You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@directory.apache.org by dr...@apache.org on 2015/04/22 15:25:45 UTC
directory-kerby git commit: Fixed the issue that cname field in
KdcReqBody should not be used in TgsReq
Repository: directory-kerby
Updated Branches:
refs/heads/master a53cdda57 -> 41df0299e
Fixed the issue that cname field in KdcReqBody should not be used in TgsReq
Project: http://git-wip-us.apache.org/repos/asf/directory-kerby/repo
Commit: http://git-wip-us.apache.org/repos/asf/directory-kerby/commit/41df0299
Tree: http://git-wip-us.apache.org/repos/asf/directory-kerby/tree/41df0299
Diff: http://git-wip-us.apache.org/repos/asf/directory-kerby/diff/41df0299
Branch: refs/heads/master
Commit: 41df0299ef254d877b6f570c1b71eb35c75e9fc5
Parents: a53cdda
Author: Drankye <dr...@gmail.com>
Authored: Wed Apr 22 21:25:21 2015 +0800
Committer: Drankye <dr...@gmail.com>
Committed: Wed Apr 22 21:25:21 2015 +0800
----------------------------------------------------------------------
.../kerb/client/request/KdcRequest.java | 5 ++--
.../kerb/client/request/TgsRequest.java | 4 ++--
.../kerberos/kerb/server/request/AsRequest.java | 24 ++++++++++++++++++++
.../kerb/server/request/KdcRequest.java | 22 +-----------------
.../kerb/server/request/TgsRequest.java | 8 +++++++
5 files changed, 37 insertions(+), 26 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/directory-kerby/blob/41df0299/kerby-kerb/kerb-client/src/main/java/org/apache/kerby/kerberos/kerb/client/request/KdcRequest.java
----------------------------------------------------------------------
diff --git a/kerby-kerb/kerb-client/src/main/java/org/apache/kerby/kerberos/kerb/client/request/KdcRequest.java b/kerby-kerb/kerb-client/src/main/java/org/apache/kerby/kerberos/kerb/client/request/KdcRequest.java
index 8cf328b..bab4e67 100644
--- a/kerby-kerb/kerb-client/src/main/java/org/apache/kerby/kerberos/kerb/client/request/KdcRequest.java
+++ b/kerby-kerb/kerb-client/src/main/java/org/apache/kerby/kerberos/kerb/client/request/KdcRequest.java
@@ -144,11 +144,10 @@ public abstract class KdcRequest {
long startTime = System.currentTimeMillis();
body.setFrom(new KerberosTime(startTime));
- PrincipalName cName = null;
- cName = getClientPrincipal();
+ PrincipalName cName = getClientPrincipal();
body.setCname(cName);
- body.setRealm(cName.getRealm());
+ body.setRealm(getContext().getKrbSetting().getKdcRealm());
PrincipalName sName = getServerPrincipal();
body.setSname(sName);
http://git-wip-us.apache.org/repos/asf/directory-kerby/blob/41df0299/kerby-kerb/kerb-client/src/main/java/org/apache/kerby/kerberos/kerb/client/request/TgsRequest.java
----------------------------------------------------------------------
diff --git a/kerby-kerb/kerb-client/src/main/java/org/apache/kerby/kerberos/kerb/client/request/TgsRequest.java b/kerby-kerb/kerb-client/src/main/java/org/apache/kerby/kerberos/kerb/client/request/TgsRequest.java
index 4a4b6e0..10b4dbb 100644
--- a/kerby-kerb/kerb-client/src/main/java/org/apache/kerby/kerberos/kerb/client/request/TgsRequest.java
+++ b/kerby-kerb/kerb-client/src/main/java/org/apache/kerby/kerberos/kerb/client/request/TgsRequest.java
@@ -51,7 +51,7 @@ public class TgsRequest extends KdcRequest {
}
public PrincipalName getClientPrincipal() {
- return tgt.getClientPrincipal();
+ return null;
}
@Override
@@ -100,7 +100,7 @@ public class TgsRequest extends KdcRequest {
private Authenticator makeAuthenticator() {
Authenticator authenticator = new Authenticator();
- authenticator.setCname(getClientPrincipal());
+ authenticator.setCname(tgt.getClientPrincipal());
authenticator.setCrealm(tgt.getRealm());
authenticator.setCtime(KerberosTime.now());
http://git-wip-us.apache.org/repos/asf/directory-kerby/blob/41df0299/kerby-kerb/kerb-server/src/main/java/org/apache/kerby/kerberos/kerb/server/request/AsRequest.java
----------------------------------------------------------------------
diff --git a/kerby-kerb/kerb-server/src/main/java/org/apache/kerby/kerberos/kerb/server/request/AsRequest.java b/kerby-kerb/kerb-server/src/main/java/org/apache/kerby/kerberos/kerb/server/request/AsRequest.java
index 85cf9fe..097a630 100644
--- a/kerby-kerb/kerb-server/src/main/java/org/apache/kerby/kerberos/kerb/server/request/AsRequest.java
+++ b/kerby-kerb/kerb-server/src/main/java/org/apache/kerby/kerberos/kerb/server/request/AsRequest.java
@@ -21,6 +21,7 @@ package org.apache.kerby.kerberos.kerb.server.request;
import org.apache.kerby.kerberos.kerb.KrbException;
import org.apache.kerby.kerberos.kerb.common.EncryptionUtil;
