private static void generateTicket( TicketGrantingContext tgsContext ) throws KerberosException
{
KdcRequest request = tgsContext.getRequest();
Ticket tgt = tgsContext.getTgt();
Authenticator authenticator = tgsContext.getAuthenticator();
CipherTextHandler cipherTextHandler = tgsContext.getCipherTextHandler();
KerberosPrincipal ticketPrincipal = request.getServerPrincipal();
EncryptionType encryptionType = tgsContext.getEncryptionType();
EncryptionKey serverKey = tgsContext.getRequestPrincipalEntry().getKeyMap().get( encryptionType );
KdcServer config = tgsContext.getConfig();
EncTicketPartModifier newTicketBody = new EncTicketPartModifier();
newTicketBody.setClientAddresses( tgt.getEncTicketPart().getClientAddresses() );
processFlags( config, request, tgt, newTicketBody );
EncryptionKey sessionKey = RandomKeyFactory.getRandomKey( tgsContext.getEncryptionType() );
newTicketBody.setSessionKey( sessionKey );
newTicketBody.setClientPrincipal( tgt.getEncTicketPart().getClientPrincipal() );
if ( request.getEncAuthorizationData() != null )
{
AuthorizationData authData = ( AuthorizationData ) cipherTextHandler.unseal( AuthorizationData.class,
authenticator.getSubSessionKey(), request.getEncAuthorizationData(), KeyUsage.NUMBER4 );
authData.add( tgt.getEncTicketPart().getAuthorizationData() );
newTicketBody.setAuthorizationData( authData );
}
processTransited( newTicketBody, tgt );
processTimes( config, request, newTicketBody, tgt );
EncTicketPart ticketPart = newTicketBody.getEncTicketPart();
if ( request.getOption( KdcOptions.ENC_TKT_IN_SKEY ) )
{
/*
* if (server not specified) then
* server = req.second_ticket.client;
* endif
*
* if ((req.second_ticket is not a TGT) or
* (req.second_ticket.client != server)) then
* error_out(KDC_ERR_POLICY);
* endif
*
* new_tkt.enc-part := encrypt OCTET STRING using etype_for_key(second-ticket.key), second-ticket.key;
*/
throw new KerberosException( ErrorType.KDC_ERR_BADOPTION );
}
else
{
EncryptedData encryptedData = cipherTextHandler.seal( serverKey, ticketPart, KeyUsage.NUMBER2 );
Ticket newTicket = new Ticket( ticketPrincipal, encryptedData );
newTicket.setEncTicketPart( ticketPart );
tgsContext.setNewTicket( newTicket );
}
}