1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20 package davmail.http;
21
22 import org.apache.http.auth.Credentials;
23 import org.apache.http.impl.auth.SPNegoScheme;
24 import org.apache.log4j.Logger;
25 import org.ietf.jgss.*;
26
27 import javax.security.auth.RefreshFailedException;
28 import javax.security.auth.Subject;
29 import javax.security.auth.kerberos.KerberosTicket;
30 import javax.security.auth.login.LoginContext;
31 import javax.security.auth.login.LoginException;
32 import java.security.PrivilegedAction;
33 import java.security.Security;
34
35
36
37
38
39 public class DavMailSPNegoScheme extends SPNegoScheme {
40 protected static final Logger LOGGER = Logger.getLogger(DavMailSPNegoScheme.class);
41 protected static final Object LOCK = new Object();
42 protected static final KerberosHelper.KerberosCallbackHandler KERBEROS_CALLBACK_HANDLER;
43 private static LoginContext clientLoginContext;
44
45 static {
46
47 Security.setProperty("login.configuration.provider", "davmail.http.KerberosLoginConfiguration");
48
49 KERBEROS_CALLBACK_HANDLER = new KerberosHelper.KerberosCallbackHandler();
50 }
51
52 public DavMailSPNegoScheme(final boolean stripPort, final boolean useCanonicalHostname) {
53 super(stripPort, useCanonicalHostname);
54 }
55
56 public DavMailSPNegoScheme(final boolean stripPort) {
57 super(stripPort);
58 }
59
60 public DavMailSPNegoScheme() {
61 super();
62 }
63
64 @Override
65 protected byte[] generateGSSToken(final byte[] input, final Oid oid, final String authServer, final Credentials credentials) throws GSSException {
66 String protocol = "HTTP";
67
68 LOGGER.debug("KerberosHelper.initSecurityContext " + protocol + '@' + authServer + ' ' + input.length + " bytes token");
69
70 synchronized (LOCK) {
71
72 if (clientLoginContext != null) {
73 for (KerberosTicket kerberosTicket : clientLoginContext.getSubject().getPrivateCredentials(KerberosTicket.class)) {
74 if (kerberosTicket.getServer().getName().startsWith("krbtgt") && !kerberosTicket.isCurrent()) {
75 LOGGER.debug("KerberosHelper.clientLogin cached TGT expired, try to relogin");
76 clientLoginContext = null;
77 }
78 }
79 }
80
81 if (clientLoginContext == null) {
82 final LoginContext localLoginContext;
83 try {
84 localLoginContext = new LoginContext("spnego-client", KERBEROS_CALLBACK_HANDLER);
85 localLoginContext.login();
86 clientLoginContext = localLoginContext;
87 } catch (LoginException e) {
88 LOGGER.error(e.getMessage(), e);
89 throw new GSSException(GSSException.FAILURE);
90 }
91 }
92
93 for (KerberosTicket kerberosTicket : clientLoginContext.getSubject().getPrivateCredentials(KerberosTicket.class)) {
94 LOGGER.debug("KerberosHelper.clientLogin ticket for " + kerberosTicket.getServer().getName() + " expires at " + kerberosTicket.getEndTime());
95 if (kerberosTicket.getEndTime().getTime() < System.currentTimeMillis() + 10000) {
96 if (kerberosTicket.isRenewable()) {
97 try {
98 kerberosTicket.refresh();
99 } catch (RefreshFailedException e) {
100 LOGGER.debug("KerberosHelper.clientLogin failed to renew ticket " + kerberosTicket);
101 }
102 } else {
103 LOGGER.debug("KerberosHelper.clientLogin ticket is not renewable");
104 }
105 }
106 }
107
108 Object result = internalGenerateGSSToken(input, oid, authServer, credentials);
109
110 if (result instanceof GSSException) {
111 LOGGER.info("KerberosHelper.initSecurityContext exception code " + ((GSSException) result).getMajor() + " minor code " + ((GSSException) result).getMinor() + " message " + ((Throwable) result).getMessage());
112 throw (GSSException) result;
113 }
114
115 LOGGER.debug("KerberosHelper.initSecurityContext return " + ((byte[]) result).length + " bytes token");
116 return (byte[]) result;
117 }
118 }
119
120 @SuppressWarnings("removal")
121 protected Object internalGenerateGSSToken(final byte[] input, final Oid oid, final String authServer, final Credentials credentials) {
122 return Subject.doAs(clientLoginContext.getSubject(), (PrivilegedAction<Object>) () -> {
123 Object result;
124 try {
125 result = super.generateGSSToken(input, oid, authServer, credentials);
126 } catch (GSSException e) {
127 result = e;
128 }
129 return result;
130 });
131 }
132
133 }