mirror of
https://github.com/kmitresse/Master-TI-2.git
synced 2026-05-13 17:11:53 +00:00
[Feat] - Toutes les notes de SSI sur la gestion d'un policyFile (sans policytool) et la signature avec et sans certification + fichier revision by lucas
This commit is contained in:
kmitresse
@@ -0,0 +1,20 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDRTCCAi2gAwIBAgIUeFkqQDxs67AqhUPln8Yzm44H2zkwDQYJKoZIhvcNAQEL
|
||||
BQAwMjEUMBIGA1UEAwwLU2ltdWxhdGVkQ0ExDTALBgNVBAoMBE15Q0ExCzAJBgNV
|
||||
BAYTAkZSMB4XDTI0MTEwNzIxMzk1NloXDTI1MTEwNzIxMzk1NlowMjEUMBIGA1UE
|
||||
AwwLU2ltdWxhdGVkQ0ExDTALBgNVBAoMBE15Q0ExCzAJBgNVBAYTAkZSMIIBIjAN
|
||||
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2kK6igwUFT7qLOwhrVva+yir/OF+
|
||||
p56T7kyXrp7UZwtIta7O5VT3BhhC8C1jVbK9hpTJ7FoSesksF+xwdapLiXBEj/B2
|
||||
COvNBFf432iGx+6fCAhkA95D8/zIxBf+QgbL5EgWPXn/emsZMomPH6wmwI20HTvL
|
||||
ANbqfLe4vvU3KR+GcnfC24rQsoXgfZIHBKaa3Vrc005J+JhoCTY4NK3AAy/ngMm9
|
||||
dsmVgaPrBzzm6XYliqp8ma7xZTTjRIIKyow4aPVG1BQZW3Tayx30+8L6HR3niCDr
|
||||
5MlNIP94hCC14i47UPRdOQQX4etSd8C9LbWHUkiSkf5Dmj84qqY3DihifQIDAQAB
|
||||
o1MwUTAdBgNVHQ4EFgQU7uGkETin7lsxsjUOS3Udk6qZV60wHwYDVR0jBBgwFoAU
|
||||
7uGkETin7lsxsjUOS3Udk6qZV60wDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0B
|
||||
AQsFAAOCAQEACfi9sjsMMNWPTlvF8ycvVQ0Kn8yhx6deQL5NYSPc48BD0miaPhvL
|
||||
jaumUzbzNxkI0XiyKBpXKOLjLt3zyBQh2tpBW5oqJ5q0L6oiOtswvZpXklyYN2RR
|
||||
RX3M0WFDcQD7uRxSXznKzwkFqxbY+kNMWEfYtIzCEFJ8BYkKBSTR8S6MYbCSlheK
|
||||
PbW+U3+1LMcYuERMfSywD2C+nzb9Xz1LSZCVkaltEknvMj/tzUcytxxjRs2RqSsr
|
||||
phyTjAE2HxpN/buQ9WmIrUbBBRrRKAVl+Vv1JB5A8R/gzeNe3nbv1zkGak0M2ddn
|
||||
Dy4VDMgwwSee/X8F/tG29R9hEI//d2kR3w==
|
||||
-----END CERTIFICATE-----
|
||||
@@ -0,0 +1,28 @@
|
||||
-----BEGIN PRIVATE KEY-----
|
||||
MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDaQrqKDBQVPuos
|
||||
7CGtW9r7KKv84X6nnpPuTJeuntRnC0i1rs7lVPcGGELwLWNVsr2GlMnsWhJ6ySwX
|
||||
7HB1qkuJcESP8HYI680EV/jfaIbH7p8ICGQD3kPz/MjEF/5CBsvkSBY9ef96axky
|
||||
iY8frCbAjbQdO8sA1up8t7i+9TcpH4Zyd8LbitCyheB9kgcEpprdWtzTTkn4mGgJ
|
||||
Njg0rcADL+eAyb12yZWBo+sHPObpdiWKqnyZrvFlNONEggrKjDho9UbUFBlbdNrL
|
||||
HfT7wvodHeeIIOvkyU0g/3iEILXiLjtQ9F05BBfh61J3wL0ttYdSSJKR/kOaPziq
|
||||
pjcOKGJ9AgMBAAECggEABsISrxQVKhw+2YG9QDYsJ2M4whWEW7HSEEqgVriVyJQF
|
||||
nhSJ1PmGxZJKPlAVd5GXgzuHrhES6ejhO+NnDwmlGZ4XjWJrcTbF7BjCPL6qj7XA
|
||||
iFnkKOeAsKUW3VWF2qsFtK2TvLcSlUqMJu+x9g/ZSlSI62/OxxmgfJieuJD0son3
|
||||
9ln6+95UZfpmlOSFb5G1+oDAX1b+S2ykdSG8Daqibh6egFn9WZ9CLmhVhkwnWPli
|
||||
r+EXZdYHxulU+454lz1jUT3ooWehp1Lkurlysr4Q3B52Zwsdg9pum8kCewLlz3la
|
||||
agGYdXoW9sW3AWN+J3+n5oOsXr3/aZ+CV8GobRgbwQKBgQDnwLYiOOrEFaLxMR0/
|
||||
CrW9smoL6IMRPRt7CpG6ePvKoaEaJMfBfutgUmbh2vp6KMAilkaZ7sBPxSY5Td+p
|
||||
Cv4IxJ/dplMqknnujhC3vQJkdrrown//4PuNGKq7P0q/CY2KTTTj1liM0JorhPr5
|
||||
8ycUj7gxclj72PyqJfeBJKRvQQKBgQDxGKSZ35z000jcRnt9L8JOhcZZX7GAJX9m
|
||||
ktGhmu8pvCGBUryKwva8+Ct6MO+uLfadNXN2T0okfKAiTDx+O5GFobgMcmFk/3ki
|
||||
WBbub/Nxk+1qgfG3gb6dyRzJoSIvMMoVnAQLNiGZp+xp9IHixMBrGy21kEFwzZn8
|
||||
hgHKymHgPQKBgDagnk4CzJPb5cSkpxgtFhnY7FZSQFLX7JpcK22hBvkEkEzxToS1
|
||||
vhW+VrH2RAR3hpKgiZPPS1WCSzhGuunFxYubjXNZuVDXphYtNpOY4e98bSJgdnuC
|
||||
NMlVfykUCjJttgdbm5P4+nZ21WBcwCwavKOEHQ7KvV7gDu6sdGLkmD4BAoGAULz6
|
||||
6li7HDXhUXr9AchLnrYn3WgxbgOgrX3/W8ohy20oH0HQx/tQW6oUDUB0E3Vq/+yV
|
||||
dQpKfvuJONMk8vUJ36FvnCN1wDfZngm37DNraB6sxB0uEFEPv5FI5bDjXMBO/HuZ
|
||||
0xNWnzlf73+lO4a+FWAtp37em2MO7UUHNp0dt9UCgYBTbDhzIV7aDluEUqJbBa2Y
|
||||
CBvkJ/9+utAL9eyf30y+Hh3ZWKxc5kuRK6xlJyxamZmFqpaGLsmN+KaWEgUojrXv
|
||||
j7Es/ry5W6mDiIIbCSULu1e/7cdUsno/HhdSxVyWKAuOjFtLEWC4pXGiD6Vpgpoo
|
||||
wVO01w/kd7bhhkAqskuGxQ==
|
||||
-----END PRIVATE KEY-----
|
||||
Binary file not shown.
Binary file not shown.
@@ -0,0 +1 @@
|
||||
Main-Class: Source
|
||||
+5
@@ -0,0 +1,5 @@
|
||||
public class Source {
|
||||
public static void main(String[] args) {
|
||||
System.out.println("Hello world!");
|
||||
}
|
||||
}
|
||||
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,18 @@
|
||||
-----BEGIN NEW CERTIFICATE REQUEST-----
|
||||
MIIC6zCCAdMCAQAwdjELMAkGA1UEBhMCRlIxFDASBgNVBAgTC0NsaWVudFN0YXRl
|
||||
MRMwEQYDVQQHEwpDbGllbnRDaXR5MRIwEAYDVQQKEwlDbGllbnRPcmcxEzARBgNV
|
||||
BAsTCkNsaWVudFVuaXQxEzARBgNVBAMTCkNsaWVudE5hbWUwggEiMA0GCSqGSIb3
|
||||
DQEBAQUAA4IBDwAwggEKAoIBAQC75nji+y18JE4ts5WI0MiZTN+Pq6P6jGbbm2lC
|
||||
LhK1J/YDuB2jWENaTBv47zfEbI9JPE/f0I65EqOHq2mFJPWVA3S/m5fdZmPSfSew
|
||||
a45eTFH0UwBHEI3jvUWO3Vm4KXTZoaRHt15dAg4ltY39OhpnGAzAvS4IovY3FS/i
|
||||
voTz/O2kgUA1VHESJGmpIsCOPsTB6KBozZ36S75d3QDKG6y2NvlYMY3NkOn/w+pv
|
||||
ZWXM1W1H5cbyU/B/mX6bUJ6Eogz5XjzyakZJKqGzt9IfGK7dHUG6l6PFms6Inwj4
|
||||
SPhVUlcHG9x50Sm7KBctHcUhZ6OnIlRWjZ5J/775HuExte/nAgMBAAGgMDAuBgkq
|
||||
hkiG9w0BCQ4xITAfMB0GA1UdDgQWBBRWo1xWegFOkWheOw+c0fNeJpliKzANBgkq
|
||||
hkiG9w0BAQwFAAOCAQEAVP8BdkzGCawgryXMrZTBT1ZTNofcM5Yqtl6KqaXbSO0c
|
||||
7VxkdrgjRZCODZ0v1WW1aQxqfdDxqp5LgxdU8cDPs9FtayIy3GhDF076ZLDWJU89
|
||||
hDgGmY20/VfdA+eGFduvQ9QsLF2idin64mKCri0JcpSv+Wb9EAjL/JnS7FtyarSI
|
||||
EgYb0IY+K1PFFXGz7ScP6e0nPIlwgCM/1AmhKZPQidMS5aEZ77tXqN+X4eK7j+u5
|
||||
KediiE0KKdYMn9Dmvu8cAr1U6MryATqp17TUCY9nRpqabA22rBGUAcYuutAoO01J
|
||||
HcvvQbYyiG0qu2uI/DZ459/1MitAy+zyLF5EBk10dQ==
|
||||
-----END NEW CERTIFICATE REQUEST-----
|
||||
@@ -0,0 +1,20 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDLzCCAhcCFG7u2CvIlzwV1EvzuwFNZqJ0a/XuMA0GCSqGSIb3DQEBCwUAMDIx
|
||||
FDASBgNVBAMMC1NpbXVsYXRlZENBMQ0wCwYDVQQKDARNeUNBMQswCQYDVQQGEwJG
|
||||
UjAeFw0yNDExMDcyMTM5NThaFw0yNTExMDcyMTM5NThaMHYxCzAJBgNVBAYTAkZS
|
||||
MRQwEgYDVQQIEwtDbGllbnRTdGF0ZTETMBEGA1UEBxMKQ2xpZW50Q2l0eTESMBAG
|
||||
A1UEChMJQ2xpZW50T3JnMRMwEQYDVQQLEwpDbGllbnRVbml0MRMwEQYDVQQDEwpD
|
||||
bGllbnROYW1lMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu+Z44vst
|
||||
fCROLbOViNDImUzfj6uj+oxm25tpQi4StSf2A7gdo1hDWkwb+O83xGyPSTxP39CO
|
||||
uRKjh6tphST1lQN0v5uX3WZj0n0nsGuOXkxR9FMARxCN471Fjt1ZuCl02aGkR7de
|
||||
XQIOJbWN/ToaZxgMwL0uCKL2NxUv4r6E8/ztpIFANVRxEiRpqSLAjj7EweigaM2d
|
||||
+ku+Xd0Ayhustjb5WDGNzZDp/8Pqb2VlzNVtR+XG8lPwf5l+m1CehKIM+V488mpG
|
||||
SSqhs7fSHxiu3R1BupejxZrOiJ8I+Ej4VVJXBxvcedEpuygXLR3FIWejpyJUVo2e
|
||||
Sf+++R7hMbXv5wIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQAEDpr35o67ao21lZZO
|
||||
DlidqPbZ6y9FsowzbXZMHqNYjkeBTjmVOIkm8jLj9ZWqrAM4WPARSpRzRzyplQcO
|
||||
0KuQtJQzgdwd5YTc3FCSRuV8ZTu9qrdY5N3/TA+xOpTuOHj/05oF8ngqXRDACMO8
|
||||
e0MUMNWNxeX03iK4fdzaVZuKcALrjgNIpZ+SugvOILP8fUrJN2iLLtP18ccG8My+
|
||||
LlIi3H70yx9EfsEEca2P2RRJ//7PSIW1vciEK7Qd0iKVHUmSPCBvtbaWMXKoYK8L
|
||||
hubTjIAtt8I+N5mbEl7bxzLFnTzGJxIH3mZwPWTGC6Owt8Bsgwu5KCIR7yIwep6C
|
||||
PIGK
|
||||
-----END CERTIFICATE-----
|
||||
Binary file not shown.
