- All Implemented Interfaces:
Serializable,Destroyable,Refreshable
All Kerberos JAAS login modules that authenticate a user to a KDC should
use this class. Where available, the login module might even read this
information from a ticket cache in the operating system instead of
directly communicating with the KDC. During the commit phase of the JAAS
authentication process, the JAAS login module should instantiate this
class and store the instance in the private credential set of a
Subject.
It might be necessary for the application to be granted a
PrivateCredentialPermission if it needs to access a KerberosTicket
instance from a Subject. This permission is not needed when the
application depends on the default JGSS Kerberos mechanism to access the
KerberosTicket. In that case, however, the application will need an
appropriate
ServicePermission.
Note that this class is applicable to both ticket granting tickets and other regular service tickets. A ticket granting ticket is just a special case of a more generalized service ticket.
- Implementation Note:
- The JAAS login module in the JDK reference implementation destroys all tickets after logout.
- Since:
- 1.4
- See Also:
-
Constructor Summary
ConstructorsConstructorDescriptionKerberosTicket(byte[] asn1Encoding, KerberosPrincipal client, KerberosPrincipal server, byte[] sessionKey, int keyType, boolean[] flags, Date authTime, Date startTime, Date endTime, Date renewTill, InetAddress[] clientAddresses) Constructs aKerberosTicketusing credentials information that a client either receives from a KDC or reads from a cache. -
Method Summary
Modifier and TypeMethodDescriptionvoiddestroy()Destroys the ticket and destroys any sensitive information stored in it.booleanCompares the specified object with thisKerberosTicketfor equality.final DateReturns the time that the client was authenticated.final KerberosPrincipalReturns the client principal associated with this ticket.final InetAddress[]Returns a list of addresses from where the ticket can be used.final byte[]Returns an ASN.1 encoding of the entire ticket.final DateReturns the expiration time for this ticket's validity period.final boolean[]getFlags()Returns the flags associated with this ticket.final DateReturns the latest expiration time for this ticket, including all renewals.final KerberosPrincipalReturns the service principal associated with this ticket.final SecretKeyReturns the session key associated with this ticket.final intReturns the key type of the session key associated with this ticket as defined by the Kerberos Protocol Specification.final DateReturns the start time for this ticket's validity period.inthashCode()Returns a hash code for thisKerberosTicket.booleanDetermines if this ticket is still current.booleanDetermines if this ticket has been destroyed.final booleanDetermines if this ticket is forwardable.final booleanDetermines if this ticket had been forwarded or was issued based on authentication involving a forwarded ticket-granting ticket.final booleanDetermines if this ticket was issued using the Kerberos AS-Exchange protocol, and not issued based on some ticket-granting ticket.final booleanDetermines is this ticket is post-dated.final booleanDetermines if this ticket is proxiable.final booleanisProxy()Determines is this ticket is a proxy-ticket.final booleanDetermines is this ticket is renewable.voidrefresh()Extends the validity period of this ticket.toString()Returns an informative textual representation of thisKerberosTicket.
-
Constructor Details
-
KerberosTicket
public KerberosTicket(byte[] asn1Encoding, KerberosPrincipal client, KerberosPrincipal server, byte[] sessionKey, int keyType, boolean[] flags, Date authTime, Date startTime, Date endTime, Date renewTill, InetAddress[] clientAddresses) Constructs aKerberosTicketusing credentials information that a client either receives from a KDC or reads from a cache.- Parameters:
asn1Encoding- the ASN.1 encoding of the ticket as defined by the Kerberos protocol specification.client- the client that owns this service ticketserver- the service that this ticket is forsessionKey- the raw bytes for the session key that must be used to encrypt the authenticator that will be sent to the serverkeyType- the key type for the session key as defined by the Kerberos protocol specification.flags- the ticket flags. Each element in this array indicates the value for the corresponding bit in the ASN.1 BitString that represents the ticket flags. If the number of elements in this array is less than the number of flags used by the Kerberos protocol, then the missing flags will be filled in with false.authTime- the time of initial authentication for the clientstartTime- the time after which the ticket will be valid. This may be null in which case the value of authTime is treated as the startTime.endTime- the time after which the ticket will no longer be validrenewTill- an absolute expiration time for the ticket, including all renewal that might be possible. This field may be null for tickets that are not renewable.clientAddresses- the addresses from where the ticket may be used by the client. This field may be null when the ticket is usable from any address.
-
-
Method Details
-
getClient
Returns the client principal associated with this ticket.- Returns:
- the client principal, or
nullif destroyed.
-
getServer
Returns the service principal associated with this ticket.- Returns:
- the service principal, or
nullif destroyed.
-
getSessionKey
Returns the session key associated with this ticket. The return value is always aEncryptionKeyobject.- Returns:
- the session key.
