/****
GSSClient.java
****/
import java.io.*;
import java.util.*;
import java.security.*;
import org.ietf.jgss.*;
import java.net.Socket;
import javax.security.auth.login.*;
import javax.security.auth.Subject;
class GSSClient
implements java.security.PrivilegedAction {
//Handles callback from the JAAS framework.
BeanCallbackHandler beanCallbackHandler = null;
//The main object that handles all JAAS login.
LoginContext peerLC = null;
//Socket and streams used for communication.
Socket socket = null;
DataInputStream inStream;
DataOutputStream outStream;
//This and remote clients.
String clientName = null;
String serverName = null;
//Address and port of remote server.
String serverAddress = null;
int serverPort;
//The name of the client configuration.
String confName = null;
public static void main(String[] args) {
if (args.length < 9) {
System.err.println("Usage: java <options> KrberosLogin "
+ " <clientname> <password> <servername> "
+ " <serveraddress> <server port> "
+ " <realm address> <kdc address> "
+ " <name and path of conf file > <conf name ");
System.exit(-1);
}
GSSClient gssClient =
new GSSClient (args[0]/*client name*/ ,
args[1]/*password*/,
args[2]/*clientName*/,
args[3]/*serveraddress*/,
Integer.parseInt(args[4])/*serverport*/,
args[5]/*kerberos realm name*/,
args[6]/*kdc addres*/,
args[7]/*name and path of conf file*/,
args[8]/*conf name*/ );
GSSContext context = gssClient.login();
if (context!=null)
{
String response = null;
//Checking confidentiality status of context.
if (context.getConfState())
{
response = gssClient.sendMessage(context,
"A sample message from client");
System.out.println ("Server Response "+response);
}//if
try {
gssClient.getLoginContext().logout();
context.dispose();
} catch (Exception e) {
e.printStackTrace();
}//catch
}
else
System.out.println("Client authentication deined...");
}//main
//The GSSClient constructor only sets all the required parameters.
public GSSClient (String clientName, String password,
String serverName, String serverAddress,
int serverPort, String kerberosRealm,
String kdcAddress, String confFile, String confName)
{
//The beanCallbackHandler will require the name and password of the client.
beanCallbackHandler = new BeanCallbackHandler(clientName, password);
this.clientName = clientName;
this.serverName = serverName;
this.serverAddress = serverAddress;
this.serverPort = serverPort;
this.confName = confName;
System.setProperty("java.security.krb5.realm", kerberosRealm);
System.setProperty("java.security.krb5.kdc", kdcAddress);
System.setProperty("java.security.auth.login.config", confFile);
System.out.println(this.clientName);
}// KerberoseLoginBean
public GSSContext login()
{
try {
peerLC = new LoginContext(confName, beanCallbackHandler);
peerLC.login();
socket = new Socket(serverAddress, serverPort);
inStream = new DataInputStream(socket.getInputStream());
outStream = new DataOutputStream(socket.getOutputStream());
return (GSSContext) Subject.doAs( peerLC.getSubject(), this);
}
catch (Exception e) {
System.out.println( ">>>> GSSClient....
Secure Context not established.." );
e.printStackTrace();
return null;
}//catch
}//establishSecureContextWithServer
//This is the only method in PrivilegedAction interface.
//It receives control only in case of successful authentication of the client.
public Object run() {
try {
GSSManager manager = GSSManager.getInstance();
Oid kerberos = new Oid("1.2.840.113554.1.2.2");
GSSName clientPeerName = manager.createName(
//Name of the client for which we want to create this GSSName object.
clientName ,
//Type of GSSName. Our client is a Windows user,
//which we can specifiy using GSSName.NT_USER_NAME property.
GSSName.NT_USER_NAME);
GSSName remotePeerName = manager.createName(serverName, GSSName.NT_USER_NAME);
System.out.println (">>> GSSClient... Getting client credentials");
GSSCredential peerCredentials = manager.createCredential(
//The GSSName object of the client.
clientPeerName,
//Time for which credentials whill be valid.
10*60,
//Kerberos mecahnism identifier.
kerberos,
//The client only intiates the secure context request.
GSSCredential.INITIATE_ONLY);
System.out.println (">>> GSSClient...
GSSManager creating security context");
GSSContext peerContext = manager.createContext(remotePeerName,
kerberos,
peerCredentials,
GSSContext.DEFAULT_LIFETIME);
peerContext.requestConf(true);
byte[] byteToken = new byte[0];
System.out.println (">>> GSSClient...
Sending token to server over secure context");
while (!peerContext.isEstablished()) {
byteToken = peerContext.initSecContext(byteToken, 0, byteToken.length);
if (byteToken != null) {
outStream.writeInt(byteToken.length);
outStream.write(byteToken );
outStream.flush();
}//if
if (!peerContext.isEstablished()) {
byteToken = new byte[inStream.readInt()];
inStream.readFully(byteToken );
}//if
}//while (!peerContext...)
return peerContext;
}//try
catch(org.ietf.jgss.GSSException ge) {
System.out.println (">>> GSSClient...
GSS Exception "+ge.getMessage());
}
catch(java.lang.Exception e) {
System.out.println (">>> GSSClient...
Exception "+e.getMessage());
}//catch
return null;
}//run
//Sends a message to the remote server on an already established context.
//It returns the reply from the remote server.
public String sendMessage(GSSContext context, String message)
{
byte[] serverMessage = null;
byte[] clientMessage = null;
MessageProp msgProp = new MessageProp(0, true);
try {
System.out.println(">>> GSSClient...
Client message is ["+message+"]");
clientMessage = context.wrap (message.getBytes(),
0, message.getBytes().length, msgProp);
outStream.writeInt(clientMessage.length);
outStream.write(clientMessage);
outStream.flush();
//Receiving server response and sending back to client.
serverMessage = new byte[inStream.readInt()];
inStream.readFully(serverMessage);
serverMessage = context.unwrap(serverMessage,
0, serverMessage.length, msgProp);
System.out.println(">>> GSSClient...
Server message is ["+serverMessage+"]");
return new String (serverMessage);
} catch(Exception e){
e.printStackTrace();
return null;
}
}//sendMessage
//It returns the established login context to client.
public LoginContext getLoginContext()
{
return peerLC;
}//getloginContext
}//GSSClient
|