@@ -0,0 +1,9 @@
|
||||
keystore "./client/keystore.jks"
|
||||
|
||||
grant signedBy "KeyAlias" {
|
||||
permission java.io.FilePermission "${user.home}${/}PauUniversty/Master-TI-2/security/Notes/Example/Client/Source_Signed.jar", "read, execute";
|
||||
};
|
||||
|
||||
grant codeBase "file:/home/kmitresse/PauUniversity/Master-TI-2/security/Notes/" {
|
||||
permission java.util.PropertyPermission "user.home", "read";
|
||||
};
|
||||
@@ -0,0 +1,3 @@
|
||||
grant codeBase "file:./" {
|
||||
|
||||
};
|
||||
@@ -0,0 +1,4 @@
|
||||
grant codeBase "file:${user.home}${/}Documents${/}Github${/}SecuriteSystemesInfo${/}revision${/}tp1${/}partie2${/}" {
|
||||
permission "java.util.PropertyPermission" "user.home", "read";
|
||||
permission "java.util.PropertyPermission" "java.home", "read";
|
||||
};
|
||||
@@ -0,0 +1,28 @@
|
||||
import java.lang.*;
|
||||
|
||||
class GetProps {
|
||||
|
||||
public static void main(String[] args) {
|
||||
|
||||
try {
|
||||
final String OS_NAME = GetProps.getProperty("os.name");
|
||||
final String JAVA_VERSION = GetProps.getProperty("java.version");
|
||||
final String USER_HOME = GetProps.getProperty("user.home");
|
||||
final String JAVA_HOME = GetProps.getProperty("java.home");
|
||||
|
||||
System.out.println(
|
||||
"os.name : " + OS_NAME + "\n"
|
||||
+ "java.version : " + JAVA_VERSION + "\n"
|
||||
+ "user.home : " + USER_HOME + "\n"
|
||||
+ "java.home : " + JAVA_HOME
|
||||
);
|
||||
} catch (Exception e) {
|
||||
System.err.println("Caught exception " + e.toString());
|
||||
}
|
||||
}
|
||||
|
||||
private static String getProperty(String property_name) {
|
||||
final String DEFAULT_VALUE = "not specified";
|
||||
return System.getProperty(property_name, DEFAULT_VALUE);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
# Compile Java file
|
||||
javac ./GetProps.java
|
||||
|
||||
# Execute with security manager and policy file
|
||||
java -Djava.security.manager \
|
||||
-Djava.security.policy=.policy \
|
||||
GetProps
|
||||
|
||||
# Remove compiled file
|
||||
rm ./GetProps.class
|
||||
@@ -0,0 +1,5 @@
|
||||
public class Source {
|
||||
public static void main(String[] args) {
|
||||
System.out.println("Hello world!");
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,29 @@
|
||||
# Reset
|
||||
rm ./keystore.jks ./Source_Signed.jar
|
||||
|
||||
# Génère un keystore
|
||||
keytool -genkeypair \
|
||||
-alias SourceKeyAlias \
|
||||
-keyalg RSA \
|
||||
-keysize 2048 \
|
||||
-keystore keystore.jks \
|
||||
-validity 365
|
||||
|
||||
# Compilation
|
||||
javac ./Source.java
|
||||
|
||||
# Créer un fichier MANIFEST.MF avec l'attribut Main-Class
|
||||
echo "Main-Class: Source" > MANIFEST.MF
|
||||
|
||||
# Crée le fichier JAR non signé avec le MANIFEST.MF modifié
|
||||
jar cmf MANIFEST.MF Source.jar Source.class
|
||||
|
||||
# Convertir en fichier JAR signé
|
||||
jarsigner -keystore keystore.jks \
|
||||
-signedjar Source_Signed.jar Source.jar SourceKeyAlias
|
||||
|
||||
# Supprime les artéfacts
|
||||
rm ./Source.class ./Source.jar MANIFEST.MF
|
||||
|
||||
# Essaye d'exécuter ton fichier JAR signé
|
||||
java -jar Source_Signed.jar
|
||||
@@ -0,0 +1,5 @@
|
||||
public class Source {
|
||||
public static void main(String[] args) {
|
||||
System.out.println("Hello world!");
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,112 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Reset
|
||||
rm -rf ./CA
|
||||
rm ./client/certificat_request.csr \
|
||||
./client/certificat_signed.cer \
|
||||
./client/certificat.cer \
|
||||
./client/keystore.jks \
|
||||
./client/Source_Signed.jar
|
||||
|
||||
##########################################
|
||||
|
||||
# Création des dossiers CA et client s'ils n'existent pas déjà
|
||||
mkdir -p CA client
|
||||
|
||||
# Génération de la clé privée de la CA
|
||||
openssl genrsa -out CA/ca.key 2048
|
||||
echo "[CA] - génération de la clé privée : OK"
|
||||
|
||||
# Génération du certificat auto-signé de la CA
|
||||
openssl req -x509 -new -nodes \
|
||||
-key CA/ca.key -sha256 -days 365 \
|
||||
-out CA/ca.crt \
|
||||
-subj "/CN=SimulatedCA/O=MyCA/C=FR"
|
||||
echo "[CA] - génération du certificat auto-signé : OK"
|
||||
|
||||
# Génération du keystore du client
|
||||
keytool -genkeypair \
|
||||
-alias KeyAlias \
|
||||
-keyalg RSA \
|
||||
-keysize 2048 \
|
||||
-keystore client/keystore.jks \
|
||||
-validity 365 \
|
||||
-dname "CN=ClientName, OU=ClientUnit, O=ClientOrg, L=ClientCity, S=ClientState, C=FR" \
|
||||
-storepass changeit \
|
||||
-keypass changeit
|
||||
echo "[Client] - Génération du keystore : OK"
|
||||
|
||||
# Génération de la demande de certificat (CSR) pour le client
|
||||
keytool -certreq \
|
||||
-alias KeyAlias \
|
||||
-keystore client/keystore.jks \
|
||||
-file client/certificat_request.csr \
|
||||
-storepass changeit
|
||||
echo "[Client] - Génération de la demande de certification : OK"
|
||||
|
||||
# La CA signe la demande de certificat du client
|
||||
openssl x509 -req \
|
||||
-in client/certificat_request.csr \
|
||||
-CA CA/ca.crt -CAkey CA/ca.key -CAcreateserial \
|
||||
-out client/certificat_signed.cer -days 365 -sha256
|
||||
echo "[CA] - Signature de la demande de certificat : OK"
|
||||
|
||||
# Importation du certificat de la CA dans le keystore du client
|
||||
keytool -import \
|
||||
-trustcacerts \
|
||||
-alias SimulatedCA \
|
||||
-file CA/ca.crt \
|
||||
-keystore client/keystore.jks \
|
||||
-noprompt \
|
||||
-storepass changeit
|
||||
echo "[Client] - Import du certificat du CA : OK"
|
||||
|
||||
# Importation du certificat signé dans le keystore du client
|
||||
keytool -import \
|
||||
-alias KeyAlias \
|
||||
-keystore client/keystore.jks \
|
||||
-file client/certificat_signed.cer \
|
||||
-noprompt \
|
||||
-storepass changeit
|
||||
echo "[Client] - Import du certificat signé : OK"
|
||||
|
||||
# Exportation du certificat signé pour distribution
|
||||
keytool -export \
|
||||
-alias KeyAlias \
|
||||
-keystore client/keystore.jks \
|
||||
-file client/certificat.cer \
|
||||
-storepass changeit
|
||||
echo "[Client] - Export du certificat signé : OK"
|
||||
|
||||
##########################################
|
||||
|
||||
cd ./client/
|
||||
|
||||
# Compile notre fichier java
|
||||
javac ./Source.java
|
||||
echo "[Client] - Compilation du .java : OK"
|
||||
|
||||
# Créer un fichier MANIFEST.MF avec l'attribut Main-Class
|
||||
echo "Main-Class: Source" > ./MANIFEST.MF
|
||||
|
||||
# Créé le fichier Jar non signé
|
||||
jar cmf ./MANIFEST.MF ./Source.jar ./Source.class
|
||||
echo "[Client] - Creation du fichier .jar : OK"
|
||||
|
||||
# Convertis en fichier jar signé
|
||||
jarsigner -keystore ./keystore.jks \
|
||||
-storepass changeit \
|
||||
-signedjar ./Source_Signed.jar ./Source.jar KeyAlias
|
||||
echo "[Client] - Creation du fichier .jar signé : OK"
|
||||
|
||||
# Supprime les artéfacts
|
||||
rm ./Source.class ./Source.jar ./MANIFEST.MF
|
||||
|
||||
# On peut vérifier que notre certificat est bien valide
|
||||
jarsigner -verify ./Source_Signed.jar
|
||||
echo "[Client] - Vérification du certificat : OK"
|
||||
|
||||
cd ..
|
||||
|
||||
# Executer le jar signé
|
||||
java -jar ./client/Source_Signed.jar
|
||||
@@ -0,0 +1,10 @@
|
||||
keystore "keystore.jks";
|
||||
|
||||
grant signedBy "KeyAlias" {
|
||||
permission java.io.FilePermission "${user.home}${/}Documents${/}Github${/}SecuriteSystemesInfo${/}revision${/}tp1${/}partie5${/}client${/}Source_Signed.jar", "read, execute";
|
||||
};
|
||||
|
||||
grant codeBase "file:${user.home}${/}Documents${/}Github${/}SecuriteSystemesInfo${/}revision${/}tp1${/}partie5${/}client${/}Source_Signed.jar" {
|
||||
permission "java.util.PropertyPermission" "user.home", "read";
|
||||
permission "java.util.PropertyPermission" "java.home", "read";
|
||||
};
|
||||
@@ -0,0 +1,27 @@
|
||||
import java.lang.*;
|
||||
|
||||
public class Source {
|
||||
public static void main(String[] args) {
|
||||
|
||||
try {
|
||||
final String OS_NAME = Source.getProperty("os.name");
|
||||
final String JAVA_VERSION = Source.getProperty("java.version");
|
||||
final String USER_HOME = Source.getProperty("user.home");
|
||||
final String JAVA_HOME = Source.getProperty("java.home");
|
||||
|
||||
System.out.println(
|
||||
"os.name : " + OS_NAME + "\n"
|
||||
+ "java.version : " + JAVA_VERSION + "\n"
|
||||
+ "user.home : " + USER_HOME + "\n"
|
||||
+ "java.home : " + JAVA_HOME
|
||||
);
|
||||
} catch (Exception e) {
|
||||
System.err.println("Caught exception " + e.toString());
|
||||
}
|
||||
}
|
||||
|
||||
private static String getProperty(String property_name) {
|
||||
final String DEFAULT_VALUE = "not specified";
|
||||
return System.getProperty(property_name, DEFAULT_VALUE);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,114 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Reset
|
||||
rm -rf ./CA
|
||||
rm ./client/certificat_request.csr \
|
||||
./client/certificat_signed.cer \
|
||||
./client/certificat.cer \
|
||||
./client/keystore.jks \
|
||||
./client/Source_Signed.jar
|
||||
|
||||
##########################################
|
||||
|
||||
# Création des dossiers CA et client s'ils n'existent pas déjà
|
||||
mkdir -p CA client
|
||||
|
||||
# Génération de la clé privée de la CA
|
||||
openssl genrsa -out CA/ca.key 2048
|
||||
echo "[CA] - génération de la clé privée : OK"
|
||||
|
||||
# Génération du certificat auto-signé de la CA
|
||||
openssl req -x509 -new -nodes \
|
||||
-key CA/ca.key -sha256 -days 365 \
|
||||
-out CA/ca.crt \
|
||||
-subj "/CN=SimulatedCA/O=MyCA/C=FR"
|
||||
echo "[CA] - génération du certificat auto-signé : OK"
|
||||
|
||||
# Génération du keystore du client
|
||||
keytool -genkeypair \
|
||||
-alias KeyAlias \
|
||||
-keyalg RSA \
|
||||
-keysize 2048 \
|
||||
-keystore client/keystore.jks \
|
||||
-validity 365 \
|
||||
-dname "CN=ClientName, OU=ClientUnit, O=ClientOrg, L=ClientCity, S=ClientState, C=FR" \
|
||||
-storepass changeit \
|
||||
-keypass changeit
|
||||
echo "[Client] - Génération du keystore : OK"
|
||||
|
||||
# Génération de la demande de certificat (CSR) pour le client
|
||||
keytool -certreq \
|
||||
-alias KeyAlias \
|
||||
-keystore client/keystore.jks \
|
||||
-file client/certificat_request.csr \
|
||||
-storepass changeit
|
||||
echo "[Client] - Génération de la demande de certification : OK"
|
||||
|
||||
# La CA signe la demande de certificat du client
|
||||
openssl x509 -req \
|
||||
-in client/certificat_request.csr \
|
||||
-CA CA/ca.crt -CAkey CA/ca.key -CAcreateserial \
|
||||
-out client/certificat_signed.cer -days 365 -sha256
|
||||
echo "[CA] - Signature de la demande de certificat : OK"
|
||||
|
||||
# Importation du certificat de la CA dans le keystore du client
|
||||
keytool -import \
|
||||
-trustcacerts \
|
||||
-alias SimulatedCA \
|
||||
-file CA/ca.crt \
|
||||
-keystore client/keystore.jks \
|
||||
-noprompt \
|
||||
-storepass changeit
|
||||
echo "[Client] - Import du certificat du CA : OK"
|
||||
|
||||
# Importation du certificat signé dans le keystore du client
|
||||
keytool -import \
|
||||
-alias KeyAlias \
|
||||
-keystore client/keystore.jks \
|
||||
-file client/certificat_signed.cer \
|
||||
-noprompt \
|
||||
-storepass changeit
|
||||
echo "[Client] - Import du certificat signé : OK"
|
||||
|
||||
# Exportation du certificat signé pour distribution
|
||||
keytool -export \
|
||||
-alias KeyAlias \
|
||||
-keystore client/keystore.jks \
|
||||
-file client/certificat.cer \
|
||||
-storepass changeit
|
||||
echo "[Client] - Export du certificat signé : OK"
|
||||
|
||||
##########################################
|
||||
|
||||
cd client
|
||||
|
||||
# Compile notre fichier java
|
||||
javac Source.java
|
||||
echo "[Client] - Compilation du .java : OK"
|
||||
|
||||
# Créer un fichier MANIFEST.MF avec l'attribut Main-Class
|
||||
echo "Main-Class: Source" > MANIFEST.MF
|
||||
|
||||
# Créé le fichier Jar non signé
|
||||
jar cmf MANIFEST.MF Source.jar Source.class
|
||||
echo "[Client] - Creation du fichier .jar : OK"
|
||||
|
||||
# Convertis en fichier jar signé
|
||||
jarsigner -keystore keystore.jks \
|
||||
-storepass changeit \
|
||||
-signedjar Source_Signed.jar Source.jar KeyAlias
|
||||
echo "[Client] - Creation du fichier .jar signé : OK"
|
||||
|
||||
# Supprime les artéfacts
|
||||
rm Source.class Source.jar MANIFEST.MF
|
||||
|
||||
# On peut vérifier que notre certificat est bien valide
|
||||
jarsigner -verify Source_Signed.jar
|
||||
echo "[Client] - Vérification du certificat : OK"
|
||||
|
||||
# Executer le jar signé
|
||||
java -Djava.security.manager \
|
||||
-Djava.security.policy=.policy \
|
||||
-jar Source_Signed.jar
|
||||
|
||||
cd ..