- Throws:
IllegalStateException- if this ticket is destroyed
-
getSessionKeyType
public final int getSessionKeyType()Returns the key type of the session key associated with this ticket as defined by the Kerberos Protocol Specification.- Returns:
- the key type of the session key associated with this ticket.
- Throws:
IllegalStateException- if this ticket is destroyed- See Also:
-
isForwardable
public final boolean isForwardable()Determines if this ticket is forwardable.- Returns:
- true if this ticket is forwardable, or false if not forwardable or destroyed.
-
isForwarded
public final boolean isForwarded()Determines if this ticket had been forwarded or was issued based on authentication involving a forwarded ticket-granting ticket.- Returns:
- true if this ticket had been forwarded or was issued based on authentication involving a forwarded ticket-granting ticket, or false otherwise or destroyed.
-
isProxiable
public final boolean isProxiable()Determines if this ticket is proxiable.- Returns:
- true if this ticket is proxiable, or false if not proxiable or destroyed.
-
isProxy
public final boolean isProxy()Determines is this ticket is a proxy-ticket.- Returns:
- true if this ticket is a proxy-ticket, or false if not a proxy-ticket or destroyed.
-
isPostdated
public final boolean isPostdated()Determines is this ticket is post-dated.- Returns:
- true if this ticket is post-dated, or false if not post-dated or destroyed.
-
isRenewable
public final boolean isRenewable()Determines is this ticket is renewable. If so, therefreshmethod can be called, assuming the validity period for renewing is not already over.- Returns:
- true if this ticket is renewable, or false if not renewable or destroyed.
-
isInitial
public final boolean isInitial()Determines if this ticket was issued using the Kerberos AS-Exchange protocol, and not issued based on some ticket-granting ticket.- Returns:
- true if this ticket was issued using the Kerberos AS-Exchange protocol, or false if not issued this way or destroyed.
-
getFlags
public final boolean[] getFlags()Returns the flags associated with this ticket. Each element in the returned array indicates the value for the corresponding bit in the ASN.1 BitString that represents the ticket flags.- Returns:
- the flags associated with this ticket, or
nullif destroyed.
-
getAuthTime
Returns the time that the client was authenticated.- Returns:
- the time that the client was authenticated
or
nullif the field is not set or this ticket is destroyed.
-
getStartTime
Returns the start time for this ticket's validity period.- Returns:
- the start time for this ticket's validity period
or
nullif the field is not set or this ticket is destroyed.
-
getEndTime
Returns the expiration time for this ticket's validity period.- Returns:
- the expiration time for this ticket's validity period,
or
nullif destroyed.
-
getRenewTill
Returns the latest expiration time for this ticket, including all renewals. This will return a null value for non-renewable tickets.- Returns:
- the latest expiration time for this ticket, or
nullif destroyed.
-
getClientAddresses
Returns a list of addresses from where the ticket can be used.- Returns:
- the list of addresses, or
nullif the field was not provided or this ticket is destroyed.
-
getEncoded
public final byte[] getEncoded()Returns an ASN.1 encoding of the entire ticket.- Returns:
- an ASN.1 encoding of the entire ticket. A new byte array is returned each time this method is called.
- Throws:
IllegalStateException- if this ticket is destroyed
-
isCurrent
public boolean isCurrent()Determines if this ticket is still current.- Specified by:
isCurrentin interfaceRefreshable- Returns:
- true if this ticket is still current, or false if not current or destroyed.
-
refresh
Extends the validity period of this ticket. The ticket will contain a new session key if the refresh operation succeeds. The refresh operation will fail if the ticket is not renewable or the latest allowable renew time has passed. Any other error returned by the KDC will also cause this method to fail. Note: This method is not synchronized with the accessor methods of this object. Hence callers need to be aware of multiple threads that might access this and try to renew it at the same time.- Specified by:
refreshin interfaceRefreshable- Throws:
IllegalStateException- if this ticket is destroyedRefreshFailedException- if the ticket is not renewable, or the latest allowable renew time has passed, or the KDC returns some error.- See Also:
-
destroy
Destroys the ticket and destroys any sensitive information stored in it.- Specified by:
destroyin interfaceDestroyable- Throws:
DestroyFailedException- if the destroy operation fails.
-
isDestroyed
public boolean isDestroyed()Determines if this ticket has been destroyed.- Specified by:
isDestroyedin interfaceDestroyable- Returns:
- true if this
Objecthas been destroyed, false otherwise.
-
toString
Returns an informative textual representation of thisKerberosTicket. -
hashCode
public int hashCode()Returns a hash code for thisKerberosTicket. -
equals
Compares the specified object with thisKerberosTicketfor equality. Returns true if the given object is also aKerberosTicketand the twoKerberosTicketinstances are equivalent. A destroyedKerberosTicketobject is only equal to itself.
-