directory-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From plusplusjia...@apache.org
Subject [08/27] directory-kerby git commit: Just write out the JWT token "as is" if there is no signature key
Date Thu, 07 Jul 2016 06:41:53 GMT
Just write out the JWT token "as is" if there is no signature key


Project: http://git-wip-us.apache.org/repos/asf/directory-kerby/repo
Commit: http://git-wip-us.apache.org/repos/asf/directory-kerby/commit/55e90d92
Tree: http://git-wip-us.apache.org/repos/asf/directory-kerby/tree/55e90d92
Diff: http://git-wip-us.apache.org/repos/asf/directory-kerby/diff/55e90d92

Branch: refs/heads/kpasswd
Commit: 55e90d922e85f969de084fc3e2322a7925547080
Parents: 5e75bf5
Author: Colm O hEigeartaigh <coheigea@apache.org>
Authored: Mon Jul 4 12:18:02 2016 +0100
Committer: Colm O hEigeartaigh <coheigea@apache.org>
Committed: Mon Jul 4 12:18:32 2016 +0100

----------------------------------------------------------------------
 .../test/jaas/TokenAuthLoginModule.java         | 73 +++++++++++++-------
 .../kerberos/provider/token/JwtAuthToken.java   |  6 +-
 2 files changed, 51 insertions(+), 28 deletions(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/directory-kerby/blob/55e90d92/kerby-kerb/integration-test/src/main/java/org/apache/kerby/kerberos/kerb/integration/test/jaas/TokenAuthLoginModule.java
----------------------------------------------------------------------
diff --git a/kerby-kerb/integration-test/src/main/java/org/apache/kerby/kerberos/kerb/integration/test/jaas/TokenAuthLoginModule.java
b/kerby-kerb/integration-test/src/main/java/org/apache/kerby/kerberos/kerb/integration/test/jaas/TokenAuthLoginModule.java
index 7eee5ba..d0e8549 100644
--- a/kerby-kerb/integration-test/src/main/java/org/apache/kerby/kerberos/kerb/integration/test/jaas/TokenAuthLoginModule.java
+++ b/kerby-kerb/integration-test/src/main/java/org/apache/kerby/kerberos/kerb/integration/test/jaas/TokenAuthLoginModule.java
@@ -33,10 +33,14 @@ import org.apache.kerby.kerberos.kerb.type.base.KrbToken;
 import org.apache.kerby.kerberos.kerb.type.base.TokenFormat;
 import org.apache.kerby.kerberos.kerb.type.kdc.EncKdcRepPart;
 import org.apache.kerby.kerberos.kerb.type.ticket.TgtTicket;
+import org.apache.kerby.kerberos.provider.token.JwtAuthToken;
 import org.apache.kerby.kerberos.provider.token.JwtTokenEncoder;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import com.nimbusds.jwt.JWT;
+import com.nimbusds.jwt.JWTParser;
+
 import javax.security.auth.Subject;
 import javax.security.auth.callback.CallbackHandler;
 import javax.security.auth.kerberos.KerberosPrincipal;
@@ -50,6 +54,7 @@ import java.io.IOException;
 import java.security.Principal;
 import java.security.PrivateKey;
 import java.security.interfaces.RSAPrivateKey;
+import java.text.ParseException;
 import java.util.Date;
 import java.util.Iterator;
 import java.util.Map;
@@ -245,38 +250,55 @@ public class TokenAuthLoginModule implements LoginModule {
                 throw new LoginException("No valid token was found in token cache: " + tokenCacheName);
             }
         }
-        TokenDecoder tokenDecoder = KrbRuntime.getTokenProvider().createTokenDecoder();
-        try {
-            authToken = tokenDecoder.decodeFromString(tokenStr);
-        } catch (IOException e) {
-            e.printStackTrace();
-        }
-        krbToken = new KrbToken(authToken, TokenFormat.JWT);
-        TokenEncoder tokenEncoder = KrbRuntime.getTokenProvider().createTokenEncoder();
 
