Package com.sun.gssapi
Class GSSCredential
java.lang.Object
com.sun.gssapi.GSSCredential
This class manages GSS-API credentials and their associated
operations. A credential contains all the necessary cryptographic
information to enable the creation of a context on behalf of the
entity that it represents. It may contain multiple distinct mechanism
specific credential elements, each containing mechanism specific
information, and all referring to the same entity.
A credential may be used to perform context initiation, acceptance, or both.
- RFC 2078
- This class represents the credential management GSS-API calls,
which are:
- gs_acquire_cred
- gss_release_cred
- gss_inquire_cred
- gss_add_cred
- gss_inquire_cred_by_mech
-
Field Summary
FieldsModifier and TypeFieldDescriptionstatic final int
Credential usage flag requesting that it be able to be used for context acceptance only.static final int
Indefinite lifetime for a credential.static final int
Credential usage flag requesting that it be able to be used for both context initiation and acceptance.static final int
Credential usage flag requesting that it be able to be used for context initiation only. -
Constructor Summary
ConstructorsConstructorDescriptionGSSCredential
(int usage) Constructor for default credentials.GSSCredential
(GSSName aName, int usage) Constructor for default mechanism credential.GSSCredential
(GSSName aName, int lifetime, Oid[] mechs, int usage) Constructor for a credential over a set of mechanisms.GSSCredential
(GSSName aName, int lifetime, Oid mechOid, int usage) Constructor for a single mechanism credential. -
Method Summary
Modifier and TypeMethodDescriptionvoid
This method enables the construction of credentials one mechanism at a time.void
dispose()
Used to dispose of any sensitive information that the GSSCredential may be containing.boolean
Tests if this GSSCredential refers to the same entity as the supplied object.Retrieves the name of the entity that the credential has been acquired for.getGSSName
(Oid mechOID) Queries the selected mechanism for the principal name of the credential.Oid[]
getMechs()
Returns the mechanism oids over which the credential has been acquired.int
Returns the remaining lifetime in seconds for the credential to remain capable of accepting security context under the specified mechanism.int
getRemainingInitLifetime
(Oid mech) Returns the remaining lifetime in seconds for the credential to remain capable of initiating security context under the specified mechanism.int
Obtains the remaining lifetime for a credential.int
getUsage()
Retrieve the credential usage flag, which is one of INITIATE_ONLY, ACCEPT_ONLY, INITIATE_AND_ACCEPT.int
Retrieve the credential usage flag, which is one of INITIATE_ONLY, ACCEPT_ONLY, INITIATE_AND_ACCEPT, for a specific credential mechanism.toString()
Debugging aid.
-
Field Details
-
INITIATE_AND_ACCEPT
public static final int INITIATE_AND_ACCEPTCredential usage flag requesting that it be able to be used for both context initiation and acceptance.- See Also:
-
INITIATE_ONLY
public static final int INITIATE_ONLYCredential usage flag requesting that it be able to be used for context initiation only.- See Also:
-
ACCEPT_ONLY
public static final int ACCEPT_ONLYCredential usage flag requesting that it be able to be used for context acceptance only.- See Also:
-
INDEFINITE
public static final int INDEFINITEIndefinite lifetime for a credential. It is set to the largest value for an int in Java.- See Also:
-
-
Constructor Details
-
GSSCredential
Constructor for default credentials. This will use the default mechanism, default mechanism name, and an INDEFINITE lifetime.- RFC 2078
- equivalent to gss_acquire_cred
- Parameters:
usage
- - the intended usage for this credential; this must be one of the constants defined in this class.- Throws:
GSSException
- with possible major code of FAILURE
-
GSSCredential
Constructor for default mechanism credential. Uses default mechanism and INDEFINITE lifetime.- RFC 2078
- equivalent to gss_acquire_cred
- Parameters:
aName
- - name of the principal for whom this credential is to be acquiredusage
- - the intended usage for this credential; this must be one of the constants defined in this class- Throws:
GSSException
- with possible major codes of FAILURE and BAD_NAME
-
GSSCredential
Constructor for a single mechanism credential. null values can be specified for name and mechanism to obtain system specific defaults.- RFC 2078
- equivalent to gss_acquire_cred
- Parameters:
aName
- - name of the principal for whom this credential is to be acquired; use null for system specific default principallifetime
- - the duration of this credentialmechOid
- - mechanism over which this credential is to be acquiredusage
- - the intended usage for this credential; this must be one of the constants defined in this class- Throws:
GSSException
- with possible major codes of FAILURE, BAD_MECH, and BAD_NAME
-
GSSCredential
Constructor for a credential over a set of mechanisms. Acquires credentials for each of the mechanisms specified in mechs array. null value can be used for Name to obtain system specific default. To determine for which mechanisms acquiring of the credential was successful use the getMechs method. Note that this call is equivalent to creating a single mechanism credential and using addCred to extend the credential over other mechanisms.- RFC 2078
- equivalent to gss_acquire_cred
- Parameters:
aName
- - name of the principal for whom this credential is to be acquired; use null for system specific default principallifetime
- - the desired duration of this credentialmechs
- - mechanisms over which this credential is to be acquiredusage
- - the intended usage for this credential; this must be one of the constants defined in this class- Throws:
GSSException
- with possible major codes of FAILURE, BAD_MECH, and BAD_NAME
-
-
Method Details
-
dispose
Used to dispose of any sensitive information that the GSSCredential may be containing. Should be called as soon as the credential is no longer needed to minimize the time sensitive information is maintained.- RFC 2078
- equivalent to gss_release_cred
- Throws:
GSSException
- with possible major code of FAILURE
-
getGSSName
Retrieves the name of the entity that the credential has been acquired for.- RFC 2078
- equivalent to obtaining the cred_name parameter from gss_inquire_cred
- Returns:
- GSSName for the credential's principal
- Throws:
GSSException
- with possible major codes of FAILURE, NO_CRED, DEFECTIVE_CREDENTIAL, CREDENTIAL_EXPIRED
-
getGSSName
Queries the selected mechanism for the principal name of the credential. The mechanism must be one of the mechanisms over which the credential is acquired.- RFC 2078
- equivalent to obtaining the cred_name parameter from gss_inquire_cred_by_mech
- Parameters:
mechOID
- the credential mechanism to be queried- Throws:
GSSException
- with possible major codes of NO_CRED, DEFECTIVE_CREDENTIAL, CREDENTIALS_EXPIRED, FAILURE and BAD_MECH
-
getRemainingLifetime
Obtains the remaining lifetime for a credential. The remaining lifetime is the minimum lifetime for any of the credential elements. Return of 0 indicates the credential is already expired.- RFC 2078
- equivalent to lifetime parameter in gss_inquire_cred
- Returns:
- lifetime in seconds
- Throws:
GSSException
- with possible major codes of NO_CRED, DEFECTIVE_CREDENTIAL, FAILURE.
