6853328: Support OK-AS-DELEGATE flag Reviewed-by: nobody diff -r 41268d273c0b src/share/classes/com/sun/security/jgss/ExtendedGSSContext.java --- a/src/share/classes/com/sun/security/jgss/ExtendedGSSContext.java +++ b/src/share/classes/com/sun/security/jgss/ExtendedGSSContext.java @@ -99,4 +99,58 @@ */ public Object inquireSecContext(InquireType type) throws GSSException; + + /** + * Requests that the delegation policy be respected. When a true value is + * requested, the underlying context would use the delegation policy + * defined by the environment as a hint to determine whether credentials + * delegation should be performed. This request can only be made on the + * context initiator's side and it has to be done prior to the first + * call to <code>initSecContext</code>. + * <p> + * When this flag is false, delegation will only be tried when the + * {@link GSSContext#requestCredDeleg(boolean) credentials delegation flag} + * is true. + * <p> + * When this flag is true but the + * {@link GSSContext#requestCredDeleg(boolean) credentials delegation flag} + * is false, delegation will be only tried if the delegation policy permits + * delegation. + * <p> + * When both this flag and the + * {@link GSSContext#requestCredDeleg(boolean) credentials delegation flag} + * are true, delegation will be always tried. However, if the delegation + * policy does not permit delegation, the value of + * {@link #getDelegPolicyState} will be false, even + * if delegation is performed successfully. + * <p> + * In any case, if the delegation is not successful, the value returned + * by {@link GSSContext#getCredDelegState()} is false, and the value + * returned by {@link #getDelegPolicyState()} is also false. + * <p> + * Not all mechanisms support delegation policy. Therefore, the + * application should check to see if the request was honored with the + * {@link #getDelegPolicyState() getDelegPolicyState} method. When + * delegation policy is not supported, <code>requestDelegPolicy</code> + * should return silently without throwing an exception. + * <p> + * Note: for the Kerberos 5 mechanism, the delegation policy is expressed + * through the OK-AS-DELEGATE flag in the service ticket. When it's true, + * the KDC permits delegation to the target server. In a cross-realm + * environment, in order for delegation be permitted, all cross-realm TGTs + * on the authentication path must also have the OK-AS-DELAGATE flags set. + * @param state true if the policy should be respected + * @throws GSSException containing the following + * major error codes: + * {@link GSSException#FAILURE GSSException.FAILURE} + */ + public void requestDelegPolicy(boolean state) throws GSSException; + + /** + * Returns the delegation policy response. Called after a security context + * is established. This method can be only called on the initiator's side. + * See {@link ExtendedGSSContext#requestDelegPolicy}. + * @return the delegation policy response + */ + public boolean getDelegPolicyState(); } diff -r 41268d273c0b src/share/classes/org/ietf/jgss/GSSContext.java --- a/src/share/classes/org/ietf/jgss/GSSContext.java +++ b/src/share/classes/org/ietf/jgss/GSSContext.java @@ -678,7 +678,7 @@ * are not definitive then the method will attempt to treat all * available bytes as part of the token.<p> * - * Other than the possible blocking behaviour described above, this + * Other than the possible blocking behavior described above, this * method is equivalent to the byte array based {@link #unwrap(byte[], * int, int, MessageProp) unwrap} method.<p> * @@ -826,7 +826,7 @@ * are not definitive then the method will attempt to treat all * available bytes as part of the token.<p> * - * Other than the possible blocking behaviour described above, this + * Other than the possible blocking behavior described above, this * method is equivalent to the byte array based {@link #verifyMIC(byte[], * int, int, byte[], int, int, MessageProp) verifyMIC} method.<p> * @@ -917,7 +917,7 @@ * getMutualAuthState} method.