the target service system.- Parameters:
spn
- - ServicePrincipalName of system for which SPNEGO token will be targeted.lifetime
- - Lifetime for the context, for example GSSCredential.INDEFINITE_LIFETIMEdelegate
- - Whether the token includes delegatable GSSCredentials.- Returns:
- - String "Negotiate " + Base64 encoded version of SPNEGO Token
- Throws:
com.ibm.websphere.security.WSSecurityException
- - thrown when no caller Subject exists.org.ietf.jgss.GSSException
- - thrown when SPNEGO token generation fails, when Subject is null, when the Subject does not contain Kerberos credentials, or when SPN is invalid.java.security.PrivilegedActionException
- - unexpected - thrown when Java 2 security is misconfigured.
-
buildSpnegoAuthorizationFromSubject
public static java.lang.String buildSpnegoAuthorizationFromSubject(java.lang.String spn, javax.security.auth.Subject subject, int lifetime, boolean delegate) throws org.ietf.jgss.GSSException, java.security.PrivilegedActionException
Build a SPNEGO Authorization string using a Kerberos credential within the supplied Java Subject. The method will use that credential to request a SPNEGO token for a ServicePrincipalName (SPN) for the target service system.- Parameters:
spn
- - ServicePrincipalName of system for which SPNEGO token will be targeted.subject
- - Subject containing Kerberos credentialslifetime
- - Lifetime for the context, for example GSSCredential.INDEFINITE_LIFETIMEdelegate
- - whether the token includes delegatable GSSCredentials.- Returns:
- - String "Negotiate " + Base64 encoded version of SPNEGO Token
- Throws:
org.ietf.jgss.GSSException
- - thrown when SPNEGO token generation fails, when Subject is null, when the Subject does not contain Kerberos credentials, or when SPN is invalid.java.security.PrivilegedActionException
- - unexpected - thrown when Java 2 security is misconfigured.javax.security.auth.login.LoginException
- - thrown when the Login fails with the supplied SPN.
-
buildSpnegoAuthorizationFromNativeCreds
public static java.lang.String buildSpnegoAuthorizationFromNativeCreds(java.lang.String spn, int lifetime, boolean delegate) throws org.ietf.jgss.GSSException, java.security.PrivilegedActionException
Build a SPNEGO Authorization string using the Native Kerberos credentials of the Operating System account that the Java process is running as. When the WebSphere java process is running on a Windows system under a userid which has Kerberos credentials, the Windows OS maintains a Kerberos Ticket Granting Ticket (TGT) for that user and will use that TGT to request a SPNEGO token can be requested for a ServicePrincipalName (SPN) for the target service system.- Parameters:
spn
- - ServicePrincipalName of system for which SPNEGO token will be targeted.lifetime
- - Lifetime for the context, for example GSSCredential.INDEFINITE_LIFETIMEdelegate
- - Whether the token includes delegatable GSSCredential credentials.- Returns:
- - String "Negotiate " + Base64 encoded version of SPNEGO Token
- Throws:
org.ietf.jgss.GSSException
- - thrown when SPNEGO token generation fails, or when SPN is invalid.java.security.PrivilegedActionException
- - unexpected - thrown when Java 2 security is misconfigured.