-
getRemainingInitLifetime
Returns the remaining lifetime in seconds for the credential to remain capable of initiating security context under the specified mechanism. Return of 0 indicates that the credential is already expired.- RFC 2078
- equivalent to lifetime_init parameter in gss_inquire_cred_by_mech
- Parameters:
mech
- Oid for the credential mechanism to be queried- Returns:
- the remaining initiation lifetime in seconds
- Throws:
GSSException
- with possible major codes of NO_CRED, DEFECTIVE_CREDENTIAL, FAILURE and BAD_MECH
-
getRemainingAcceptLifetime
Returns the remaining lifetime in seconds for the credential to remain capable of accepting security context under the specified mechanism. Return of 0 indicates that the credential is already expired.- RFC 2078
- equivalent to lifetime_accept parameter in gss_inquire_cred_by_mech
- Parameters:
mech
- Oid for the credential mechanism to be queried- Returns:
- the remaining acceptance lifetime in seconds
- Throws:
GSSException
- with possible major codes of NO_CRED, DEFECTIVE_CREDENTIAL, FAILURE and BAD_MECH
-
getUsage
Retrieve the credential usage flag, which is one of INITIATE_ONLY, ACCEPT_ONLY, INITIATE_AND_ACCEPT.- RFC 2078
- equivalent to usage parameter in gss_inquire_cred
- Returns:
- credential usage which will be only of INITIATE_ONLY, ACCEPT_ONLY, or INITIATE_AND_ACCEPT
- Throws:
GSSException
- with possible major codes of NO_CRED, DEFECTIVE_CREDENTIAL, CREDENTIALS_EXPIRED, FAILURE.
-
getUsage
Retrieve the credential usage flag, which is one of INITIATE_ONLY, ACCEPT_ONLY, INITIATE_AND_ACCEPT, for a specific credential mechanism.- RFC 2078
- equivalent to usage parameter in gss_inquire_cred_by_mech
- Parameters:
oid
- for the credential mechanism to query- Returns:
- credential usage which will be only of INITIATE_ONLY, ACCEPT_ONLY, or INITIATE_AND_ACCEPT
- Throws:
GSSException
- with possible major codes of NO_CRED, DEFECTIVE_CREDENTIAL, CREDENTIALS_EXPIRED, FAILURE.
-
getMechs
Returns the mechanism oids over which the credential has been acquired.- RFC 2078
- equivalent to mech_set parameter of gss_inquire_cred
- Returns:
- the array of mechanism oid's over which this credential has been acquired
- Throws:
GSSException
- with possible major codes of FAILURE, NO_CRED, DEFECTIVE_CREDENTIAL, CREDENTIAL_EXPIRED
-
add
public void add(GSSName aName, int initLifetime, int acceptLifetime, Oid mech, int usage) throws GSSException This method enables the construction of credentials one mechanism at a time. A single mechanism credential will be added as specified by the mech parameter. This is equivalent to using the constructor for multiple mechanism but gives finer control and feedback.- RFC 2078
- equivalent to gss_add_cred
to obtain a new credential as in gss_add_cred, first call clone and then addCred
- Parameters:
aName
- - name of the principal for whom this credential is to be acquired; use null for system specific default principalinitLifetime
- - the desired duration of this credential initiation lifetime; value in secondsacceptLifetime
- - the desired duration of this credential accept lifetime; value in secondsusage
- - the intended usage for this credential; this must be one of the constants defined in this classmechs
- - mechanism over which this credential is to be acquired- Throws:
GSSException
- with possible major codes of DUPLICATE_ELEMENT, BAD_MECH, BAD_NAME, BAD_NAME, NO_CRED, or FAILURE.
-
equals
Tests if this GSSCredential refers to the same entity as the supplied object. The two GSSCredentials must be acquired over the same mechanisms. -
toString
Debugging aid. Returns string with information about this credential object.
-