<p> * * @param state a boolean value indicating whether mutual - * authentication shouls be used or not. + * authentication should be used or not. * @see #getMutualAuthState() * * @throws GSSException containing the following @@ -928,7 +928,7 @@ /** * Requests that replay detection be enabled for the - * per-message security services after context establishemnt. This + * per-message security services after context establishment. This * request can only be made on the context initiator's side and it has * to be done prior to the first call to * <code>initSecContext</code>. During context establishment replay @@ -958,7 +958,7 @@ /** * Requests that sequence checking be enabled for the - * per-message security services after context establishemnt. This + * per-message security services after context establishment. This * request can only be made on the context initiator's side and it has * to be done prior to the first call to * <code>initSecContext</code>. During context establishment sequence diff -r 41268d273c0b src/share/classes/sun/net/www/protocol/http/NegotiatorImpl.java --- a/src/share/classes/sun/net/www/protocol/http/NegotiatorImpl.java +++ b/src/share/classes/sun/net/www/protocol/http/NegotiatorImpl.java @@ -25,6 +25,7 @@ package sun.net.www.protocol.http; +import com.sun.security.jgss.ExtendedGSSContext; import java.io.IOException; import java.net.Authenticator; @@ -102,15 +103,10 @@ deleg, GSSContext.DEFAULT_LIFETIME); - // In order to support credential delegation in HTTP/SPNEGO, - // we always request it before initSecContext. The current - // implementation will check the OK-AS-DELEGATE flag inside - // the service ticket of the web server, and only enable - // delegation when this flag is set. This check is only - // performed when the GSS caller is CALLER_HTTP_NEGOTIATE, - // so all other normal GSS-API calls are not affected. - - context.requestCredDeleg(true); + // Always respect delegation policy in HTTP/SPNEGO. + if (context instanceof ExtendedGSSContext) { + ((ExtendedGSSContext)context).requestDelegPolicy(true); + } oneToken = context.initSecContext(new byte[0], 0, 0); } diff -r 41268d273c0b src/share/classes/sun/security/jgss/GSSContextImpl.java --- a/src/share/classes/sun/security/jgss/GSSContextImpl.java +++ b/src/share/classes/sun/security/jgss/GSSContextImpl.java @@ -89,7 +89,8 @@ */ class GSSContextImpl implements ExtendedGSSContext { - private GSSManagerImpl gssManager = null; + private final GSSManagerImpl gssManager; + private final boolean initiator; // private flags for the context state private static final int PRE_INIT = 1; @@ -99,14 +100,12 @@ // instance variables private int currentState = PRE_INIT; - private boolean initiator; private GSSContextSpi mechCtxt = null; private Oid mechOid = null; private ObjectIdentifier objId = null; private GSSCredentialImpl myCred = null; - private GSSCredentialImpl delegCred = null; private GSSNameImpl srcName = null; private GSSNameImpl targName = null; @@ -121,6 +120,7 @@ private boolean reqSequenceDetState = true; private boolean reqCredDelegState = false; private boolean reqAnonState = false; + private boolean reqDelegPolicyState = false; /** * Creates a GSSContextImp on the context initiator's side. @@ -221,6 +221,7 @@ mechCtxt.requestSequenceDet(reqSequenceDetState); mechCtxt.requestAnonymity(reqAnonState); mechCtxt.setChannelBinding(channelBindings); + mechCtxt.requestDelegPolicy(reqDelegPolicyState); objId = new ObjectIdentifier(mechOid.toString()); @@ -472,42 +473,42 @@ } public void requestMutualAuth(boolean state) throws GSSException { - if (mechCtxt == null) + if (mechCtxt == null && initiator) reqMutualAuthState = state; } public void requestReplayDet(boolean state) throws GSSException { - if (mechCtxt == null) + if (mechCtxt == null && initiator) reqReplayDetState = state; } public void requestSequenceDet(boolean state) throws GSSException { - if (mechCtxt == null) + if (mechCtxt == null && initiator) reqSequenceDetState = state; } public void requestCredDeleg(boolean