|
||||
@@ -0,0 +1,5 @@
|
||||
/** Login Configuration for the JAAS Sample Application **/
|
||||
|
||||
Sample {
|
||||
sample.module.SampleLoginModule required debug=true;
|
||||
};
|
||||
@@ -0,0 +1,15 @@
|
||||
# Compile Java files
|
||||
javac \
|
||||
sample/SampleAcn.java \
|
||||
sample/module/SampleLoginModule.java \
|
||||
sample/principal/SamplePrincipal.java
|
||||
|
||||
# Execute
|
||||
java -Djava.security.auth.login.config==jaas.config sample.SampleAcn
|
||||
|
||||
# Reset
|
||||
rm \
|
||||
./sample/MyCallbackHandler.class \
|
||||
./sample/SampleAcn.class \
|
||||
./sample/module/SampleLoginModule.class \
|
||||
./sample/principal/SamplePrincipal.class
|
||||
@@ -0,0 +1,240 @@
|
||||
/*
|
||||
*
|
||||
* Copyright (c) 2001, 2002, Oracle and/or its affiliates. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or
|
||||
* without modification, are permitted provided that the following
|
||||
* conditions are met:
|
||||
*
|
||||
* -Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* -Redistribution in binary form must reproduct the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in
|
||||
* the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
*
|
||||
* Neither the name of Oracle nor the names of
|
||||
* contributors may be used to endorse or promote products derived
|
||||
* from this software without specific prior written permission.
|
||||
*
|
||||
* This software is provided "AS IS," without a warranty of any
|
||||
* kind. ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND
|
||||
* WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,
|
||||
* FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE HEREBY
|
||||
* EXCLUDED. SUN AND ITS LICENSORS SHALL NOT BE LIABLE FOR ANY
|
||||
* DAMAGES OR LIABILITIES SUFFERED BY LICENSEE AS A RESULT OF OR
|
||||
* RELATING TO USE, MODIFICATION OR DISTRIBUTION OF THE SOFTWARE OR
|
||||
* ITS DERIVATIVES. IN NO EVENT WILL SUN OR ITS LICENSORS BE LIABLE
|
||||
* FOR ANY LOST REVENUE, PROFIT OR DATA, OR FOR DIRECT, INDIRECT,
|
||||
* SPECIAL, CONSEQUENTIAL, INCIDENTAL OR PUNITIVE DAMAGES, HOWEVER
|
||||
* CAUSED AND REGARDLESS OF THE THEORY OF LIABILITY, ARISING OUT OF
|
||||
* THE USE OF OR INABILITY TO USE SOFTWARE, EVEN IF SUN HAS BEEN
|
||||
* ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
|
||||
*
|
||||
* You acknowledge that Software is not designed, licensed or
|
||||
* intended for use in the design, construction, operation or
|
||||
* maintenance of any nuclear facility.
|
||||
*/
|
||||
|
||||
package sample;
|
||||
|
||||
import java.io.*;
|
||||
import java.util.*;
|
||||
import javax.security.auth.login.*;
|
||||
import javax.security.auth.*;
|
||||
import javax.security.auth.callback.*;
|
||||
|
||||
/**
|
||||
* <p> This Sample application attempts to authenticate a user
|
||||
* and reports whether or not the authentication was successful.
|
||||
*/
|
||||
public class SampleAcn {
|
||||
|
||||
/**
|
||||
* Attempt to authenticate the user.
|
||||
*
|
||||
* <p>
|
||||
*
|
||||
* @param args input arguments for this application. These are ignored.
|
||||
*/
|
||||
public static void main(String[] args) {
|
||||
|
||||
// Obtain a LoginContext, needed for authentication. Tell it
|
||||
// to use the LoginModule implementation specified by the
|
||||
// entry named "Sample" in the JAAS login configuration
|
||||
// file and to also use the specified CallbackHandler.
|
||||
LoginContext lc = null;
|
||||
try {
|
||||
lc = new LoginContext("Sample", new MyCallbackHandler());
|
||||
} catch (LoginException le) {
|
||||
System.err.println("Cannot create LoginContext. "
|
||||
+ le.getMessage());
|
||||
System.exit(-1);
|
||||
} catch (SecurityException se) {
|
||||
System.err.println("Cannot create LoginContext. "
|
||||
+ se.getMessage());
|
||||
System.exit(-1);
|
||||
}
|
||||
|
||||
// the user has 3 attempts to authenticate successfully
|
||||
int i;
|
||||
for (i = 0; i < 3; i++) {
|
||||
try {
|
||||
|
||||
// attempt authentication
|
||||
lc.login();
|
||||
|
||||
// if we return with no exception, authentication succeeded
|
||||
break;
|
||||
|
||||
} catch (LoginException le) {
|
||||
|
||||
System.err.println("Authentication failed:");
|
||||
System.err.println(" " + le.getMessage());
|
||||
try {
|
||||
Thread.currentThread().sleep(3000);
|
||||
} catch (Exception e) {
|
||||
// ignore
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
// did they fail three times?
|
||||
if (i == 3) {
|
||||
System.out.println("Sorry");
|
||||
System.exit(-1);
|
||||
}
|
||||
|
||||
System.out.println("Authentication succeeded!");
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* The application implements the CallbackHandler.
|
||||
*
|
||||
* <p> This application is text-based. Therefore it displays information
|
||||
* to the user using the OutputStreams System.out and System.err,
|
||||
* and gathers input from the user using the InputStream System.in.
|
||||
*/
|
||||
class MyCallbackHandler implements CallbackHandler {
|
||||
|
||||
/**
|
||||
* Invoke an array of Callbacks.
|
||||
*
|
||||
* <p>
|
||||
*
|
||||
* @param callbacks an array of <code>Callback</code> objects which contain
|
||||
* the information requested by an underlying security
|
||||
* service to be retrieved or displayed.
|
||||
*
|
||||
* @exception java.io.IOException if an input or output error occurs. <p>
|
||||
*
|
||||
* @exception UnsupportedCallbackException if the implementation of this
|
||||
* method does not support one or more of the Callbacks
|
||||
* specified in the <code>callbacks</code> parameter.
|
||||
*/
|
||||
public void handle(Callback[] callbacks)
|
||||
throws IOException, UnsupportedCallbackException {
|
||||
|
||||
for (int i = 0; i < callbacks.length; i++) {
|
||||
if (callbacks[i] instanceof TextOutputCallback) {
|
||||
|
||||
// display the message according to the specified type
|
||||
TextOutputCallback toc = (TextOutputCallback)callbacks[i];
|
||||
switch (toc.getMessageType()) {
|
||||
case TextOutputCallback.INFORMATION:
|
||||
System.out.println(toc.getMessage());
|
||||
break;
|
||||
case TextOutputCallback.ERROR:
|
||||
System.out.println("ERROR: " + toc.getMessage());
|
||||
break;
|
||||
case TextOutputCallback.WARNING:
|
||||
System.out.println("WARNING: " + toc.getMessage());
|
||||
break;
|
||||
default:
|
||||
throw new IOException("Unsupported message type: " +
|
||||
toc.getMessageType());
|
||||
}
|
||||
|
||||
} else if (callbacks[i] instanceof NameCallback) {
|
||||
|
||||
// prompt the user for a username
|
||||
NameCallback nc = (NameCallback)callbacks[i];
|
||||
|
||||
System.err.print(nc.getPrompt());
|
||||
System.err.flush();
|
||||
nc.setName((new BufferedReader
|
||||
(new InputStreamReader(System.in))).readLine());
|
||||
|
||||
} else if (callbacks[i] instanceof PasswordCallback) {
|
||||
|
||||
// prompt the user for sensitive information
|
||||
PasswordCallback pc = (PasswordCallback)callbacks[i];
|
||||
System.err.print(pc.getPrompt());
|
||||
System.err.flush();
|
||||
pc.setPassword(readPassword(System.in));
|
||||
|
||||
} else {
|
||||
throw new UnsupportedCallbackException
|
||||
(callbacks[i], "Unrecognized Callback");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Reads user password from given input stream.
|
||||
private char[] readPassword(InputStream in) throws IOException {
|
||||
|
||||
char[] lineBuffer;
|
||||
char[] buf;
|
||||
int i;
|
||||
|
||||
buf = lineBuffer = new char[128];
|
||||
|
||||
int room = buf.length;
|
||||
int offset = 0;
|
||||
int c;
|
||||
|
||||
loop: while (true) {
|
||||
switch (c = in.read()) {
|
||||
case -1:
|
||||
case '\n':
|
||||
break loop;
|
||||
|
||||
case '\r':
|
||||
int c2 = in.read();
|
||||
if ((c2 != '\n') && (c2 != -1)) {
|
||||
if (!(in instanceof PushbackInputStream)) {
|
||||
in = new PushbackInputStream(in);
|
||||
}
|
||||
((PushbackInputStream)in).unread(c2);
|
||||
} else
|
||||
break loop;
|
||||
|
||||
default:
|
||||
if (--room < 0) {
|
||||
buf = new char[offset + 128];
|
||||
room = buf.length - offset - 1;
|
||||
System.arraycopy(lineBuffer, 0, buf, 0, offset);
|
||||
Arrays.fill(lineBuffer, ' ');
|
||||
lineBuffer = buf;
|
||||
}
|
||||
buf[offset++] = (char) c;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
if (offset == 0) {
|
||||
return null;
|
||||
}
|
||||
|
||||
char[] ret = new char[offset];
|
||||
System.arraycopy(buf, 0, ret, 0, offset);
|
||||
Arrays.fill(buf, ' ');
|
||||
|
||||
return ret;
|
||||
}
|
||||
}
|
||||
+337
@@ -0,0 +1,337 @@
|
||||
/*
|
||||
*
|
||||
* Copyright (c) 2000, 2002, Oracle and/or its affiliates. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or
|
||||
* without modification, are permitted provided that the following
|
||||
* conditions are met:
|
||||
*
|
||||
* -Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* -Redistribution in binary form must reproduct the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in
|
||||
* the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
*
|
||||
* Neither the name of Oracle nor the names of
|
||||
* contributors may be used to endorse or promote products derived
|
||||
* from this software without specific prior written permission.
|
||||
*
|
||||
* This software is provided "AS IS," without a warranty of any
|
||||
* kind. ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND
|
||||
* WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,
|
||||
* FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE HEREBY
|
||||
* EXCLUDED. SUN AND ITS LICENSORS SHALL NOT BE LIABLE FOR ANY
|
||||
* DAMAGES OR LIABILITIES SUFFERED BY LICENSEE AS A RESULT OF OR
|
||||
* RELATING TO USE, MODIFICATION OR DISTRIBUTION OF THE SOFTWARE OR
|
||||
* ITS DERIVATIVES. IN NO EVENT WILL SUN OR ITS LICENSORS BE LIABLE
|
||||
* FOR ANY LOST REVENUE, PROFIT OR DATA, OR FOR DIRECT, INDIRECT,
|
||||
* SPECIAL, CONSEQUENTIAL, INCIDENTAL OR PUNITIVE DAMAGES, HOWEVER
|
||||
* CAUSED AND REGARDLESS OF THE THEORY OF LIABILITY, ARISING OUT OF
|
||||
* THE USE OF OR INABILITY TO USE SOFTWARE, EVEN IF SUN HAS BEEN
|
||||
* ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
|
||||
*
|
||||
* You acknowledge that Software is not designed, licensed or
|
||||
* intended for use in the design, construction, operation or
|
||||
* maintenance of any nuclear facility.
|
||||
*/
|
||||
|
||||
package sample.module;
|
||||
|
||||
import java.util.*;
|
||||
import java.io.IOException;
|
||||
import javax.security.auth.*;
|
||||
import javax.security.auth.callback.*;
|
||||
import javax.security.auth.login.*;
|
||||
import javax.security.auth.spi.*;
|
||||
import sample.principal.SamplePrincipal;
|
||||
|
||||
/**
|
||||
* <p> This sample LoginModule authenticates users with a password.
|
||||
*
|
||||
* <p> This LoginModule only recognizes one user: testUser
|
||||
* <p> testUser's password is: testPassword
|
||||
*
|
||||
* <p> If testUser successfully authenticates itself,
|
||||
* a <code>SamplePrincipal</code> with the testUser's user name
|
||||
* is added to the Subject.
|
||||
*
|
||||
* <p> This LoginModule recognizes the debug option.
|
||||
* If set to true in the login Configuration,
|
||||
* debug messages will be output to the output stream, System.out.
|
||||
*
|
||||
*/
|
||||
public class SampleLoginModule implements LoginModule {
|
||||
|
||||
// initial state
|
||||
private Subject subject;
|
||||
private CallbackHandler callbackHandler;
|
||||
private Map sharedState;
|
||||
private Map options;
|
||||
|
||||
// configurable option
|
||||
private boolean debug = false;
|
||||
|
||||
// the authentication status
|
||||
private boolean succeeded = false;
|
||||
private boolean commitSucceeded = false;
|
||||
|
||||
// username and password
|
||||
private String username;
|
||||
private char[] password;
|
||||
|
||||
// testUser's SamplePrincipal
|
||||
private SamplePrincipal userPrincipal;
|
||||
|
||||
/**
|
||||
* Initialize this <code>LoginModule</code>.
|
||||
*
|
||||
* <p>
|
||||
*
|
||||
* @param subject the <code>Subject</code> to be authenticated. <p>
|
||||
*
|
||||
* @param callbackHandler a <code>CallbackHandler</code> for communicating
|
||||
* with the end user (prompting for user names and
|
||||
* passwords, for example). <p>
|
||||
*
|
||||
* @param sharedState shared <code>LoginModule</code> state. <p>
|
||||
*
|
||||
* @param options options specified in the login
|
||||
* <code>Configuration</code> for this particular
|
||||
* <code>LoginModule</code>.
|
||||
*/
|
||||
public void initialize(Subject subject,
|
||||
CallbackHandler callbackHandler,
|
||||
Map<java.lang.String, ?> sharedState,
|
||||
Map<java.lang.String, ?> options) {
|
||||
|
||||
this.subject = subject;
|
||||
this.callbackHandler = callbackHandler;
|
||||
this.sharedState = sharedState;
|
||||
this.options = options;
|
||||
|
||||
// initialize any configured options
|
||||
debug = "true".equalsIgnoreCase((String)options.get("debug"));
|
||||
}
|
||||
|
||||
/**
|
||||
* Authenticate the user by prompting for a user name and password.
|
||||
*
|
||||
* <p>
|
||||
*
|
||||
* @return true in all cases since this <code>LoginModule</code>
|
||||
* should not be ignored.
|
||||
*
|
||||
* @exception FailedLoginException if the authentication fails. <p>
|
||||
*
|
||||
* @exception LoginException if this <code>LoginModule</code>
|
||||
* is unable to perform the authentication.