+import org.apache.kerby.kerberos.kerb.identity.KrbIdentity;
import org.apache.kerby.kerberos.kerb.server.KdcContext;
import org.apache.kerby.kerberos.kerb.spec.KerberosTime;
import org.apache.kerby.kerberos.kerb.spec.base.*;
@@ -35,6 +36,29 @@ public class AsRequest extends KdcRequest {
}
@Override
+ protected void checkClient() throws KrbException {
+ KdcReq request = getKdcReq();
+
+ PrincipalName clientPrincipal = request.getReqBody().getCname();
+ String clientRealm = request.getReqBody().getRealm();
+ if (clientRealm == null || clientRealm.isEmpty()) {
+ clientRealm = kdcContext.getKdcRealm();
+ }
+ clientPrincipal.setRealm(clientRealm);
+
+ KrbIdentity clientEntry = getEntry(clientPrincipal.getName());
+ setClientEntry(clientEntry);
+
+ for (EncryptionType encType : request.getReqBody().getEtypes()) {
+ if (clientEntry.getKeys().containsKey(encType)) {
+ EncryptionKey clientKey = clientEntry.getKeys().get(encType);
+ setClientKey(clientKey);
+ break;
+ }
+ }
+ }
+
+ @Override
protected void makeReply() throws KrbException {
Ticket ticket = getTicket();
http://git-wip-us.apache.org/repos/asf/directory-kerby/blob/41df0299/kerby-kerb/kerb-server/src/main/java/org/apache/kerby/kerberos/kerb/server/request/KdcRequest.java
----------------------------------------------------------------------
diff --git a/kerby-kerb/kerb-server/src/main/java/org/apache/kerby/kerberos/kerb/server/request/KdcRequest.java b/kerby-kerb/kerb-server/src/main/java/org/apache/kerby/kerberos/kerb/server/request/KdcRequest.java
index e6bcef0..df36ce2 100644
--- a/kerby-kerb/kerb-server/src/main/java/org/apache/kerby/kerberos/kerb/server/request/KdcRequest.java
+++ b/kerby-kerb/kerb-server/src/main/java/org/apache/kerby/kerberos/kerb/server/request/KdcRequest.java
@@ -226,27 +226,7 @@ public abstract class KdcRequest {
}
}
- protected void checkClient() throws KrbException {
- KdcReq request = getKdcReq();
-
- PrincipalName clientPrincipal = request.getReqBody().getCname();
- String clientRealm = request.getReqBody().getRealm();
- if (clientRealm == null || clientRealm.isEmpty()) {
- clientRealm = kdcContext.getKdcRealm();
- }
- clientPrincipal.setRealm(clientRealm);
-
- KrbIdentity clientEntry = getEntry(clientPrincipal.getName());
- setClientEntry(clientEntry);
-
- for (EncryptionType encType : request.getReqBody().getEtypes()) {
- if (clientEntry.getKeys().containsKey(encType)) {
- EncryptionKey clientKey = clientEntry.getKeys().get(encType);
- setClientKey(clientKey);
- break;
- }
- }
- }
+ protected abstract void checkClient() throws KrbException;
protected void preauth() throws KrbException {
KdcReq request = getKdcReq();
http://git-wip-us.apache.org/repos/asf/directory-kerby/blob/41df0299/kerby-kerb/kerb-server/src/main/java/org/apache/kerby/kerberos/kerb/server/request/TgsRequest.java
----------------------------------------------------------------------
diff --git a/kerby-kerb/kerb-server/src/main/java/org/apache/kerby/kerberos/kerb/server/request/TgsRequest.java b/kerby-kerb/kerb-server/src/main/java/org/apache/kerby/kerberos/kerb/server/request/TgsRequest.java
index 76804e5..6d5c610 100644
--- a/kerby-kerb/kerb-server/src/main/java/org/apache/kerby/kerberos/kerb/server/request/TgsRequest.java
+++ b/kerby-kerb/kerb-server/src/main/java/org/apache/kerby/kerberos/kerb/server/request/TgsRequest.java
@@ -22,6 +22,7 @@ package org.apache.kerby.kerberos.kerb.server.request;
import org.apache.kerby.kerberos.kerb.KrbErrorCode;
import org.apache.kerby.kerberos.kerb.KrbCodec;
import org.apache.kerby.kerberos.kerb.common.EncryptionUtil;
+import org.apache.kerby.kerberos.kerb.identity.KrbIdentity;
import org.apache.kerby.kerberos.kerb.server.KdcContext;
import org.apache.kerby.kerberos.kerb.KrbConstant;
import org.apache.kerby.kerberos.kerb.KrbException;
@@ -56,6 +57,11 @@ public class TgsRequest extends KdcRequest {
this.tgtSessionKey = tgtSessionKey;
}
+ @Override
+ protected void checkClient() throws KrbException {
+ // Nothing to do at this phase because client couldn't be checked out yet.
+ }
+
public void verifyAuthenticator(PaDataEntry paDataEntry) throws KrbException {
ApReq apReq = KrbCodec.decode(paDataEntry.getPaDataValue(), ApReq.class);
@@ -106,6 +112,8 @@ public class TgsRequest extends KdcRequest {
serverPrincipal.setRealm(ticket.getRealm());
PrincipalName clientPrincipal = authenticator.getCname();
clientPrincipal.setRealm(authenticator.getCrealm());
+ KrbIdentity clientEntry = getEntry(clientPrincipal.getName());
+ setClientEntry(clientEntry);
if (!authenticator.getCtime().isInClockSkew(
kdcContext.getConfig().getAllowableClockSkew() * 1000)) {