state) throws GSSException { - if (mechCtxt == null) + if (mechCtxt == null && initiator) reqCredDelegState = state; } public void requestAnonymity(boolean state) throws GSSException { - if (mechCtxt == null) + if (mechCtxt == null && initiator) reqAnonState = state; } public void requestConf(boolean state) throws GSSException { - if (mechCtxt == null) + if (mechCtxt == null && initiator) reqConfState = state; } public void requestInteg(boolean state) throws GSSException { - if (mechCtxt == null) + if (mechCtxt == null && initiator) reqIntegState = state; } public void requestLifetime(int lifetime) throws GSSException { - if (mechCtxt == null) + if (mechCtxt == null && initiator) reqLifetime = lifetime; } @@ -637,6 +638,8 @@ targName = null; } + // ExtendedGSSContext methods: + @Override public Object inquireSecContext(InquireType type) throws GSSException { SecurityManager security = System.getSecurityManager(); @@ -648,4 +651,18 @@ } return mechCtxt.inquireSecContext(type); } + + @Override + public void requestDelegPolicy(boolean state) throws GSSException { + if (mechCtxt == null && initiator) + reqDelegPolicyState = state; + } + + @Override + public boolean getDelegPolicyState() { + if (mechCtxt != null) + return mechCtxt.getDelegPolicyState(); + else + return reqDelegPolicyState; + } } diff -r 41268d273c0b src/share/classes/sun/security/jgss/krb5/InitialToken.java --- a/src/share/classes/sun/security/jgss/krb5/InitialToken.java +++ b/src/share/classes/sun/security/jgss/krb5/InitialToken.java @@ -85,32 +85,39 @@ int size = CHECKSUM_LENGTH_SIZE + CHECKSUM_BINDINGS_SIZE + CHECKSUM_FLAGS_SIZE; + if (!tgt.isForwardable()) { + context.setCredDelegState(false); + context.setDelegPolicyState(false); + } else if (context.getCredDelegState()) { + if (context.getDelegPolicyState()) { + if (!serviceTicket.checkDelegate()) { + // delegation not permitted by server policy, mark it + context.setDelegPolicyState(false); + } + } + } else if (context.getDelegPolicyState()) { + if (serviceTicket.checkDelegate()) { + context.setCredDelegState(true); + } else { + context.setDelegPolicyState(false); + } + } + if (context.getCredDelegState()) { - if (context.getCaller() instanceof HttpCaller && - !serviceTicket.getFlags()[Krb5.TKT_OPTS_DELEGATE]) { - // When the caller is HTTP/SPNEGO and OK-AS-DELEGATE - // is not present in the service ticket, delegation - // is disabled. - context.setCredDelegState(false); - } else if (!tgt.isForwardable()) { - // XXX log this resetting of delegation state - context.setCredDelegState(false); + KrbCred krbCred = null; + CipherHelper cipherHelper = + context.getCipherHelper(serviceTicket.getSessionKey()); + if (useNullKey(cipherHelper)) { + krbCred = new KrbCred(tgt, serviceTicket, + EncryptionKey.NULL_KEY); } else { - KrbCred krbCred = null; - CipherHelper cipherHelper = - context.getCipherHelper(serviceTicket.getSessionKey()); - if (useNullKey(cipherHelper)) { - krbCred = new KrbCred(tgt, serviceTicket, - EncryptionKey.NULL_KEY); - } else { - krbCred = new KrbCred(tgt, serviceTicket, - serviceTicket.getSessionKey()); - } - krbCredMessage = krbCred.getMessage(); - size += CHECKSUM_DELEG_OPT_SIZE + - CHECKSUM_DELEG_LGTH_SIZE + - krbCredMessage.length; - } + krbCred = new KrbCred(tgt, serviceTicket, + serviceTicket.getSessionKey()); + } + krbCredMessage = krbCred.getMessage(); + size += CHECKSUM_DELEG_OPT_SIZE + + CHECKSUM_DELEG_LGTH_SIZE + + krbCredMessage.length; } checksumBytes = new byte[size]; @@ -296,6 +303,7 @@ return delegCreds; } + // Only called by acceptor public void setContextFlags(Krb5Context context) { // default for cred delegation is false if ((flags & CHECKSUM_DELEG_FLAG) > 0) diff -r 41268d273c0b src/share/classes/sun/security/jgss/krb5/Krb5Context.java --- a/src/share/classes/sun/security/jgss/krb5/Krb5Context.java +++ b/src/share/classes/sun/security/jgss/krb5/Krb5Context.java @@ -86,6 +86,7 @@ private boolean sequenceDetState = true; private boolean confState = true; private boolean integState = true; + private boolean delegPolicyState = false; private int mySeqNumber; private int peerSeqNumber; @@ -329,6 +330,21 @@ return sequenceDetState || replayDetState; } + /** + * Requests that the deleg policy be respected. + */ + public final void requestDelegPolicy(boolean value) { + if (state == STATE_NEW && isInitiator()) + delegPolicyState = value; + } + + /** + * Is deleg policy respected? + */ + public final boolean getDelegPolicyState() { + return delegPolicyState; + } + /* * Anonymity is a little different in that after an application * requests anonymity it will want to know whether the mechanism @@ -452,6 +468,10 @@ integState = state; } + final void setDelegPolicyState(boolean state) { + delegPolicyState = state; + } + /** * Sets the channel bindings to be used during context * establishment. diff -r 41268d273c0b src/share/classes/sun/security/jgss/spi/GSSContextSpi.java --- a/src/share/classes/sun/security/jgss/spi/GSSContextSpi.java +++ b/src/share/classes/sun/security/jgss/spi/GSSContextSpi.java @@ -124,6 +124,8 @@ public void requestInteg(boolean state) throws GSSException; + public void requestDelegPolicy(boolean state) throws GSSException; + public void setChannelBinding(ChannelBinding cb) throws GSSException; public boolean getCredDelegState(); @@ -136,6 +138,8 @@ public boolean getAnonymityState(); + public boolean getDelegPolicyState(); + public boolean isTransferable() throws GSSException; public boolean isProtReady(); diff -r 41268d273c0b src/share/classes/sun/security/jgss/spnego/SpNegoContext.java --- a/src/share/classes/sun/security/jgss/spnego/SpNegoContext.java +++ b/src/share/classes/sun/security/jgss/spnego/SpNegoContext.java @@ -63,6 +63,7 @@ private boolean sequenceDetState = true; private boolean confState = true; private boolean integState = true; + private boolean delegPolicyState = false; private GSSNameSpi peerName = null; private GSSNameSpi myName = null; @@ -162,6 +163,14 @@ } /** + * Requests that deleg policy be respected. + */ + public final void requestDelegPolicy(boolean value) throws GSSException { + if (state == STATE_NEW && isInitiator()) + delegPolicyState = value; + } + + /** * Is integrity available? */ public final boolean getIntegState() { @@ -169,6 +178,19 @@ } /** + * Is deleg policy respected? + */ + public final boolean getDelegPolicyState() { + if (isInitiator() && mechContext != null && + mechContext instanceof ExtendedGSSContext && + (state == STATE_IN_PROCESS || state == STATE_DONE)) { + return ((ExtendedGSSContext)mechContext).getDelegPolicyState(); + } else { + return delegPolicyState; + } + } + + /** * Requests that credential delegation be done during context * establishment. */ @@ -181,7 +203,7 @@ * Is credential delegation enabled? */ public final boolean getCredDelegState() { - if (mechContext != null && + if (isInitiator() && mechContext != null && (state == STATE_IN_PROCESS || state == STATE_DONE)) { return mechContext.getCredDelegState(); } else { @@ -209,30 +231,6 @@ return mutualAuthState; } - final void setCredDelegState(boolean state) { - credDelegState = state; - } - - final void setMutualAuthState(boolean state) { - mutualAuthState = state; - } - - final void setReplayDetState(boolean state) { - replayDetState = state; - } - - final void setSequenceDetState(boolean state) { - sequenceDetState = state; - } - - final void setConfState(boolean state) { - confState = state; - } - - final void setIntegState(boolean state) { - integState = state; - } - /** * Returns the mechanism oid. * @@ -637,8 +635,6 @@ if (isMechContextEstablished()) { negoResult = SpNegoToken.NegoResult.ACCEPT_COMPLETE; state = STATE_DONE; - // now set the context flags for acceptor - setContextFlags(); // print the negotiated mech info if (DEBUG) { System.out.println("SPNEGO Negotiated Mechanism = " @@ -759,6 +755,10 @@ throw gssException; } + if (state == STATE_DONE) { + // now set the context flags for acceptor + setContextFlags(); + } return retVal; } @@ -809,28 +809,31 @@ return out; } + // Only called