|
||||
*/
|
||||
public boolean login() throws LoginException {
|
||||
|
||||
// prompt for a user name and password
|
||||
if (callbackHandler == null)
|
||||
throw new LoginException("Error: no CallbackHandler available " +
|
||||
"to garner authentication information from the user");
|
||||
|
||||
Callback[] callbacks = new Callback[2];
|
||||
callbacks[0] = new NameCallback("user name: ");
|
||||
callbacks[1] = new PasswordCallback("password: ", false);
|
||||
|
||||
try {
|
||||
callbackHandler.handle(callbacks);
|
||||
username = ((NameCallback)callbacks[0]).getName();
|
||||
char[] tmpPassword = ((PasswordCallback)callbacks[1]).getPassword();
|
||||
if (tmpPassword == null) {
|
||||
// treat a NULL password as an empty password
|
||||
tmpPassword = new char[0];
|
||||
}
|
||||
password = new char[tmpPassword.length];
|
||||
System.arraycopy(tmpPassword, 0,
|
||||
password, 0, tmpPassword.length);
|
||||
((PasswordCallback)callbacks[1]).clearPassword();
|
||||
|
||||
} catch (java.io.IOException ioe) {
|
||||
throw new LoginException(ioe.toString());
|
||||
} catch (UnsupportedCallbackException uce) {
|
||||
throw new LoginException("Error: " + uce.getCallback().toString() +
|
||||
" not available to garner authentication information " +
|
||||
"from the user");
|
||||
}
|
||||
|
||||
// print debugging information
|
||||
if (debug) {
|
||||
System.out.println("\t\t[SampleLoginModule] " +
|
||||
"user entered user name: " +
|
||||
username);
|
||||
System.out.print("\t\t[SampleLoginModule] " +
|
||||
"user entered password: ");
|
||||
for (int i = 0; i < password.length; i++)
|
||||
System.out.print(password[i]);
|
||||
System.out.println();
|
||||
}
|
||||
|
||||
// verify the username/password
|
||||
boolean usernameCorrect = false;
|
||||
boolean passwordCorrect = false;
|
||||
if (username.equals("testUser"))
|
||||
usernameCorrect = true;
|
||||
if (usernameCorrect &&
|
||||
password.length == 12 &&
|
||||
password[0] == 't' &&
|
||||
password[1] == 'e' &&
|
||||
password[2] == 's' &&
|
||||
password[3] == 't' &&
|
||||
password[4] == 'P' &&
|
||||
password[5] == 'a' &&
|
||||
password[6] == 's' &&
|
||||
password[7] == 's' &&
|
||||
password[8] == 'w' &&
|
||||
password[9] == 'o' &&
|
||||
password[10] == 'r' &&
|
||||
password[11] == 'd') {
|
||||
|
||||
// authentication succeeded!!!
|
||||
passwordCorrect = true;
|
||||
if (debug)
|
||||
System.out.println("\t\t[SampleLoginModule] " +
|
||||
"authentication succeeded");
|
||||
succeeded = true;
|
||||
return true;
|
||||
} else {
|
||||
|
||||
// authentication failed -- clean out state
|
||||
if (debug)
|
||||
System.out.println("\t\t[SampleLoginModule] " +
|
||||
"authentication failed");
|
||||
succeeded = false;
|
||||
username = null;
|
||||
for (int i = 0; i < password.length; i++)
|
||||
password[i] = ' ';
|
||||
password = null;
|
||||
if (!usernameCorrect) {
|
||||
throw new FailedLoginException("User Name Incorrect");
|
||||
} else {
|
||||
throw new FailedLoginException("Password Incorrect");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* <p> This method is called if the LoginContext's
|
||||
* overall authentication succeeded
|
||||
* (the relevant REQUIRED, REQUISITE, SUFFICIENT and OPTIONAL LoginModules
|
||||
* succeeded).
|
||||
*
|
||||
* <p> If this LoginModule's own authentication attempt
|
||||
* succeeded (checked by retrieving the private state saved by the
|
||||
* <code>login</code> method), then this method associates a
|
||||
* <code>SamplePrincipal</code>
|
||||
* with the <code>Subject</code> located in the
|
||||
* <code>LoginModule</code>. If this LoginModule's own
|
||||
* authentication attempted failed, then this method removes
|
||||
* any state that was originally saved.
|
||||
*
|
||||
* <p>
|
||||
*
|
||||
* @exception LoginException if the commit fails.
|
||||
*
|
||||
* @return true if this LoginModule's own login and commit
|
||||
* attempts succeeded, or false otherwise.
|
||||
*/
|
||||
public boolean commit() throws LoginException {
|
||||
if (succeeded == false) {
|
||||
return false;
|
||||
} else {
|
||||
// add a Principal (authenticated identity)
|
||||
// to the Subject
|
||||
|
||||
// assume the user we authenticated is the SamplePrincipal
|
||||
userPrincipal = new SamplePrincipal(username);
|
||||
if (!subject.getPrincipals().contains(userPrincipal))
|
||||
subject.getPrincipals().add(userPrincipal);
|
||||
|
||||
if (debug) {
|
||||
System.out.println("\t\t[SampleLoginModule] " +
|
||||
"added SamplePrincipal to Subject");
|
||||
}
|
||||
|
||||
// in any case, clean out state
|
||||
username = null;
|
||||
for (int i = 0; i < password.length; i++)
|
||||
password[i] = ' ';
|
||||
password = null;
|
||||
|
||||
commitSucceeded = true;
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* <p> This method is called if the LoginContext's
|
||||
* overall authentication failed.
|
||||
* (the relevant REQUIRED, REQUISITE, SUFFICIENT and OPTIONAL LoginModules
|
||||
* did not succeed).
|
||||
*
|
||||
* <p> If this LoginModule's own authentication attempt
|
||||
* succeeded (checked by retrieving the private state saved by the
|
||||
* <code>login</code> and <code>commit</code> methods),
|
||||
* then this method cleans up any state that was originally saved.
|
||||
*
|
||||
* <p>
|
||||
*
|
||||
* @exception LoginException if the abort fails.
|
||||
*
|
||||
* @return false if this LoginModule's own login and/or commit attempts
|
||||
* failed, and true otherwise.
|
||||
*/
|
||||
public boolean abort() throws LoginException {
|
||||
if (succeeded == false) {
|
||||
return false;
|
||||
} else if (succeeded == true && commitSucceeded == false) {
|
||||
// login succeeded but overall authentication failed
|
||||
succeeded = false;
|
||||
username = null;
|
||||
if (password != null) {
|
||||
for (int i = 0; i < password.length; i++)
|
||||
password[i] = ' ';
|
||||
password = null;
|
||||
}
|
||||
userPrincipal = null;
|
||||
} else {
|
||||
// overall authentication succeeded and commit succeeded,
|
||||
// but someone else's commit failed
|
||||
logout();
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Logout the user.
|
||||
*
|
||||
* <p> This method removes the <code>SamplePrincipal</code>
|
||||
* that was added by the <code>commit</code> method.
|
||||
*
|
||||
* <p>
|
||||
*
|
||||
* @exception LoginException if the logout fails.
|
||||
*
|
||||
* @return true in all cases since this <code>LoginModule</code>
|
||||
* should not be ignored.
|
||||
*/
|
||||
public boolean logout() throws LoginException {
|
||||
|
||||
subject.getPrincipals().remove(userPrincipal);
|
||||
succeeded = false;
|
||||
succeeded = commitSucceeded;
|
||||
username = null;
|
||||
if (password != null) {
|
||||
for (int i = 0; i < password.length; i++)
|
||||
password[i] = ' ';
|
||||
password = null;
|
||||
}
|
||||
userPrincipal = null;
|
||||
return true;
|
||||
}
|
||||
}
|
||||
+144
@@ -0,0 +1,144 @@
|
||||
/*
|
||||
*
|
||||
* Copyright (c) 2000, 2002, Oracle and/or its affiliates. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or
|
||||
* without modification, are permitted provided that the following
|
||||
* conditions are met:
|
||||
*
|
||||
* -Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* -Redistribution in binary form must reproduct the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in
|
||||
* the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
*
|
||||
* Neither the name of Oracle nor the names of
|
||||
* contributors may be used to endorse or promote products derived
|
||||
* from this software without specific prior written permission.
|
||||
*
|
||||
* This software is provided "AS IS," without a warranty of any
|
||||
* kind. ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND
|
||||
* WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,
|
||||
* FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE HEREBY
|
||||
* EXCLUDED. SUN AND ITS LICENSORS SHALL NOT BE LIABLE FOR ANY
|
||||
* DAMAGES OR LIABILITIES SUFFERED BY LICENSEE AS A RESULT OF OR
|
||||
* RELATING TO USE, MODIFICATION OR DISTRIBUTION OF THE SOFTWARE OR
|
||||
* ITS DERIVATIVES. IN NO EVENT WILL SUN OR ITS LICENSORS BE LIABLE
|
||||
* FOR ANY LOST REVENUE, PROFIT OR DATA, OR FOR DIRECT, INDIRECT,
|
||||
* SPECIAL, CONSEQUENTIAL, INCIDENTAL OR PUNITIVE DAMAGES, HOWEVER
|
||||
* CAUSED AND REGARDLESS OF THE THEORY OF LIABILITY, ARISING OUT OF
|
||||
* THE USE OF OR INABILITY TO USE SOFTWARE, EVEN IF SUN HAS BEEN
|
||||
* ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
|
||||
*
|
||||
* You acknowledge that Software is not designed, licensed or
|
||||
* intended for use in the design, construction, operation or
|
||||
* maintenance of any nuclear facility.
|
||||
*/
|
||||
|
||||
package sample.principal;
|
||||
|
||||
import java.security.Principal;
|
||||
|
||||
/**
|
||||
* <p> This class implements the <code>Principal</code> interface
|
||||
* and represents a Sample user.
|
||||
*
|
||||
* <p> Principals such as this <code>SamplePrincipal</code>
|
||||
* may be associated with a particular <code>Subject</code>
|
||||
* to augment that <code>Subject</code> with an additional
|
||||
* identity. Refer to the <code>Subject</code> class for more information
|
||||
* on how to achieve this. Authorization decisions can then be based upon
|
||||
* the Principals associated with a <code>Subject</code>.
|
||||
*
|
||||
* @see java.security.Principal
|
||||
* @see javax.security.auth.Subject
|
||||
*/
|
||||
public class SamplePrincipal implements Principal, java.io.Serializable {
|
||||
|
||||
/**
|
||||
* @serial
|
||||
*/
|
||||
private String name;
|
||||
|
||||
/**
|
||||
* Create a SamplePrincipal with a Sample username.
|
||||
*
|
||||
* <p>
|
||||
*
|
||||
* @param name the Sample username for this user.
|
||||
*
|
||||
* @exception NullPointerException if the <code>name</code>
|
||||
* is <code>null</code>.
|
||||
*/
|
||||
public SamplePrincipal(String name) {
|
||||
if (name == null)
|
||||
throw new NullPointerException("illegal null input");
|
||||
|
||||
this.name = name;
|
||||
}
|
||||
|
||||
/**
|
||||
* Return the Sample username for this <code>SamplePrincipal</code>.
|
||||
*
|
||||
* <p>
|
||||
*
|
||||
* @return the Sample username for this <code>SamplePrincipal</code>
|
||||
*/
|
||||
public String getName() {
|
||||
return name;
|
||||
}
|
||||
|
||||
/**
|
||||
* Return a string representation of this <code>SamplePrincipal</code>.
|
||||
*
|
||||
* <p>
|
||||
*
|
||||
* @return a string representation of this <code>SamplePrincipal</code>.
|
||||
*/
|
||||
public String toString() {
|
||||
return("SamplePrincipal: " + name);
|
||||
}
|
||||
|
||||
/**
|
||||
* Compares the specified Object with this <code>SamplePrincipal</code>
|
||||
* for equality. Returns true if the given object is also a
|
||||
* <code>SamplePrincipal</code> and the two SamplePrincipals
|
||||
* have the same username.
|
||||
*
|
||||
* <p>
|
||||
*
|
||||
* @param o Object to be compared for equality with this
|
||||
* <code>SamplePrincipal</code>.
|
||||
*
|
||||
* @return true if the specified Object is equal equal to this
|
||||
* <code>SamplePrincipal</code>.
|
||||
*/
|
||||
public boolean equals(Object o) {
|
||||
if (o == null)
|
||||
return false;
|
||||
|
||||
if (this == o)
|
||||
return true;
|
||||
|
||||
if (!(o instanceof SamplePrincipal))
|
||||
return false;
|
||||
SamplePrincipal that = (SamplePrincipal)o;
|
||||
|
||||
if (this.getName().equals(that.getName()))
|
||||
return true;
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Return a hash code for this <code>SamplePrincipal</code>.
|
||||
*
|
||||
* <p>
|
||||
*
|
||||
* @return a hash code for this <code>SamplePrincipal</code>.
|
||||
*/
|
||||
public int hashCode() {
|
||||
return name.hashCode();
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,7 @@
|
||||
grant codebase "file:./SampleLM.jar" {
|
||||
permission javax.security.auth.AuthPermission "modifyPrincipals";
|
||||
};
|
||||
|
||||
grant codebase "file:./SampleAcn.jar" {
|
||||
permission javax.security.auth.AuthPermission "createLoginContext.Sample";
|
||||
};
|
||||
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,5 @@
|
||||
/** Login Configuration for the JAAS Sample Application **/
|
||||
|
||||
Sample {
|
||||
sample.module.SampleLoginModule required debug=true;
|
||||
};
|
||||
@@ -0,0 +1,28 @@
|
||||
# Reset
|
||||
rm \
|
||||
./SampleAcn.jar \
|
||||
./SampleLM.jar
|
||||
|
||||
# Compile Java files
|
||||
javac \
|
||||
sample/SampleAcn.java \
|
||||
sample/module/SampleLoginModule.java \
|
||||
sample/principal/SamplePrincipal.java
|
||||
|
||||
# Crée deux fichier Jar (SampleAcn et SampleLM)
|
||||
jar -cvf SampleAcn.jar sample/SampleAcn.class sample/MyCallbackHandler.class
|
||||
jar -cvf SampleLM.jar sample/module/SampleLoginModule.class sample/principal/SamplePrincipal.class
|
||||
|
||||
# Supprime les artéfacts
|
||||
rm \
|
||||
./sample/MyCallbackHandler.class \
|
||||
./sample/SampleAcn.class \
|
||||
./sample/module/SampleLoginModule.class \
|
||||
./sample/principal/SamplePrincipal.class \
|
||||
|
||||
# Exécute
|
||||
java -classpath SampleAcn.jar:SampleLM.jar \
|
||||
-Djava.security.manager \
|
||||
-Djava.security.policy==.policy \
|
||||
-Djava.security.auth.login.config==jaas.config \
|
||||
sample.SampleAcn
|
||||
@@ -0,0 +1,237 @@
|
||||
/*
|
||||
*
|
||||
* Copyright (c) 2001, 2002, Oracle and/or its affiliates. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or
|
||||
* without modification, are permitted provided that the following
|
||||
* conditions are met:
|
||||
*
|
||||
* -Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* -Redistribution in binary form must reproduct the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in
|
||||
* the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
*
|
||||
* Neither the name of Oracle nor the names of
|
||||
* contributors may be used to endorse or promote products derived
|
||||
* from this software without specific prior written permission.
