}
private void prepare() throws WSSecurityException {
boolean needSession = false;
KrbSession krbSession = null;
krbSession = KrbSessionCache.getInstance().getCurrentSession();
if (krbSession == null) {
// Session is null, at client end when initiating a kerberos request.
// This is not null, at the service end when sending the response back.
needSession = true;
}
secRef = new SecurityTokenReference(document);
strUri = (new StringBuilder()).append("STRId-").append(secRef.hashCode()).toString();
secRef.setID(strUri);
byte tokenData[] = null;
if (needSession) {
try {
KerberosTicket tgt = getTicketGrantingTicket();
tokenData = getServiceTicketData(servicePrincipalName);
sessionKey = getSessionKey(tgt);
krbSession = new KrbSession(SecurityUtil.getSHA1(tokenData), sessionKey);
krbSession.setClientPrincipalName(user);
krbSession.setServerPrincipalName(servicePrincipalName);
KrbSessionCache.getInstance().addSession(krbSession);
} catch (LoginException e) {
throw new WSSecurityException(5, "kerberosLoginFailed",
new Object[] { e.getMessage() });
} catch (GSSException e) {
throw new WSSecurityException(5, "kerberosSTReqFailed", new Object[] {
servicePrincipalName, e.getMessage() });
} catch (Exception e) {
throw new WSSecurityException(5, "kerberosSTReqFailed", new Object[] {
servicePrincipalName, e.getMessage() });
}
if (tokenData == null) {
throw new WSSecurityException(5, "kerberosSTReqFailed", new Object[] {
servicePrincipalName, "Check service principal exists in KDC" });
}
tokenUri = (new StringBuilder()).append("KerbTokenId-").append(tokenData.hashCode())
.toString();
} else {
keyIdentifierType = WSConstants.THUMBPRINT_IDENTIFIER;
}
wsDocInfo = new WSDocInfo(document);
switch (keyIdentifierType) {
case WSConstants.BST_DIRECT_REFERENCE:
Reference ref = new Reference(document);
ref.setURI((new StringBuilder()).append("#").append(tokenUri).toString());
bstToken = new KerberosSecurity(document);
((KerberosSecurity) bstToken).setKerberosToken(tokenData);
ref.setValueType(bstToken.getValueType());
secRef.setReference(ref);
bstToken.setID(tokenUri);
wsDocInfo.setBst(bstToken.getElement());
break;
case WSConstants.THUMBPRINT_IDENTIFIER:
secRef.setKerberosIdentifierThumb(krbSession);
sessionKey = krbSession.getSessionKey();
break;
default:
throw new WSSecurityException(0, "unsupportedKeyId");
}