on acceptor side. On the intiiator side, most flags + // are already set at request. For those that might get chanegd, + // state from mech below is used. private void setContextFlags() { if (mechContext != null) { // default for cred delegation is false if (mechContext.getCredDelegState()) { - setCredDelegState(true); + credDelegState = true; } // default for the following are true if (!mechContext.getMutualAuthState()) { - setMutualAuthState(false); + mutualAuthState = false; } if (!mechContext.getReplayDetState()) { - setReplayDetState(false); + replayDetState = false; } if (!mechContext.getSequenceDetState()) { - setSequenceDetState(false); + sequenceDetState = false; } if (!mechContext.getIntegState()) { - setIntegState(false); + integState = false; } if (!mechContext.getConfState()) { - setConfState(false); + confState = false; } } } @@ -941,6 +944,10 @@ mechContext.requestMutualAuth(mutualAuthState); mechContext.requestReplayDet(replayDetState); mechContext.requestSequenceDet(sequenceDetState); + if (mechContext instanceof ExtendedGSSContext) { + ((ExtendedGSSContext)mechContext).requestDelegPolicy( + delegPolicyState); + } } // pass token @@ -1314,5 +1321,5 @@ "inquireSecContext not supported by underlying mech."); } } - } + diff -r 41268d273c0b src/share/classes/sun/security/jgss/wrapper/NativeGSSContext.java --- a/src/share/classes/sun/security/jgss/wrapper/NativeGSSContext.java +++ b/src/share/classes/sun/security/jgss/wrapper/NativeGSSContext.java @@ -549,6 +549,9 @@ public void requestInteg(boolean state) throws GSSException { changeFlags(GSS_C_INTEG_FLAG, state); } + public void requestDelegPolicy(boolean state) throws GSSException { + // Not supported, ignore + } public void requestLifetime(int lifetime) throws GSSException { if (isInitiator && pContext == 0) { this.lifetime = lifetime; @@ -590,6 +593,9 @@ public boolean getIntegState() { return checkFlags(GSS_C_INTEG_FLAG); } + public boolean getDelegPolicyState() { + return false; + } public int getLifetime() { return cStub.getContextTime(pContext); } diff -r 41268d273c0b src/share/classes/sun/security/krb5/Credentials.java --- a/src/share/classes/sun/security/krb5/Credentials.java +++ b/src/share/classes/sun/security/krb5/Credentials.java @@ -239,7 +239,21 @@ * @return true if OK-AS_DELEGATE flag is set, otherwise, return false. */ public boolean checkDelegate() { - return (flags.get(Krb5.TKT_OPTS_DELEGATE)); + return flags.get(Krb5.TKT_OPTS_DELEGATE); + } + + /** + * Reset TKT_OPTS_DELEGATE to false, called at credentials acquirement + * when one of the cross-realm TGTs does not have the OK-AS-DELEGATE + * flag set. This info must be preservable and restorable through + * the Krb5Util.credsToTicket/ticketToCreds() methods. + */ + public void resetCrossRealmOkAsDelegateAllSet() { + flags.set(Krb5.TKT_OPTS_DELEGATE, false); + } + + public void resetDelegate() { + flags.set(Krb5.TKT_OPTS_DELEGATE, false); } public Credentials renew() throws KrbException, IOException { diff -r 41268d273c0b src/share/classes/sun/security/krb5/internal/CredentialsUtil.java --- a/src/share/classes/sun/security/krb5/internal/CredentialsUtil.java +++ b/src/share/classes/sun/security/krb5/internal/CredentialsUtil.java @@ -119,6 +119,7 @@ // Get a list of realms to traverse String[] realms = Realm.getRealmsList(localRealm, serviceRealm); + boolean okAsDelegate = true; if (realms == null || realms.length == 0) { @@ -196,6 +197,15 @@ */ newTgtRealm = newTgt.getServer().getInstanceComponent(); + if (okAsDelegate && !newTgt.checkDelegate()) { + if (DEBUG) + { + System.out.println(">>> Credentials acquireServiceCreds: " + + "glocal OK-AS-DELEGATE turned off at " + + newTgt.getServer()); + } + okAsDelegate = false; + } if (DEBUG) { @@ -285,6 +295,9 @@ System.out.println(">>> Credentials acquireServiceCreds: returning creds:"); Credentials.printDebug(theCreds); } + if (!okAsDelegate) { + theCreds.resetCrossRealmOkAsDelegateAllSet(); + } return theCreds; } throw new KrbApErrException(Krb5.KRB_AP_ERR_GEN_CRED,