|
||||
*
|
||||
* This software is provided "AS IS," without a warranty of any
|
||||
* kind. ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND
|
||||
* WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,
|
||||
* FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE HEREBY
|
||||
* EXCLUDED. SUN AND ITS LICENSORS SHALL NOT BE LIABLE FOR ANY
|
||||
* DAMAGES OR LIABILITIES SUFFERED BY LICENSEE AS A RESULT OF OR
|
||||
* RELATING TO USE, MODIFICATION OR DISTRIBUTION OF THE SOFTWARE OR
|
||||
* ITS DERIVATIVES. IN NO EVENT WILL SUN OR ITS LICENSORS BE LIABLE
|
||||
* FOR ANY LOST REVENUE, PROFIT OR DATA, OR FOR DIRECT, INDIRECT,
|
||||
* SPECIAL, CONSEQUENTIAL, INCIDENTAL OR PUNITIVE DAMAGES, HOWEVER
|
||||
* CAUSED AND REGARDLESS OF THE THEORY OF LIABILITY, ARISING OUT OF
|
||||
* THE USE OF OR INABILITY TO USE SOFTWARE, EVEN IF SUN HAS BEEN
|
||||
* ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
|
||||
*
|
||||
* You acknowledge that Software is not designed, licensed or
|
||||
* intended for use in the design, construction, operation or
|
||||
* maintenance of any nuclear facility.
|
||||
*/
|
||||
|
||||
package sample;
|
||||
|
||||
import java.io.*;
|
||||
import java.util.*;
|
||||
import javax.security.auth.login.*;
|
||||
import javax.security.auth.*;
|
||||
import javax.security.auth.callback.*;
|
||||
|
||||
/**
|
||||
* <p> This Sample application attempts to authenticate a user
|
||||
* and reports whether or not the authentication was successful.
|
||||
*/
|
||||
public class SampleAcn {
|
||||
|
||||
/**
|
||||
* Attempt to authenticate the user.
|
||||
*
|
||||
* <p>
|
||||
*
|
||||
* @param args input arguments for this application. These are ignored.
|
||||
*/
|
||||
public static void main(String[] args) {
|
||||
|
||||
// Obtain a LoginContext, needed for authentication. Tell it
|
||||
// to use the LoginModule implementation specified by the
|
||||
// entry named "Sample" in the JAAS login configuration
|
||||
// file and to also use the specified CallbackHandler.
|
||||
LoginContext lc = null;
|
||||
try {
|
||||
lc = new LoginContext("Sample", new MyCallbackHandler());
|
||||
} catch (LoginException le) {
|
||||
System.err.println("Cannot create LoginContext. " + le.getMessage());
|
||||
System.exit(-1);
|
||||
} catch (SecurityException se) {
|
||||
System.err.println("Cannot create LoginContext. " + se.getMessage());
|
||||
System.exit(-1);
|
||||
}
|
||||
|
||||
// the user has 3 attempts to authenticate successfully
|
||||
int i;
|
||||
for (i = 0; i < 3; i++) {
|
||||
try {
|
||||
|
||||
// attempt authentication
|
||||
lc.login();
|
||||
|
||||
// if we return with no exception, authentication succeeded
|
||||
break;
|
||||
|
||||
} catch (LoginException le) {
|
||||
|
||||
System.err.println("Authentication failed:");
|
||||
System.err.println(" " + le.getMessage());
|
||||
try {
|
||||
Thread.currentThread().sleep(3000);
|
||||
} catch (Exception e) {
|
||||
// ignore
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
// did they fail three times?
|
||||
if (i == 3) {
|
||||
System.out.println("Sorry");
|
||||
System.exit(-1);
|
||||
}
|
||||
|
||||
System.out.println("Authentication succeeded!");
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* The application implements the CallbackHandler.
|
||||
*
|
||||
* <p> This application is text-based. Therefore it displays information
|
||||
* to the user using the OutputStreams System.out and System.err,
|
||||
* and gathers input from the user using the InputStream System.in.
|
||||
*/
|
||||
class MyCallbackHandler implements CallbackHandler {
|
||||
|
||||
/**
|
||||
* Invoke an array of Callbacks.
|
||||
*
|
||||
* <p>
|
||||
*
|
||||
* @param callbacks an array of <code>Callback</code> objects which contain
|
||||
* the information requested by an underlying security
|
||||
* service to be retrieved or displayed.
|
||||
*
|
||||
* @exception java.io.IOException if an input or output error occurs. <p>
|
||||
*
|
||||
* @exception UnsupportedCallbackException if the implementation of this
|
||||
* method does not support one or more of the Callbacks
|
||||
* specified in the <code>callbacks</code> parameter.
|
||||
*/
|
||||
public void handle(Callback[] callbacks)
|
||||
throws IOException, UnsupportedCallbackException {
|
||||
|
||||
for (int i = 0; i < callbacks.length; i++) {
|
||||
if (callbacks[i] instanceof TextOutputCallback) {
|
||||
|
||||
// display the message according to the specified type
|
||||
TextOutputCallback toc = (TextOutputCallback)callbacks[i];
|
||||
switch (toc.getMessageType()) {
|
||||
case TextOutputCallback.INFORMATION:
|
||||
System.out.println(toc.getMessage());
|
||||
break;
|
||||
case TextOutputCallback.ERROR:
|
||||
System.out.println("ERROR: " + toc.getMessage());
|
||||
break;
|
||||
case TextOutputCallback.WARNING:
|
||||
System.out.println("WARNING: " + toc.getMessage());
|
||||
break;
|
||||
default:
|
||||
throw new IOException("Unsupported message type: " + toc.getMessageType());
|
||||
}
|
||||
|
||||
} else if (callbacks[i] instanceof NameCallback) {
|
||||
|
||||
// prompt the user for a username
|
||||
NameCallback nc = (NameCallback)callbacks[i];
|
||||
|
||||
System.err.print(nc.getPrompt());
|
||||
System.err.flush();
|
||||
nc.setName((new BufferedReader
|
||||
(new InputStreamReader(System.in))).readLine());
|
||||
|
||||
} else if (callbacks[i] instanceof PasswordCallback) {
|
||||
|
||||
// prompt the user for sensitive information
|
||||
PasswordCallback pc = (PasswordCallback)callbacks[i];
|
||||
System.err.print(pc.getPrompt());
|
||||
System.err.flush();
|
||||
pc.setPassword(readPassword(System.in));
|
||||
|
||||
} else {
|
||||
throw new UnsupportedCallbackException
|
||||
(callbacks[i], "Unrecognized Callback");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Reads user password from given input stream.
|
||||
private char[] readPassword(InputStream in) throws IOException {
|
||||
|
||||
char[] lineBuffer;
|
||||
char[] buf;
|
||||
int i;
|
||||
|
||||
buf = lineBuffer = new char[128];
|
||||
|
||||
int room = buf.length;
|
||||
int offset = 0;
|
||||
int c;
|
||||
|
||||
loop: while (true) {
|
||||
switch (c = in.read()) {
|
||||
case -1:
|
||||
case '\n':
|
||||
break loop;
|
||||
|
||||
case '\r':
|
||||
int c2 = in.read();
|
||||
if ((c2 != '\n') && (c2 != -1)) {
|
||||
if (!(in instanceof PushbackInputStream)) {
|
||||
in = new PushbackInputStream(in);
|
||||
}
|
||||
((PushbackInputStream)in).unread(c2);
|
||||
} else
|
||||
break loop;
|
||||
|
||||
default:
|
||||
if (--room < 0) {
|
||||
buf = new char[offset + 128];
|
||||
room = buf.length - offset - 1;
|
||||
System.arraycopy(lineBuffer, 0, buf, 0, offset);
|
||||
Arrays.fill(lineBuffer, ' ');
|
||||
lineBuffer = buf;
|
||||
}
|
||||
buf[offset++] = (char) c;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
if (offset == 0) {
|
||||
return null;
|
||||
}
|
||||
|
||||
char[] ret = new char[offset];
|
||||
System.arraycopy(buf, 0, ret, 0, offset);
|
||||
Arrays.fill(buf, ' ');
|
||||
|
||||
return ret;
|
||||
}
|
||||
}
|
||||
+337
@@ -0,0 +1,337 @@
|
||||
/*
|
||||
*
|
||||
* Copyright (c) 2000, 2002, Oracle and/or its affiliates. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or
|
||||
* without modification, are permitted provided that the following
|
||||
* conditions are met:
|
||||
*
|
||||
* -Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* -Redistribution in binary form must reproduct the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in
|
||||
* the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
*
|
||||
* Neither the name of Oracle nor the names of
|
||||
* contributors may be used to endorse or promote products derived
|
||||
* from this software without specific prior written permission.
|
||||
*
|
||||
* This software is provided "AS IS," without a warranty of any
|
||||
* kind. ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND
|
||||
* WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,
|
||||
* FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE HEREBY
|
||||
* EXCLUDED. SUN AND ITS LICENSORS SHALL NOT BE LIABLE FOR ANY
|
||||
* DAMAGES OR LIABILITIES SUFFERED BY LICENSEE AS A RESULT OF OR
|
||||
* RELATING TO USE, MODIFICATION OR DISTRIBUTION OF THE SOFTWARE OR
|
||||
* ITS DERIVATIVES. IN NO EVENT WILL SUN OR ITS LICENSORS BE LIABLE
|
||||
* FOR ANY LOST REVENUE, PROFIT OR DATA, OR FOR DIRECT, INDIRECT,
|
||||
* SPECIAL, CONSEQUENTIAL, INCIDENTAL OR PUNITIVE DAMAGES, HOWEVER
|
||||
* CAUSED AND REGARDLESS OF THE THEORY OF LIABILITY, ARISING OUT OF
|
||||
* THE USE OF OR INABILITY TO USE SOFTWARE, EVEN IF SUN HAS BEEN
|
||||
* ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
|
||||
*
|
||||
* You acknowledge that Software is not designed, licensed or
|
||||
* intended for use in the design, construction, operation or
|
||||
* maintenance of any nuclear facility.
|
||||
*/
|
||||
|
||||
package sample.module;
|
||||
|
||||
import java.util.*;
|
||||
import java.io.IOException;
|
||||
import javax.security.auth.*;
|
||||
import javax.security.auth.callback.*;
|
||||
import javax.security.auth.login.*;
|
||||
import javax.security.auth.spi.*;
|
||||
import sample.principal.SamplePrincipal;
|
||||
|
||||
/**
|
||||
* <p> This sample LoginModule authenticates users with a password.
|
||||
*
|
||||
* <p> This LoginModule only recognizes one user: testUser
|
||||
* <p> testUser's password is: testPassword
|
||||
*
|
||||
* <p> If testUser successfully authenticates itself,
|
||||
* a <code>SamplePrincipal</code> with the testUser's user name
|
||||
* is added to the Subject.
|
||||
*
|
||||
* <p> This LoginModule recognizes the debug option.
|
||||
* If set to true in the login Configuration,
|
||||
* debug messages will be output to the output stream, System.out.
|
||||
*
|
||||
*/
|
||||
public class SampleLoginModule implements LoginModule {
|
||||
|
||||
// initial state
|
||||
private Subject subject;
|
||||
private CallbackHandler callbackHandler;
|
||||
private Map sharedState;
|
||||
private Map options;
|
||||
|
||||
// configurable option
|
||||
private boolean debug = false;
|
||||
|
||||
// the authentication status
|
||||
private boolean succeeded = false;
|
||||
private boolean commitSucceeded = false;
|
||||
|
||||
// username and password
|
||||
private String username;
|
||||
private char[] password;
|
||||
|
||||
// testUser's SamplePrincipal
|
||||
private SamplePrincipal userPrincipal;
|
||||
|
||||
/**
|
||||
* Initialize this <code>LoginModule</code>.
|
||||
*
|
||||
* <p>
|
||||
*
|
||||
* @param subject the <code>Subject</code> to be authenticated. <p>
|
||||
*
|
||||
* @param callbackHandler a <code>CallbackHandler</code> for communicating
|
||||
* with the end user (prompting for user names and
|
||||
* passwords, for example). <p>
|
||||
*
|
||||
* @param sharedState shared <code>LoginModule</code> state. <p>
|
||||
*
|
||||
* @param options options specified in the login
|
||||
* <code>Configuration</code> for this particular
|
||||
* <code>LoginModule</code>.
|
||||
*/
|
||||
public void initialize(Subject subject,
|
||||
CallbackHandler callbackHandler,
|
||||
Map<java.lang.String, ?> sharedState,
|
||||
Map<java.lang.String, ?> options) {
|
||||
|
||||
this.subject = subject;
|
||||
this.callbackHandler = callbackHandler;
|
||||
this.sharedState = sharedState;
|
||||
this.options = options;
|
||||
|
||||
// initialize any configured options
|
||||
debug = "true".equalsIgnoreCase((String)options.get("debug"));
|
||||
}
|
||||
|
||||
/**
|
||||
* Authenticate the user by prompting for a user name and password.
|
||||
*
|
||||
* <p>
|
||||
*
|
||||
* @return true in all cases since this <code>LoginModule</code>
|
||||
* should not be ignored.
|
||||
*
|
||||
* @exception FailedLoginException if the authentication fails. <p>
|
||||
*
|
||||
* @exception LoginException if this <code>LoginModule</code>
|
||||
* is unable to perform the authentication.
