Package net.shibboleth.idp.authn.impl

Class KerberosCredentialValidator

  • All Implemented Interfaces:
    net.shibboleth.idp.authn.CredentialValidator, net.shibboleth.idp.authn.principal.PrincipalSupportingComponent, net.shibboleth.utilities.java.support.component.Component, net.shibboleth.utilities.java.support.component.DestructableComponent, net.shibboleth.utilities.java.support.component.IdentifiableComponent, net.shibboleth.utilities.java.support.component.IdentifiedComponent, net.shibboleth.utilities.java.support.component.InitializableComponent
    @ThreadSafe
public class KerberosCredentialValidator
extends net.shibboleth.idp.authn.AbstractUsernamePasswordCredentialValidator
    A password validator that authenticates against Kerberos natively, with optional service ticket verification.
    Since:
    4.0.0

    • Nested Class Summary

      Nested Classes 
      Modifier and Type Class Description
      private class  KerberosCredentialValidator.SimpleCallbackHandler
      A callback handler that provides static name and password data to a JAAS login process.

      • Nested classes/interfaces inherited from interface net.shibboleth.idp.authn.CredentialValidator

        net.shibboleth.idp.authn.CredentialValidator.ErrorHandler, net.shibboleth.idp.authn.CredentialValidator.WarningHandler

    • Method Summary

      All Methods Instance Methods Concrete Methods 
      Modifier and Type Method Description
      protected void doInitialize()
      protected Subject doValidate​(org.opensaml.profile.context.ProfileRequestContext profileRequestContext, net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext, net.shibboleth.idp.authn.context.UsernamePasswordContext usernamePasswordContext, net.shibboleth.idp.authn.CredentialValidator.WarningHandler warningHandler, net.shibboleth.idp.authn.CredentialValidator.ErrorHandler errorHandler)
      protected Subject populateSubject​(Subject subject, net.shibboleth.idp.authn.context.UsernamePasswordContext usernamePasswordContext)
      void setKeytabPath​(String path)
      Provides a keytab for the service principal to use to verify the KDC.
      void setLoginModuleClassName​(String name)
      Set the name of the JAAS LoginModule to use to acquire Kerberos credentials.
      void setPreserveTicket​(boolean flag)
      Set whether to save the TGT in the Subject.
      void setRefreshKrb5Config​(boolean flag)
      Set whether to refresh the Kerberos configuration before running.
      void setServicePrincipal​(String name)
      Set the name of a service principal to use to verify the KDC.
      private void verifyKDC​(Subject subject)
      Use credentials to acquire and verify a service ticket.

      • Methods inherited from class net.shibboleth.idp.authn.AbstractUsernamePasswordCredentialValidator

        applyTransforms, doValidate, removeContextAfterValidation, savePasswordToCredentialSet, setLowercase, setMatchExpression, setRemoveContextAfterValidation, setSavePasswordToCredentialSet, setTransforms, setTrim, setUppercase, setUsernamePasswordContextLookupStrategy

      • Methods inherited from class net.shibboleth.idp.authn.AbstractCredentialValidator

        getLogPrefix, getSupportedPrincipals, isAcceptable, populateSubject, setActivationCondition, setId, setSupportedPrincipals, validate

      • Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractIdentifiedInitializableComponent

        getId

      • Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

        destroy, doDestroy, initialize, isDestroyed, isInitialized

      • Methods inherited from interface net.shibboleth.utilities.java.support.component.IdentifiedComponent

        getId

    • Field Detail

      • log

        @Nonnull
private final org.slf4j.Logger log
        Class logger.

      • loginModuleClassName

        @NonnullAfterInit
@NotEmpty
private String loginModuleClassName
        Class name of JAAS LoginModule to acquire Kerberos credentials.

      • refreshKrb5Config

        private boolean refreshKrb5Config
        Refresh the Kerberos config before running?

      • preserveTicket

        private boolean preserveTicket
        Save the TGT in the resulting Subject?

      • servicePrincipal

        private String servicePrincipal
        Service principal to acquire a ticket for to verify KDC.

      • keytabPath

        private String keytabPath
        Path to keytab for service principal.

      • clientOptions

        @NonnullAfterInit
private Map<String,​String> clientOptions
        JAAS options for client login.

      • serverOptions

        @NonnullAfterInit
private Map<String,​String> serverOptions
        JAAS options for server login.

    • Constructor Detail

      • KerberosCredentialValidator

        public KerberosCredentialValidator()
        Constructor.

    • Method Detail

      • setLoginModuleClassName

        public void setLoginModuleClassName​(@Nonnull
                                    String name)
        Set the name of the JAAS LoginModule to use to acquire Kerberos credentials.
        Parameters:
        name - name of login module class

      • setRefreshKrb5Config

        public void setRefreshKrb5Config​(boolean flag)
        Set whether to refresh the Kerberos configuration before running.
        Parameters:
        flag - flag to set

      • setPreserveTicket

        public void setPreserveTicket​(boolean flag)
        Set whether to save the TGT in the Subject.
        Parameters:
        flag - flag to set

      • setServicePrincipal

        public void setServicePrincipal​(@Nullable
                                String name)
        Set the name of a service principal to use to verify the KDC.

        If non-null, a keytab resource must also be set.

        Parameters:
        name - name of service principal

      • setKeytabPath

        public void setKeytabPath​(@Nullable
                          String path)
        Provides a keytab for the service principal to use to verify the KDC.
        Parameters:
        path - path to file containing a keytab

      • doInitialize

        protected void doInitialize()
                     throws net.shibboleth.utilities.java.support.component.ComponentInitializationException
        Overrides:
        doInitialize in class net.shibboleth.utilities.java.support.component.AbstractIdentifiedInitializableComponent
        Throws:
        net.shibboleth.utilities.java.support.component.ComponentInitializationException

      • doValidate

        protected Subject doValidate​(@Nonnull
                             org.opensaml.profile.context.ProfileRequestContext profileRequestContext,
                             @Nonnull
                             net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext,
                             @Nonnull
                             net.shibboleth.idp.authn.context.UsernamePasswordContext usernamePasswordContext,
                             @Nullable
                             net.shibboleth.idp.authn.CredentialValidator.WarningHandler warningHandler,
                             @Nullable
                             net.shibboleth.idp.authn.CredentialValidator.ErrorHandler errorHandler)
                      throws Exception
        Specified by:
        doValidate in class net.shibboleth.idp.authn.AbstractUsernamePasswordCredentialValidator
        Throws:
        Exception

      • populateSubject

        @Nonnull
protected Subject populateSubject​(@Nonnull
                                  Subject subject,
                                  @Nonnull
                                  net.shibboleth.idp.authn.context.UsernamePasswordContext usernamePasswordContext)
        Overrides:
        populateSubject in class net.shibboleth.idp.authn.AbstractUsernamePasswordCredentialValidator

      • verifyKDC

        private void verifyKDC​(@Nonnull
                       Subject subject)
                throws Exception
        Use credentials to acquire and verify a service ticket.
        Parameters:
        subject - client identity
        Throws:
        Exception - if an error occurs