* @param data the RequestData associated with the request
* @throws WSSecurityException on a failed validation
*/
public Credential validate(Credential credential, RequestData data) throws WSSecurityException {
if (credential == null || credential.getBinarySecurityToken() == null) {
throw new WSSecurityException(WSSecurityException.ErrorCode.FAILURE, "noCredential");
}
BinarySecurity binarySecurity = credential.getBinarySecurityToken();
if (!(binarySecurity instanceof KerberosSecurity)) {
return credential;
}
if (LOG.isDebugEnabled()) {
try {
String jaasAuth = System.getProperty("java.security.auth.login.config");
String krbConf = System.getProperty("java.security.krb5.conf");
LOG.debug("KerberosTokenValidator - Using JAAS auth login file: " + jaasAuth);
LOG.debug("KerberosTokenValidator - Using KRB conf file: " + krbConf);
} catch (SecurityException ex) {
LOG.debug(ex.getMessage(), ex);
}
}
// Get a TGT from the KDC using JAAS
LoginContext loginContext = null;
try {
if (callbackHandler != null) {
loginContext = new LoginContext(getContextName(), callbackHandler);
} else if (data.getCallbackHandler() != null) {
loginContext = new LoginContext(getContextName(), data.getCallbackHandler());
} else {
loginContext = new LoginContext(getContextName());
}
loginContext.login();
} catch (LoginException ex) {
if (LOG.isDebugEnabled()) {
LOG.debug(ex.getMessage(), ex);
}
throw new WSSecurityException(
WSSecurityException.ErrorCode.FAILURE,
"kerberosLoginError",
ex,
ex.getMessage());
}
if (LOG.isDebugEnabled()) {
LOG.debug("Successfully authenticated to the TGT");
}
byte[] token = binarySecurity.getToken();
// Get the service name to use - fall back on the principal
Subject subject = loginContext.getSubject();
String service = serviceName;
if (service == null) {
Set<Principal> principals = subject.getPrincipals();
if (principals.isEmpty()) {
throw new WSSecurityException(
WSSecurityException.ErrorCode.FAILURE,
"kerberosLoginError",
"No Client principals found after login");
}
service = principals.iterator().next().getName();
}
// Validate the ticket
KerberosServiceAction action = new KerberosServiceAction(token, service);
Principal principal = Subject.doAs(subject, action);
if (principal == null) {
throw new WSSecurityException(
WSSecurityException.ErrorCode.FAILURE, "kerberosTicketValidationError"
);
}
credential.setPrincipal(principal);
credential.setSubject(subject);
KerberosTokenDecoder kerberosTokenDecoder = this.kerberosTokenDecoder;
if (kerberosTokenDecoder == null) {
kerberosTokenDecoder = new KerberosTokenDecoderImpl();
}
kerberosTokenDecoder.clear();
kerberosTokenDecoder.setToken(token);
kerberosTokenDecoder.setSubject(subject);
try {
byte[] sessionKey = kerberosTokenDecoder.getSessionKey();
credential.setSecretKey(sessionKey);
} catch (KerberosTokenDecoderException e) {
throw new WSSecurityException(WSSecurityException.ErrorCode.FAILURE, e);
}
if (LOG.isDebugEnabled()) {
LOG.debug("Successfully validated a ticket");
}