|
||||
*/
|
||||
public boolean login() throws LoginException {
|
||||
|
||||
// prompt for a user name and password
|
||||
if (callbackHandler == null)
|
||||
throw new LoginException("Error: no CallbackHandler available " +
|
||||
"to garner authentication information from the user");
|
||||
|
||||
Callback[] callbacks = new Callback[2];
|
||||
callbacks[0] = new NameCallback("user name: ");
|
||||
callbacks[1] = new PasswordCallback("password: ", false);
|
||||
|
||||
try {
|
||||
callbackHandler.handle(callbacks);
|
||||
username = ((NameCallback)callbacks[0]).getName();
|
||||
char[] tmpPassword = ((PasswordCallback)callbacks[1]).getPassword();
|
||||
if (tmpPassword == null) {
|
||||
// treat a NULL password as an empty password
|
||||
tmpPassword = new char[0];
|
||||
}
|
||||
password = new char[tmpPassword.length];
|
||||
System.arraycopy(tmpPassword, 0,
|
||||
password, 0, tmpPassword.length);
|
||||
((PasswordCallback)callbacks[1]).clearPassword();
|
||||
|
||||
} catch (java.io.IOException ioe) {
|
||||
throw new LoginException(ioe.toString());
|
||||
} catch (UnsupportedCallbackException uce) {
|
||||
throw new LoginException("Error: " + uce.getCallback().toString() +
|
||||
" not available to garner authentication information " +
|
||||
"from the user");
|
||||
}
|
||||
|
||||
// print debugging information
|
||||
if (debug) {
|
||||
System.out.println("\t\t[SampleLoginModule] " +
|
||||
"user entered user name: " +
|
||||
username);
|
||||
System.out.print("\t\t[SampleLoginModule] " +
|
||||
"user entered password: ");
|
||||
for (int i = 0; i < password.length; i++)
|
||||
System.out.print(password[i]);
|
||||
System.out.println();
|
||||
}
|
||||
|
||||
// verify the username/password
|
||||
boolean usernameCorrect = false;
|
||||
boolean passwordCorrect = false;
|
||||
if (username.equals("testUser"))
|
||||
usernameCorrect = true;
|
||||
if (usernameCorrect &&
|
||||
password.length == 12 &&
|
||||
password[0] == 't' &&
|
||||
password[1] == 'e' &&
|
||||
password[2] == 's' &&
|
||||
password[3] == 't' &&
|
||||
password[4] == 'P' &&
|
||||
password[5] == 'a' &&
|
||||
password[6] == 's' &&
|
||||
password[7] == 's' &&
|
||||
password[8] == 'w' &&
|
||||
password[9] == 'o' &&
|
||||
password[10] == 'r' &&
|
||||
password[11] == 'd') {
|
||||
|
||||
// authentication succeeded!!!
|
||||
passwordCorrect = true;
|
||||
if (debug)
|
||||
System.out.println("\t\t[SampleLoginModule] " +
|
||||
"authentication succeeded");
|
||||
succeeded = true;
|
||||
return true;
|
||||
} else {
|
||||
|
||||
// authentication failed -- clean out state
|
||||
if (debug)
|
||||
System.out.println("\t\t[SampleLoginModule] " +
|
||||
"authentication failed");
|
||||
succeeded = false;
|
||||
username = null;
|
||||
for (int i = 0; i < password.length; i++)
|
||||
password[i] = ' ';
|
||||
password = null;
|
||||
if (!usernameCorrect) {
|
||||
throw new FailedLoginException("User Name Incorrect");
|
||||
} else {
|
||||
throw new FailedLoginException("Password Incorrect");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* <p> This method is called if the LoginContext's
|
||||
* overall authentication succeeded
|
||||
* (the relevant REQUIRED, REQUISITE, SUFFICIENT and OPTIONAL LoginModules
|
||||
* succeeded).
|
||||
*
|
||||
* <p> If this LoginModule's own authentication attempt
|
||||
* succeeded (checked by retrieving the private state saved by the
|
||||
* <code>login</code> method), then this method associates a
|
||||
* <code>SamplePrincipal</code>
|
||||
* with the <code>Subject</code> located in the
|
||||
* <code>LoginModule</code>. If this LoginModule's own
|
||||
* authentication attempted failed, then this method removes
|
||||
* any state that was originally saved.
|
||||
*
|
||||
* <p>
|
||||
*
|
||||
* @exception LoginException if the commit fails.
|
||||
*
|
||||
* @return true if this LoginModule's own login and commit
|
||||
* attempts succeeded, or false otherwise.
|
||||
*/
|
||||
public boolean commit() throws LoginException {
|
||||
if (succeeded == false) {
|
||||
return false;
|
||||
} else {
|
||||
// add a Principal (authenticated identity)
|
||||
// to the Subject
|
||||
|
||||
// assume the user we authenticated is the SamplePrincipal
|
||||
userPrincipal = new SamplePrincipal(username);
|
||||
if (!subject.getPrincipals().contains(userPrincipal))
|
||||
subject.getPrincipals().add(userPrincipal);
|
||||
|
||||
if (debug) {
|
||||
System.out.println("\t\t[SampleLoginModule] " +
|
||||
"added SamplePrincipal to Subject");
|
||||
}
|
||||
|
||||
// in any case, clean out state
|
||||
username = null;
|
||||
for (int i = 0; i < password.length; i++)
|
||||
password[i] = ' ';
|
||||
password = null;
|
||||
|
||||
commitSucceeded = true;
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* <p> This method is called if the LoginContext's
|
||||
* overall authentication failed.
|
||||
* (the relevant REQUIRED, REQUISITE, SUFFICIENT and OPTIONAL LoginModules
|
||||
* did not succeed).
|
||||
*
|
||||
* <p> If this LoginModule's own authentication attempt
|
||||
* succeeded (checked by retrieving the private state saved by the
|
||||
* <code>login</code> and <code>commit</code> methods),
|
||||
* then this method cleans up any state that was originally saved.
|
||||
*
|
||||
* <p>
|
||||
*
|
||||
* @exception LoginException if the abort fails.
|
||||
*
|
||||
* @return false if this LoginModule's own login and/or commit attempts
|
||||
* failed, and true otherwise.
|
||||
*/
|
||||
public boolean abort() throws LoginException {
|
||||
if (succeeded == false) {
|
||||
return false;
|
||||
} else if (succeeded == true && commitSucceeded == false) {
|
||||
// login succeeded but overall authentication failed
|
||||
succeeded = false;
|
||||
username = null;
|
||||
if (password != null) {
|
||||
for (int i = 0; i < password.length; i++)
|
||||
password[i] = ' ';
|
||||
password = null;
|
||||
}
|
||||
userPrincipal = null;
|
||||
} else {
|
||||
// overall authentication succeeded and commit succeeded,
|
||||
// but someone else's commit failed
|
||||
logout();
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Logout the user.
|
||||
*
|
||||
* <p> This method removes the <code>SamplePrincipal</code>
|
||||
* that was added by the <code>commit</code> method.
|
||||
*
|
||||
* <p>
|
||||
*
|
||||
* @exception LoginException if the logout fails.
|
||||
*
|
||||
* @return true in all cases since this <code>LoginModule</code>
|
||||
* should not be ignored.
|
||||
*/
|
||||
public boolean logout() throws LoginException {
|
||||
|
||||
subject.getPrincipals().remove(userPrincipal);
|
||||
succeeded = false;
|
||||
succeeded = commitSucceeded;
|
||||
username = null;
|
||||
if (password != null) {
|
||||
for (int i = 0; i < password.length; i++)
|
||||
password[i] = ' ';
|
||||
password = null;
|
||||
}
|
||||
userPrincipal = null;
|
||||
return true;
|
||||
}
|
||||
}
|
||||
+141
@@ -0,0 +1,141 @@
|
||||
/*
|
||||
*
|
||||
* Copyright (c) 2000, 2002, Oracle and/or its affiliates. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or
|
||||
* without modification, are permitted provided that the following
|
||||
* conditions are met:
|
||||
*
|
||||
* -Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* -Redistribution in binary form must reproduct the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in
|
||||
* the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
*
|
||||
* Neither the name of Oracle nor the names of
|
||||
* contributors may be used to endorse or promote products derived
|
||||
* from this software without specific prior written permission.
|
||||
*
|
||||
* This software is provided "AS IS," without a warranty of any
|
||||
* kind. ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND
|
||||
* WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,
|
||||
* FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE HEREBY
|
||||
* EXCLUDED. SUN AND ITS LICENSORS SHALL NOT BE LIABLE FOR ANY
|
||||
* DAMAGES OR LIABILITIES SUFFERED BY LICENSEE AS A RESULT OF OR
|
||||
* RELATING TO USE, MODIFICATION OR DISTRIBUTION OF THE SOFTWARE OR
|
||||
* ITS DERIVATIVES. IN NO EVENT WILL SUN OR ITS LICENSORS BE LIABLE
|
||||
* FOR ANY LOST REVENUE, PROFIT OR DATA, OR FOR DIRECT, INDIRECT,
|
||||
* SPECIAL, CONSEQUENTIAL, INCIDENTAL OR PUNITIVE DAMAGES, HOWEVER
|
||||
* CAUSED AND REGARDLESS OF THE THEORY OF LIABILITY, ARISING OUT OF
|
||||
* THE USE OF OR INABILITY TO USE SOFTWARE, EVEN IF SUN HAS BEEN
|
||||
* ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
|
||||
*
|
||||
* You acknowledge that Software is not designed, licensed or
|
||||
* intended for use in the design, construction, operation or
|
||||
* maintenance of any nuclear facility.
|
||||
*/
|
||||
|
||||
package sample.principal;
|
||||
|
||||
import java.security.Principal;
|
||||
|
||||
/**
|
||||
* <p> This class implements the <code>Principal</code> interface
|
||||
* and represents a Sample user.
|
||||
*
|
||||
* <p> Principals such as this <code>SamplePrincipal</code>
|
||||
* may be associated with a particular <code>Subject</code>
|
||||
* to augment that <code>Subject</code> with an additional
|
||||
* identity. Refer to the <code>Subject</code> class for more information
|
||||
* on how to achieve this. Authorization decisions can then be based upon
|
||||
* the Principals associated with a <code>Subject</code>.
|
||||
*
|
||||
* @see java.security.Principal
|
||||
* @see javax.security.auth.Subject
|
||||
*/
|
||||
public class SamplePrincipal implements Principal, java.io.Serializable {
|
||||
|
||||
/**
|
||||
* @serial
|
||||
*/
|
||||
private String name;
|
||||
|
||||
/**
|
||||
* Create a SamplePrincipal with a Sample username.
|
||||
*
|
||||
* <p>
|
||||
*
|
||||
* @param name the Sample username for this user.
|
||||
*
|
||||
* @exception NullPointerException if the <code>name</code>
|
||||
* is <code>null</code>.
|
||||
*/
|
||||
public SamplePrincipal(String name) {
|
||||
if (name == null)
|
||||
throw new NullPointerException("illegal null input");
|
||||
|
||||
this.name = name;
|
||||
}
|
||||
|
||||
/**
|
||||
* Return the Sample username for this <code>SamplePrincipal</code>.
|
||||
*
|
||||
* <p>
|
||||
*
|
||||
* @return the Sample username for this <code>SamplePrincipal</code>
|
||||
*/
|
||||
public String getName() {
|
||||
return name;
|
||||
}
|
||||
|
||||
/**
|
||||
* Return a string representation of this <code>SamplePrincipal</code>.
|
||||
*
|
||||
* <p>
|
||||
*
|
||||
* @return a string representation of this <code>SamplePrincipal</code>.
|
||||
*/
|
||||
public String toString() {
|
||||
return("SamplePrincipal: " + name);
|
||||
}
|
||||
|
||||
/**
|
||||
* Compares the specified Object with this <code>SamplePrincipal</code>
|
||||
* for equality. Returns true if the given object is also a
|
||||
* <code>SamplePrincipal</code> and the two SamplePrincipals
|
||||
* have the same username.
|
||||
*
|
||||
* <p>
|
||||
*
|
||||
* @param o Object to be compared for equality with this
|
||||
* <code>SamplePrincipal</code>.
|
||||
*
|
||||
* @return true if the specified Object is equal equal to this
|
||||
* <code>SamplePrincipal</code>.
|
||||
*/
|
||||
public boolean equals(Object o) {
|
||||
if (o == null) return false;
|
||||
if (this == o) return true;
|
||||
|
||||
if (!(o instanceof SamplePrincipal))
|
||||
return false;
|
||||
SamplePrincipal that = (SamplePrincipal)o;
|
||||
|
||||
if (this.getName().equals(that.getName()))
|
||||
return true;
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Return a hash code for this <code>SamplePrincipal</code>.
|
||||
*
|
||||
* <p>
|
||||
*
|
||||
* @return a hash code for this <code>SamplePrincipal</code>.
|
||||
*/
|
||||
public int hashCode() {
|
||||
return name.hashCode();
|
||||
}
|
||||
}
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,24 @@
|
||||
/** Java 2 Access Control Policy for the JAAS Sample Application **/
|
||||
|
||||
/* grant the sample LoginModule permissions */
|
||||
grant codebase "file:./SampleLM.jar" {
|
||||
permission javax.security.auth.AuthPermission "modifyPrincipals";
|
||||
};
|
||||
|
||||
grant codebase "file:./SampleAzn.jar" {
|
||||
|
||||
permission javax.security.auth.AuthPermission "createLoginContext.Sample";
|
||||
permission javax.security.auth.AuthPermission "doAsPrivileged";
|
||||
};
|
||||
|
||||
/** User-Based Access Control Policy for the SampleAction class
|
||||
** instantiated by SampleAzn
|
||||
**/
|
||||
|
||||
grant codebase "file:./SampleAction.jar",
|
||||
Principal sample.principal.SamplePrincipal "testUser" {
|
||||
|
||||
permission java.util.PropertyPermission "java.home", "read";
|
||||
permission java.util.PropertyPermission "user.home", "read";
|
||||
permission java.io.FilePermission "foo.txt", "read";
|
||||
};
|
||||
@@ -0,0 +1 @@
|
||||
Coucou c'est moi FOO
|
||||
@@ -0,0 +1,5 @@
|
||||
/** Login Configuration for the JAAS Sample Application **/
|
||||
|
||||
Sample {
|
||||
sample.module.SampleLoginModule required debug=true;
|
||||
};
|
||||
@@ -0,0 +1,31 @@
|
||||
# Reset
|
||||
rm \
|
||||
./SampleAcn.jar \
|
||||
./SampleAction.jar \
|
||||
./SampleLM.jar
|
||||
|
||||
# Compile
|
||||
javac \
|
||||
sample/SampleAction.java \
|
||||
sample/SampleAzn.java \
|
||||
sample/module/SampleLoginModule.java \
|
||||
sample/principal/SamplePrincipal.java
|
||||
|
||||
# Créé les JAR SampleAzn, SampleAction, SampleLM
|
||||
jar -cvf SampleAzn.jar sample/SampleAzn.class sample/MyCallbackHandler.class
|
||||
jar -cvf SampleAction.jar sample/SampleAction.class
|
||||
jar -cvf SampleLM.jar sample/module/SampleLoginModule.class sample/principal/SamplePrincipal.class
|
||||
|
||||
# Enlève les artéfacts
|
||||
rm \
|
||||
./sample/SampleAction.class \
|
||||
./sample/SampleAzn.class \
|
||||
./sample/MyCallbackHandler.class \
|
||||
./sample/module/SampleLoginModule.class \
|
||||
./sample/principal/SamplePrincipal.class
|
||||
|
||||
# Executer
|
||||
java -classpath SampleAzn.jar:SampleAction.jar:SampleLM.jar \
|
||||
-Djava.security.manager \
|
||||
-Djava.security.policy==azn.policy \
|
||||
-Djava.security.auth.login.config==jaas.config sample.SampleAzn
|
||||
@@ -0,0 +1,75 @@
|
||||
/*
|
||||
*
|
||||
* Copyright (c) 2000, 2002, Oracle and/or its affiliates. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or
|
||||
* without modification, are permitted provided that the following
|
||||
* conditions are met:
|
||||
*
|
||||
* -Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* -Redistribution in binary form must reproduct the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in
|
||||
* the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
*
|
||||
* Neither the name of Oracle nor the names of
|
||||
* contributors may be used to endorse or promote products derived
|
||||
* from this software without specific prior written permission.
