Class Krb5LoginModule

  • java.lang.Object
  • All Implemented Interfaces:

    public class Krb5LoginModule
    extends java.lang.Object

    A JAAS LoginModule for acquiring Kerberos credentials.

    Supported options (specified in a JAAS configuration file):

     1) Kerberos options
           credsType=initiator|acceptor|both (default=initiator)
           forwardable=true|false (default=false)
           proxiable=true|false (default=false)
           renewable=true|false (default=false)
           useDefaultCcache=true|false (default=false)
           useDefaultKeytab=true|false (default=false)
      2) JAAS-suggested options:
           debug=true|false (default=unset, JGSS debug options used)
           tryFirstPass=true|false (default=false)
           useFirstPass=true|false (default=false)
           moduleBanner=true|false (default=false)
     1) Default realm (which is obtained from the Kerberos config file) is
        used if the principal specified does not include a realm component.
     2) debug option: true is equivalent to
                      false is equivalent to
        The debug option affects debug from the Login module only;
        other subcomponents of JGSS are not affected.
     3) Boolean options can be set to "true" or "yes", "false" or "no"
     4) The keytab and ccache options take precedence over tryFirstPass.
        If a keytab or ccache option is set in addition to tryFirstPass,
        the keytab or ccache is used and the principal saved in the shared state
        if login is succesful. There will be no prompting for password if
        the login fails.
     5) The keytab and ccache options are incompatible with the
        useFirstPass option; specifying useFirstPass in conjunction with
        either a keytab or ccache option will cause an exception to be thrown.
     6) From the Java 1.4 JAAS guide:
     try_first_pass - If true, the first LoginModule in the stack
         saves the password entered, and subsequent LoginModules also
         try to use it. If authentication fails, the LoginModules prompt
         for a new password and retry the authentication.
      use_first_pass - If true, the first LoginModule in the stack
         saves the password entered, and subsequent LoginModules also
         try to use it. LoginModules do not prompt for a new password
         if authentication fails (authentication simply fails).
      moduleBanner - If true, then when invoking the CallbackHandler,
         the LoginModule provides a TextOutputCallback as the first Callback,
         which describes the LoginModule performing the authentication.
      debug - If true, instructs a LoginModule to output debugging information.

    • Constructor Summary

      Constructor and Description
    • Method Summary

      All Methods Instance Methods Concrete Methods 
      Modifier and Type Method and Description
      boolean abort()
      Abort the login
      boolean commit()
      commit the login for user
      void initialize( subject, callbackHandler, java.util.Map sharedState, java.util.Map options) 
      boolean login()
      boolean logout()
      Logout the user.
      • Methods inherited from class java.lang.Object

        clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
    • Constructor Detail

      • Krb5LoginModule

        public Krb5LoginModule()
    • Method Detail

      • initialize

        public void initialize( subject,
                               java.util.Map sharedState,
                               java.util.Map options)
        Specified by:
        initialize in interface
        subject -
        callbackHandler -
        sharedState -
        options -
      • login

        public boolean login()
        Specified by:
        login in interface
        true if login is successful
      • commit

        public boolean commit()
        commit the login for user
        Specified by:
        commit in interface
        true if commit is successful
      • abort

        public boolean abort()
        Abort the login
        Specified by:
        abort in interface
        true if abort is successful
      • logout

        public boolean logout()
        Logout the user.

        This method removes the Principal that was added by the commit method.

        Specified by:
        logout in interface
        true in all cases since this LoginModule should not be ignored.
        Throws: - if the logout fails.

© Portions Copyright 2003, 2015 IBM Corporation. All rights reserved.
© Portions Copyright 2003, 2015, Oracle and/or its affiliates. All rights reserved.