regardless whether the caller has the getSubject
permission */
for (Iterator iter = constraints.requirements().iterator();
iter.hasNext(); )
{
InvocationConstraint c = (InvocationConstraint) iter.next();
if (!KerberosUtil.isSupportableConstraint(c)) {
errorCode = UNSUPPORTABLE_CONSTRAINT_REQUIRED;
detailedExceptionMsg = "A constraint unsupportable by " +
"this endpoint has been required: " + c;
return;
}
}
/* All Kerberos principals allowed by the constraints. If
the resulting set is empty, it means no client min/max
principal constraints found in the constraints, instead
of no principals allowed. */
clientPrincipals = new HashSet();
for (Iterator iter = constraints.requirements().iterator();
iter.hasNext(); )
{
if (!KerberosUtil.collectCpCandidates(
(InvocationConstraint) iter.next(),
clientPrincipals))
{
errorCode = UNSUPPORTABLE_CONSTRAINT_REQUIRED;
detailedExceptionMsg = "Client principal constraint " +
"related conflicts found in the given set of " +
"constraints: " + constraints;
return;
}
}
if (clientSubject == null) {
errorCode = NULL_SUBJECT;
detailedExceptionMsg = "JAAS login has not been done " +
"properly, the subject associated with the current " +
"AccessControlContext is null.";
return;
}
this.clientSubject = clientSubject;
this.constraints = constraints;
subjectReadOnly = clientSubject.isReadOnly();
subjectClientPrincipals = getClientPrincipals(clientSubject);
if (subjectClientPrincipals.size() == 0) {
errorCode = NO_CLIENT_PRINCIPAL;
detailedExceptionMsg = "JAAS login has not been done " +
"properly, the subject associated with the current " +
"AccessControlContext contains no KerberosPrincipal.";
return;
}
if (clientPrincipals.size() > 0) {
clientPrincipals.retainAll(subjectClientPrincipals);
} else {
clientPrincipals = subjectClientPrincipals;
}
boolean canDeleg = false;
if (KerberosUtil.containsConstraint(
constraints.requirements(), Delegation.YES) ||
KerberosUtil.containsConstraint(
constraints.preferences(), Delegation.YES))
{
canDeleg = true;
}
// enumerate all possible configs and filter them by constraints
ArrayList configArr = new ArrayList();
outer:
for (ConfigIter citer = new ConfigIter(
clientPrincipals, serverPrincipal, canDeleg);
citer.hasNext(); )
{
Config config = citer.next();
for (Iterator jter = constraints.requirements().iterator();
jter.hasNext(); )
{
InvocationConstraint c =
(InvocationConstraint) jter.next();
if (!KerberosUtil.isSatisfiable(config, c))
continue outer;
}
configArr.add(config);
}
if (configArr.size() == 0) {
errorCode = UNSATISFIABLE_CONSTRAINT_REQUIRED;
detailedExceptionMsg = "Constraints unsatisfiable by this " +
"endpoint with the current subject have been required: " +
constraints + ", while the KerberosPrincipal set of " +
"the subject is: " + subjectClientPrincipals;
return;
}
configs = (Config[]) configArr.toArray(
new Config[configArr.size()]);
// reorder configs by the num of preferences a config can satisfy
for (int i = 0; i < configs.length; i++) {
for (Iterator iter = constraints.preferences().iterator();
iter.hasNext(); )
{
InvocationConstraint c =
(InvocationConstraint) iter.next();
if (KerberosUtil.isSatisfiable(configs[i], c))
configs[i].prefCount++;
}
}