|
||||
*
|
||||
* This software is provided "AS IS," without a warranty of any
|
||||
* kind. ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND
|
||||
* WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,
|
||||
* FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE HEREBY
|
||||
* EXCLUDED. SUN AND ITS LICENSORS SHALL NOT BE LIABLE FOR ANY
|
||||
* DAMAGES OR LIABILITIES SUFFERED BY LICENSEE AS A RESULT OF OR
|
||||
* RELATING TO USE, MODIFICATION OR DISTRIBUTION OF THE SOFTWARE OR
|
||||
* ITS DERIVATIVES. IN NO EVENT WILL SUN OR ITS LICENSORS BE LIABLE
|
||||
* FOR ANY LOST REVENUE, PROFIT OR DATA, OR FOR DIRECT, INDIRECT,
|
||||
* SPECIAL, CONSEQUENTIAL, INCIDENTAL OR PUNITIVE DAMAGES, HOWEVER
|
||||
* CAUSED AND REGARDLESS OF THE THEORY OF LIABILITY, ARISING OUT OF
|
||||
* THE USE OF OR INABILITY TO USE SOFTWARE, EVEN IF SUN HAS BEEN
|
||||
* ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
|
||||
*
|
||||
* You acknowledge that Software is not designed, licensed or
|
||||
* intended for use in the design, construction, operation or
|
||||
* maintenance of any nuclear facility.
|
||||
*/
|
||||
|
||||
package sample;
|
||||
|
||||
import java.io.File;
|
||||
import java.security.PrivilegedAction;
|
||||
|
||||
/**
|
||||
* <p> This is a Sample PrivilegedAction implementation, designed to be
|
||||
* used with the Sample application.
|
||||
*
|
||||
*/
|
||||
public class SampleAction implements PrivilegedAction {
|
||||
|
||||
/**
|
||||
* <p> This Sample PrivilegedAction performs the following operations:
|
||||
* <ul>
|
||||
* <li> Access the System property, <i>java.home</i>
|
||||
* <li> Access the System property, <i>user.home</i>
|
||||
* <li> Access the file, <i>foo.txt</i>
|
||||
* </ul>
|
||||
*
|
||||
* @return <code>null</code> in all cases.
|
||||
*
|
||||
* @exception SecurityException if the caller does not have permission
|
||||
* to perform the operations listed above.
|
||||
*/
|
||||
public Object run() {
|
||||
System.out.println("java.home : " + System.getProperty("java.home"));
|
||||
System.out.println("user.home : " + System.getProperty("user.home"));
|
||||
|
||||
File f = new File("foo.txt");
|
||||
System.out.print("foo.txt does ");
|
||||
if (!f.exists()) System.out.print("not ");
|
||||
System.out.println("exist in the current working directory.");
|
||||
return null;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,265 @@
|
||||
/*
|
||||
*
|
||||
* Copyright (c) 2001, 2002, Oracle and/or its affiliates. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or
|
||||
* without modification, are permitted provided that the following
|
||||
* conditions are met:
|
||||
*
|
||||
* -Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* -Redistribution in binary form must reproduct the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in
|
||||
* the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
*
|
||||
* Neither the name of Oracle nor the names of
|
||||
* contributors may be used to endorse or promote products derived
|
||||
* from this software without specific prior written permission.
|
||||
*
|
||||
* This software is provided "AS IS," without a warranty of any
|
||||
* kind. ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND
|
||||
* WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,
|
||||
* FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE HEREBY
|
||||
* EXCLUDED. SUN AND ITS LICENSORS SHALL NOT BE LIABLE FOR ANY
|
||||
* DAMAGES OR LIABILITIES SUFFERED BY LICENSEE AS A RESULT OF OR
|
||||
* RELATING TO USE, MODIFICATION OR DISTRIBUTION OF THE SOFTWARE OR
|
||||
* ITS DERIVATIVES. IN NO EVENT WILL SUN OR ITS LICENSORS BE LIABLE
|
||||
* FOR ANY LOST REVENUE, PROFIT OR DATA, OR FOR DIRECT, INDIRECT,
|
||||
* SPECIAL, CONSEQUENTIAL, INCIDENTAL OR PUNITIVE DAMAGES, HOWEVER
|
||||
* CAUSED AND REGARDLESS OF THE THEORY OF LIABILITY, ARISING OUT OF
|
||||
* THE USE OF OR INABILITY TO USE SOFTWARE, EVEN IF SUN HAS BEEN
|
||||
* ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
|
||||
*
|
||||
* You acknowledge that Software is not designed, licensed or
|
||||
* intended for use in the design, construction, operation or
|
||||
* maintenance of any nuclear facility.
|
||||
*/
|
||||
|
||||
package sample;
|
||||
|
||||
import java.io.*;
|
||||
import java.util.*;
|
||||
import java.security.Principal;
|
||||
import java.security.PrivilegedAction;
|
||||
import javax.security.auth.*;
|
||||
import javax.security.auth.callback.*;
|
||||
import javax.security.auth.login.*;
|
||||
import javax.security.auth.spi.*;
|
||||
import com.sun.security.auth.*;
|
||||
|
||||
/**
|
||||
* <p> This Sample application attempts to authenticate a user
|
||||
* and executes a SampleAction as that user.
|
||||
*
|
||||
* <p> If the user successfully authenticates itself,
|
||||
* the username and number of Credentials is displayed.
|
||||
*/
|
||||
public class SampleAzn {
|
||||
|
||||
/**
|
||||
* Attempt to authenticate the user.
|
||||
*
|
||||
* <p>
|
||||
*
|
||||
* @param args input arguments for this application. These are ignored.
|
||||
*/
|
||||
public static void main(String[] args) {
|
||||
|
||||
// Obtain a LoginContext, needed for authentication. Tell it
|
||||
// to use the LoginModule implementation specified by the
|
||||
// entry named "Sample" in the JAAS login configuration
|
||||
// file and to also use the specified CallbackHandler.
|
||||
LoginContext lc = null;
|
||||
try {
|
||||
lc = new LoginContext("Sample", new MyCallbackHandler());
|
||||
} catch (LoginException le) {
|
||||
System.err.println("Cannot create LoginContext. "
|
||||
+ le.getMessage());
|
||||
System.exit(-1);
|
||||
} catch (SecurityException se) {
|
||||
System.err.println("Cannot create LoginContext. "
|
||||
+ se.getMessage());
|
||||
System.exit(-1);
|
||||
}
|
||||
|
||||
// the user has 3 attempts to authenticate successfully
|
||||
int i;
|
||||
for (i = 0; i < 3; i++) {
|
||||
try {
|
||||
|
||||
// attempt authentication
|
||||
lc.login();
|
||||
|
||||
// if we return with no exception, authentication succeeded
|
||||
break;
|
||||
|
||||
} catch (LoginException le) {
|
||||
|
||||
System.err.println("Authentication failed:");
|
||||
System.err.println(" " + le.getMessage());
|
||||
try {
|
||||
Thread.currentThread().sleep(3000);
|
||||
} catch (Exception e) {
|
||||
// ignore
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
// did they fail three times?
|
||||
if (i == 3) {
|
||||
System.out.println("Sorry");
|
||||
System.exit(-1);
|
||||
}
|
||||
|
||||
System.out.println("Authentication succeeded!");
|
||||
|
||||
Subject mySubject = lc.getSubject();
|
||||
|
||||
// let's see what Principals we have
|
||||
Iterator principalIterator = mySubject.getPrincipals().iterator();
|
||||
System.out.println("Authenticated user has the following Principals:");
|
||||
while (principalIterator.hasNext()) {
|
||||
Principal p = (Principal)principalIterator.next();
|
||||
System.out.println("\t" + p.toString());
|
||||
}
|
||||
|
||||
System.out.println("User has " +
|
||||
mySubject.getPublicCredentials().size() +
|
||||
" Public Credential(s)");
|
||||
|
||||
// now try to execute the SampleAction as the authenticated Subject
|
||||
PrivilegedAction action = new SampleAction();
|
||||
Subject.doAsPrivileged(mySubject, action, null);
|
||||
|
||||
System.exit(0);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A CallbackHandler implemented by the application.
|
||||
*
|
||||
* <p> This application is text-based. Therefore it displays information
|
||||
* to the user using the OutputStreams System.out and System.err,
|
||||
* and gathers input from the user using the InputStream System.in.
|
||||
*/
|
||||
class MyCallbackHandler implements CallbackHandler {
|
||||
|
||||
/**
|
||||
* Invoke an array of Callbacks.
|
||||
*
|
||||
* <p>
|
||||
*
|
||||
* @param callbacks an array of <code>Callback</code> objects which contain
|
||||
* the information requested by an underlying security
|
||||
* service to be retrieved or displayed.
|
||||
*
|
||||
* @exception java.io.IOException if an input or output error occurs. <p>
|
||||
*
|
||||
* @exception UnsupportedCallbackException if the implementation of this
|
||||
* method does not support one or more of the Callbacks
|
||||
* specified in the <code>callbacks</code> parameter.
|
||||
*/
|
||||
public void handle(Callback[] callbacks)
|
||||
throws IOException, UnsupportedCallbackException {
|
||||
|
||||
for (int i = 0; i < callbacks.length; i++) {
|
||||
if (callbacks[i] instanceof TextOutputCallback) {
|
||||
|
||||
// display the message according to the specified type
|
||||
TextOutputCallback toc = (TextOutputCallback)callbacks[i];
|
||||
switch (toc.getMessageType()) {
|
||||
case TextOutputCallback.INFORMATION:
|
||||
System.out.println(toc.getMessage());
|
||||
break;
|
||||
case TextOutputCallback.ERROR:
|
||||
System.out.println("ERROR: " + toc.getMessage());
|
||||
break;
|
||||
case TextOutputCallback.WARNING:
|
||||
System.out.println("WARNING: " + toc.getMessage());
|
||||
break;
|
||||
default:
|
||||
throw new IOException("Unsupported message type: " +
|
||||
toc.getMessageType());
|
||||
}
|
||||
|
||||
} else if (callbacks[i] instanceof NameCallback) {
|
||||
|
||||
// prompt the user for a username
|
||||
NameCallback nc = (NameCallback)callbacks[i];
|
||||
|
||||
System.err.print(nc.getPrompt());
|
||||
System.err.flush();
|
||||
nc.setName((new BufferedReader
|
||||
(new InputStreamReader(System.in))).readLine());
|
||||
|
||||
} else if (callbacks[i] instanceof PasswordCallback) {
|
||||
|
||||
// prompt the user for sensitive information
|
||||
PasswordCallback pc = (PasswordCallback)callbacks[i];
|
||||
System.err.print(pc.getPrompt());
|
||||
System.err.flush();
|
||||
pc.setPassword(readPassword(System.in));
|
||||
|
||||
} else {
|
||||
throw new UnsupportedCallbackException
|
||||
(callbacks[i], "Unrecognized Callback");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Reads user password from given input stream.
|
||||
private char[] readPassword(InputStream in) throws IOException {
|
||||
|
||||
char[] lineBuffer;
|
||||
char[] buf;
|
||||
int i;
|
||||
|
||||
buf = lineBuffer = new char[128];
|
||||
|
||||
int room = buf.length;
|
||||
int offset = 0;
|
||||
int c;
|
||||
|
||||
loop: while (true) {
|
||||
switch (c = in.read()) {
|
||||
case -1:
|
||||
case '\n':
|
||||
break loop;
|
||||
|
||||
case '\r':
|
||||
int c2 = in.read();
|
||||
if ((c2 != '\n') && (c2 != -1)) {
|
||||
if (!(in instanceof PushbackInputStream)) {
|
||||
in = new PushbackInputStream(in);
|
||||
}
|
||||
((PushbackInputStream)in).unread(c2);
|
||||
} else
|
||||
break loop;
|
||||
|
||||
default:
|
||||
if (--room < 0) {
|
||||
buf = new char[offset + 128];
|
||||
room = buf.length - offset - 1;
|
||||
System.arraycopy(lineBuffer, 0, buf, 0, offset);
|
||||
Arrays.fill(lineBuffer, ' ');
|
||||
lineBuffer = buf;
|
||||
}
|
||||
buf[offset++] = (char) c;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
if (offset == 0) {
|
||||
return null;
|
||||
}
|
||||
|
||||
char[] ret = new char[offset];
|
||||
System.arraycopy(buf, 0, ret, 0, offset);
|
||||
Arrays.fill(buf, ' ');
|
||||
|
||||
return ret;
|
||||
}
|
||||
}
|
||||
+337
@@ -0,0 +1,337 @@
|
||||
/*
|
||||
*
|
||||
* Copyright (c) 2000, 2002, Oracle and/or its affiliates. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or
|
||||
* without modification, are permitted provided that the following
|
||||
* conditions are met:
|
||||
*
|
||||
* -Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* -Redistribution in binary form must reproduct the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in
|
||||
* the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
*
|
||||
* Neither the name of Oracle nor the names of
|
||||
* contributors may be used to endorse or promote products derived
|
||||
* from this software without specific prior written permission.