-
buildSpnegoAuthorizationFromUpn
public static java.lang.String buildSpnegoAuthorizationFromUpn(java.lang.String spn, java.lang.String upn, java.lang.String jaasLoginContextEntry, int lifetime, boolean delegate) throws org.ietf.jgss.GSSException, javax.security.auth.login.LoginException, java.security.PrivilegedActionException
Build a SPNEGO Authorization string using a key for a UserPrincipalName from the Kerberos cache or from a key in the Kerberos keytab file used by the process. On a system where a user has logged in, typically using tools such as Java kinit tool, the user's Kerberos credentials are stored in a cache file named krb5cc_userid. Alternatively, a keytab file containing a user's key can be created using a number of tools such as Microsoft's ktpass tool, or the Java ktab tool. These files contain a copy of the user's Kerberos key which can be used to get a Ticket Granting Ticket (TGT) for that userid. The method will use that TGT to request a SPNEGO token can be requested for a ServicePrincipalName (SPN) for the target service system.- Parameters:
spn
- - ServicePrincipalName of system for which SPNEGO token will be targeted.upn
- - UserPrincipalName of the user for which the SPNEGO token will be generated.jaasLoginContextEntry
- - JAAS login context entry to use.lifetime
- - Lifetime for the context, for example GSSCredential.INDEFINITE_LIFETIMEdelegate
- - whether the token includes delegatable GSSCredential credentials.- Returns:
- - String "Negotiate " + Base64 encoded version of SPNEGO Token
- Throws:
org.ietf.jgss.GSSException
- - thrown when SPNEGO token generation fails, when UPN is invalid, or when SPN is invalid.javax.security.auth.login.LoginException
- - thrown when the Login fails with the supplied UPN.java.security.PrivilegedActionException
- - unexpected - thrown when Java 2 security is misconfigured.
-
buildSpnegoAuthorizationFromUseridPassword
public static java.lang.String buildSpnegoAuthorizationFromUseridPassword(java.lang.String spn, java.lang.String userid, java.lang.String password, int lifetime, boolean delegate) throws org.ietf.jgss.GSSException, javax.security.auth.login.LoginException, java.security.PrivilegedActionException
Build a SPNEGO Authorization string using Kerberos credentials for a user based on userid and password provided. The method will login to the Kerberos Key Distribution (KDC) with the supplied userid and password to get a Ticket Granting Ticket (TGT) then will request the SPNEGO token with that TGT for the specified ServicePrincipalName.- Parameters:
spn
- - ServicePrincipalName of system for which SPNEGO token will be targeted.userid
- - Userid for the Loginpassword
- - Password for the Loginlifetime
- - Lifetime for the context, for example GSSCredential.INDEFINITE_LIFETIMEdelegate
- - whether the token includes delegatable GSScredentials.- Returns:
- - String "Negotiate " + Base64 encoded version of SPNEGO Token
- Throws:
org.ietf.jgss.GSSException
- - thrown when SPNEGO token generation fails, when userid or password is null, or when SPN is invalid.javax.security.auth.login.LoginException
- - thrown when the Login fails with the supplied userid and password.java.security.PrivilegedActionException
-
buildSpnegoAuthorizationFromUseridPassword
public static java.lang.String buildSpnegoAuthorizationFromUseridPassword(java.lang.String spn, java.lang.String userid, java.lang.String password, java.lang.String jaasLoginContextEntry, int lifetime, boolean delegate) throws org.ietf.jgss.GSSException, javax.security.auth.login.LoginException, java.security.PrivilegedActionException
Build a SPNEGO Authorization string using Kerberos credentials for a user based on userid and password provided. The method will login to the Kerberos Key Distribution (KDC) with the supplied userid and password to get a Ticket Granting Ticket (TGT) then will request the SPNEGO token with that TGT for the specified ServicePrincipalName.- Parameters:
spn
- - ServicePrincipalName of system for which SPNEGO token will be targeted.userid
- - Userid for the Loginpassword
- - Password for the LoginjaasLoginContextEntry
- - JAAS login context entry to use.lifetime
- - Lifetime for the context, for example GSSCredential.INDEFINITE_LIFETIMEdelegate
- - whether the token includes delegatable GSSCredentials.- Returns:
- - String "Negotiate " + Base64 encoded version of SPNEGO Token
- Throws:
org.ietf.jgss.GSSException
- - thrown when SPNEGO token generation fails, when userid or password is null, or when SPN is invalid.javax.security.auth.login.LoginException
- - thrown when the Login fails with the supplied userid and password.java.security.PrivilegedActionException
- - unexpected - thrown when Java 2 security is misconfigured.
-
-