-        if (tokenEncoder instanceof JwtTokenEncoder && signKeyFile != null) {
-            PrivateKey signKey = null;
+        krbToken = new KrbToken();
+        
+        // Sign the token.
+        if (signKeyFile != null) {
             try {
-                FileInputStream fis = new FileInputStream(signKeyFile);
-                signKey = PrivateKeyReader.loadPrivateKey(fis);
-            } catch (FileNotFoundException e) {
-                e.printStackTrace();
-            } catch (Exception e) {
-                e.printStackTrace();
+                TokenDecoder tokenDecoder = KrbRuntime.getTokenProvider().createTokenDecoder();
+                try {
+                    authToken = tokenDecoder.decodeFromString(tokenStr);
+                } catch (IOException e) {
+                    e.printStackTrace();
+                }
+                krbToken = new KrbToken(authToken, TokenFormat.JWT);
+                TokenEncoder tokenEncoder = KrbRuntime.getTokenProvider().createTokenEncoder();
+    
+                if (tokenEncoder instanceof JwtTokenEncoder) {
+                    PrivateKey signKey = null;
+                    try {
+                        FileInputStream fis = new FileInputStream(signKeyFile);
+                        signKey = PrivateKeyReader.loadPrivateKey(fis);
+                    } catch (FileNotFoundException e) {
+                        e.printStackTrace();
+                    } catch (Exception e) {
+                        e.printStackTrace();
+                    }
+    
+                    ((JwtTokenEncoder) tokenEncoder).setSignKey((RSAPrivateKey) signKey);
+                }
+                
+                krbToken.setTokenValue(tokenEncoder.encodeAsBytes(authToken));
+            } catch (KrbException e) {
+                throw new RuntimeException("Failed to encode AuthToken", e);
+            }
+        } else {
+            // Otherwise just write out the token (which could be already signed)
+            krbToken.setTokenValue(tokenStr.getBytes());
+            
+            try {
+                JWT jwt = JWTParser.parse(tokenStr);
+                authToken = new JwtAuthToken(jwt.getJWTClaimsSet());
+            } catch (ParseException e) {
+                // Invalid JWT encoding
+                throw new RuntimeException("Failed to parse JWT token string", e);
             }
-
-            ((JwtTokenEncoder) tokenEncoder).setSignKey((RSAPrivateKey) signKey);
         }
-
-        krbToken = new KrbToken();
+        
         krbToken.setInnerToken(authToken);
         krbToken.setTokenType();
         krbToken.setTokenFormat(TokenFormat.JWT);
-        try {
-            krbToken.setTokenValue(tokenEncoder.encodeAsBytes(authToken));
-        } catch (KrbException e) {
-            throw new RuntimeException("Failed to encode AuthToken", e);
-        }
 
         KrbClient krbClient = null;
         try {
@@ -290,6 +312,7 @@ public class TokenAuthLoginModule implements LoginModule {
         } catch (IOException e) {
             e.printStackTrace();
         }
+        
         KrbTokenClient tokenClient = new KrbTokenClient(krbClient);
         try {
             tgtTicket = tokenClient.requestTgt(krbToken,

http://git-wip-us.apache.org/repos/asf/directory-kerby/blob/55e90d92/kerby-provider/token-provider/src/main/java/org/apache/kerby/kerberos/provider/token/JwtAuthToken.java
----------------------------------------------------------------------
diff --git a/kerby-provider/token-provider/src/main/java/org/apache/kerby/kerberos/provider/token/JwtAuthToken.java
b/kerby-provider/token-provider/src/main/java/org/apache/kerby/kerberos/provider/token/JwtAuthToken.java
index e5d92c8..b6e60c4 100644
--- a/kerby-provider/token-provider/src/main/java/org/apache/kerby/kerberos/provider/token/JwtAuthToken.java
+++ b/kerby-provider/token-provider/src/main/java/org/apache/kerby/kerberos/provider/token/JwtAuthToken.java
@@ -40,15 +40,15 @@ public class JwtAuthToken implements AuthToken {
     private Boolean isIdToken = true;
     private Boolean isAcToken = false;
 
-    protected JwtAuthToken() {
+    public JwtAuthToken() {
         this(new JWTClaimsSet());
     }
 
-    protected JwtAuthToken(JWTClaimsSet jwtClaims) {
+    public JwtAuthToken(JWTClaimsSet jwtClaims) {
         this.jwtClaims = jwtClaims;
     }
 
-    protected JwtAuthToken(ReadOnlyJWTClaimsSet jwtClaims) {
+    public JwtAuthToken(ReadOnlyJWTClaimsSet jwtClaims) {
         this.jwtClaims = JwtUtil.from(jwtClaims);
     }
 


Mime
View raw message