|
||||
*
|
||||
* This software is provided "AS IS," without a warranty of any
|
||||
* kind. ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND
|
||||
* WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,
|
||||
* FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE HEREBY
|
||||
* EXCLUDED. SUN AND ITS LICENSORS SHALL NOT BE LIABLE FOR ANY
|
||||
* DAMAGES OR LIABILITIES SUFFERED BY LICENSEE AS A RESULT OF OR
|
||||
* RELATING TO USE, MODIFICATION OR DISTRIBUTION OF THE SOFTWARE OR
|
||||
* ITS DERIVATIVES. IN NO EVENT WILL SUN OR ITS LICENSORS BE LIABLE
|
||||
* FOR ANY LOST REVENUE, PROFIT OR DATA, OR FOR DIRECT, INDIRECT,
|
||||
* SPECIAL, CONSEQUENTIAL, INCIDENTAL OR PUNITIVE DAMAGES, HOWEVER
|
||||
* CAUSED AND REGARDLESS OF THE THEORY OF LIABILITY, ARISING OUT OF
|
||||
* THE USE OF OR INABILITY TO USE SOFTWARE, EVEN IF SUN HAS BEEN
|
||||
* ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
|
||||
*
|
||||
* You acknowledge that Software is not designed, licensed or
|
||||
* intended for use in the design, construction, operation or
|
||||
* maintenance of any nuclear facility.
|
||||
*/
|
||||
|
||||
package sample.module;
|
||||
|
||||
import java.util.*;
|
||||
import java.io.IOException;
|
||||
import javax.security.auth.*;
|
||||
import javax.security.auth.callback.*;
|
||||
import javax.security.auth.login.*;
|
||||
import javax.security.auth.spi.*;
|
||||
import sample.principal.SamplePrincipal;
|
||||
|
||||
/**
|
||||
* <p> This sample LoginModule authenticates users with a password.
|
||||
*
|
||||
* <p> This LoginModule only recognizes one user: testUser
|
||||
* <p> testUser's password is: testPassword
|
||||
*
|
||||
* <p> If testUser successfully authenticates itself,
|
||||
* a <code>SamplePrincipal</code> with the testUser's user name
|
||||
* is added to the Subject.
|
||||
*
|
||||
* <p> This LoginModule recognizes the debug option.
|
||||
* If set to true in the login Configuration,
|
||||
* debug messages will be output to the output stream, System.out.
|
||||
*
|
||||
*/
|
||||
public class SampleLoginModule implements LoginModule {
|
||||
|
||||
// initial state
|
||||
private Subject subject;
|
||||
private CallbackHandler callbackHandler;
|
||||
private Map sharedState;
|
||||
private Map options;
|
||||
|
||||
// configurable option
|
||||
private boolean debug = false;
|
||||
|
||||
// the authentication status
|
||||
private boolean succeeded = false;
|
||||
private boolean commitSucceeded = false;
|
||||
|
||||
// username and password
|
||||
private String username;
|
||||
private char[] password;
|
||||
|
||||
// testUser's SamplePrincipal
|
||||
private SamplePrincipal userPrincipal;
|
||||
|
||||
/**
|
||||
* Initialize this <code>LoginModule</code>.
|
||||
*
|
||||
* <p>
|
||||
*
|
||||
* @param subject the <code>Subject</code> to be authenticated. <p>
|
||||
*
|
||||
* @param callbackHandler a <code>CallbackHandler</code> for communicating
|
||||
* with the end user (prompting for user names and
|
||||
* passwords, for example). <p>
|
||||
*
|
||||
* @param sharedState shared <code>LoginModule</code> state. <p>
|
||||
*
|
||||
* @param options options specified in the login
|
||||
* <code>Configuration</code> for this particular
|
||||
* <code>LoginModule</code>.
|
||||
*/
|
||||
public void initialize(Subject subject,
|
||||
CallbackHandler callbackHandler,
|
||||
Map<java.lang.String, ?> sharedState,
|
||||
Map<java.lang.String, ?> options) {
|
||||
|
||||
this.subject = subject;
|
||||
this.callbackHandler = callbackHandler;
|
||||
this.sharedState = sharedState;
|
||||
this.options = options;
|
||||
|
||||
// initialize any configured options
|
||||
debug = "true".equalsIgnoreCase((String)options.get("debug"));
|
||||
}
|
||||
|
||||
/**
|
||||
* Authenticate the user by prompting for a user name and password.
|
||||
*
|
||||
* <p>
|
||||
*
|
||||
* @return true in all cases since this <code>LoginModule</code>
|
||||
* should not be ignored.
|
||||
*
|
||||
* @exception FailedLoginException if the authentication fails. <p>
|
||||
*
|
||||
* @exception LoginException if this <code>LoginModule</code>
|
||||
* is unable to perform the authentication.
|
||||
*/
|
||||
public boolean login() throws LoginException {
|
||||
|
||||
// prompt for a user name and password
|
||||
if (callbackHandler == null)
|
||||
throw new LoginException("Error: no CallbackHandler available " +
|
||||
"to garner authentication information from the user");
|
||||
|
||||
Callback[] callbacks = new Callback[2];
|
||||
callbacks[0] = new NameCallback("user name: ");
|
||||
callbacks[1] = new PasswordCallback("password: ", false);
|
||||
|
||||
try {
|
||||
callbackHandler.handle(callbacks);
|
||||
username = ((NameCallback)callbacks[0]).getName();
|
||||
char[] tmpPassword = ((PasswordCallback)callbacks[1]).getPassword();
|
||||
if (tmpPassword == null) {
|
||||
// treat a NULL password as an empty password
|
||||
tmpPassword = new char[0];
|
||||
}
|
||||
password = new char[tmpPassword.length];
|
||||
System.arraycopy(tmpPassword, 0,
|
||||
password, 0, tmpPassword.length);
|
||||
((PasswordCallback)callbacks[1]).clearPassword();
|
||||
|
||||
} catch (java.io.IOException ioe) {
|
||||
throw new LoginException(ioe.toString());
|
||||
} catch (UnsupportedCallbackException uce) {
|
||||
throw new LoginException("Error: " + uce.getCallback().toString() +
|
||||
" not available to garner authentication information " +
|
||||
"from the user");
|
||||
}
|
||||
|
||||
// print debugging information
|
||||
if (debug) {
|
||||
System.out.println("\t\t[SampleLoginModule] " +
|
||||
"user entered user name: " +
|
||||
username);
|
||||
System.out.print("\t\t[SampleLoginModule] " +
|
||||
"user entered password: ");
|
||||
for (int i = 0; i < password.length; i++)
|
||||
System.out.print(password[i]);
|
||||
System.out.println();
|
||||
}
|
||||
|
||||
// verify the username/password
|
||||
boolean usernameCorrect = false;
|
||||
boolean passwordCorrect = false;
|
||||
if (username.equals("testUser"))
|
||||
usernameCorrect = true;
|
||||
if (usernameCorrect &&
|
||||
password.length == 12 &&
|
||||
password[0] == 't' &&
|
||||
password[1] == 'e' &&
|
||||
password[2] == 's' &&
|
||||
password[3] == 't' &&
|
||||
password[4] == 'P' &&
|
||||
password[5] == 'a' &&
|
||||
password[6] == 's' &&
|
||||
password[7] == 's' &&
|
||||
password[8] == 'w' &&
|
||||
password[9] == 'o' &&
|
||||
password[10] == 'r' &&
|
||||
password[11] == 'd') {
|
||||
|
||||
// authentication succeeded!!!
|
||||
passwordCorrect = true;
|
||||
if (debug)
|
||||
System.out.println("\t\t[SampleLoginModule] " +
|
||||
"authentication succeeded");
|
||||
succeeded = true;
|
||||
return true;
|
||||
} else {
|
||||
|
||||
// authentication failed -- clean out state
|
||||
if (debug)
|
||||
System.out.println("\t\t[SampleLoginModule] " +
|
||||
"authentication failed");
|
||||
succeeded = false;
|
||||
username = null;
|
||||
for (int i = 0; i < password.length; i++)
|
||||
password[i] = ' ';
|
||||
password = null;
|
||||
if (!usernameCorrect) {
|
||||
throw new FailedLoginException("User Name Incorrect");
|
||||
} else {
|
||||
throw new FailedLoginException("Password Incorrect");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* <p> This method is called if the LoginContext's
|
||||
* overall authentication succeeded
|
||||
* (the relevant REQUIRED, REQUISITE, SUFFICIENT and OPTIONAL LoginModules
|
||||
* succeeded).
|
||||
*
|
||||
* <p> If this LoginModule's own authentication attempt
|
||||
* succeeded (checked by retrieving the private state saved by the
|
||||
* <code>login</code> method), then this method associates a
|
||||
* <code>SamplePrincipal</code>
|
||||
* with the <code>Subject</code> located in the
|
||||
* <code>LoginModule</code>. If this LoginModule's own
|
||||
* authentication attempted failed, then this method removes
|
||||
* any state that was originally saved.
|
||||
*
|
||||
* <p>
|
||||
*
|
||||
* @exception LoginException if the commit fails.
|
||||
*
|
||||
* @return true if this LoginModule's own login and commit
|
||||
* attempts succeeded, or false otherwise.
|
||||
*/
|
||||
public boolean commit() throws LoginException {
|
||||
if (succeeded == false) {
|
||||
return false;
|
||||
} else {
|
||||
// add a Principal (authenticated identity)
|
||||
// to the Subject
|
||||
|
||||
// assume the user we authenticated is the SamplePrincipal
|
||||
userPrincipal = new SamplePrincipal(username);
|
||||
if (!subject.getPrincipals().contains(userPrincipal))
|
||||
subject.getPrincipals().add(userPrincipal);
|
||||
|
||||
if (debug) {
|
||||
System.out.println("\t\t[SampleLoginModule] " +
|
||||
"added SamplePrincipal to Subject");
|
||||
}
|
||||
|
||||
// in any case, clean out state
|
||||
username = null;
|
||||
for (int i = 0; i < password.length; i++)
|
||||
password[i] = ' ';
|
||||
password = null;
|
||||
|
||||
commitSucceeded = true;
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* <p> This method is called if the LoginContext's
|
||||
* overall authentication failed.
|
||||
* (the relevant REQUIRED, REQUISITE, SUFFICIENT and OPTIONAL LoginModules
|
||||
* did not succeed).
|
||||
*
|
||||
* <p> If this LoginModule's own authentication attempt
|
||||
* succeeded (checked by retrieving the private state saved by the
|
||||
* <code>login</code> and <code>commit</code> methods),
|
||||
* then this method cleans up any state that was originally saved.
|
||||
*
|
||||
* <p>
|
||||
*
|
||||
* @exception LoginException if the abort fails.
|
||||
*
|
||||
* @return false if this LoginModule's own login and/or commit attempts
|
||||
* failed, and true otherwise.
|
||||
*/
|
||||
public boolean abort() throws LoginException {
|
||||
if (succeeded == false) {
|
||||
return false;
|
||||
} else if (succeeded == true && commitSucceeded == false) {
|
||||
// login succeeded but overall authentication failed
|
||||
succeeded = false;
|
||||
username = null;
|
||||
if (password != null) {
|
||||
for (int i = 0; i < password.length; i++)
|
||||
password[i] = ' ';
|
||||
password = null;
|
||||
}
|
||||
userPrincipal = null;
|
||||
} else {
|
||||
// overall authentication succeeded and commit succeeded,
|
||||
// but someone else's commit failed
|
||||
logout();
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Logout the user.
|
||||
*
|
||||
* <p> This method removes the <code>SamplePrincipal</code>
|
||||
* that was added by the <code>commit</code> method.
|
||||
*
|
||||
* <p>
|
||||
*
|
||||
* @exception LoginException if the logout fails.
|
||||
*
|
||||
* @return true in all cases since this <code>LoginModule</code>
|
||||
* should not be ignored.
|
||||
*/
|
||||
public boolean logout() throws LoginException {
|
||||
|
||||
subject.getPrincipals().remove(userPrincipal);
|
||||
succeeded = false;
|
||||
succeeded = commitSucceeded;
|
||||
username = null;
|
||||
if (password != null) {
|
||||
for (int i = 0; i < password.length; i++)
|
||||
password[i] = ' ';
|
||||
password = null;
|
||||
}
|
||||
userPrincipal = null;
|
||||
return true;
|
||||
}
|
||||
}
|
||||
+144
@@ -0,0 +1,144 @@
|
||||
/*
|
||||
*
|
||||
* Copyright (c) 2000, 2002, Oracle and/or its affiliates. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or
|
||||
* without modification, are permitted provided that the following
|
||||
* conditions are met:
|
||||
*
|
||||
* -Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* -Redistribution in binary form must reproduct the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in
|
||||
* the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
*
|
||||
* Neither the name of Oracle nor the names of
|
||||
* contributors may be used to endorse or promote products derived
|
||||
* from this software without specific prior written permission.
|
||||
*
|
||||
* This software is provided "AS IS," without a warranty of any
|
||||
* kind. ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND
|
||||
* WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,
|
||||
* FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE HEREBY
|
||||
* EXCLUDED. SUN AND ITS LICENSORS SHALL NOT BE LIABLE FOR ANY
|
||||
* DAMAGES OR LIABILITIES SUFFERED BY LICENSEE AS A RESULT OF OR
|
||||
* RELATING TO USE, MODIFICATION OR DISTRIBUTION OF THE SOFTWARE OR
|
||||
* ITS DERIVATIVES. IN NO EVENT WILL SUN OR ITS LICENSORS BE LIABLE
|
||||
* FOR ANY LOST REVENUE, PROFIT OR DATA, OR FOR DIRECT, INDIRECT,
|
||||
* SPECIAL, CONSEQUENTIAL, INCIDENTAL OR PUNITIVE DAMAGES, HOWEVER
|
||||
* CAUSED AND REGARDLESS OF THE THEORY OF LIABILITY, ARISING OUT OF
|
||||
* THE USE OF OR INABILITY TO USE SOFTWARE, EVEN IF SUN HAS BEEN
|
||||
* ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
|
||||
*
|
||||
* You acknowledge that Software is not designed, licensed or
|
||||
* intended for use in the design, construction, operation or
|
||||
* maintenance of any nuclear facility.
|
||||
*/
|
||||
|
||||
package sample.principal;
|
||||
|
||||
import java.security.Principal;
|
||||
|
||||
/**
|
||||
* <p> This class implements the <code>Principal</code> interface
|
||||
* and represents a Sample user.
|
||||
*
|
||||
* <p> Principals such as this <code>SamplePrincipal</code>
|
||||
* may be associated with a particular <code>Subject</code>
|
||||
* to augment that <code>Subject</code> with an additional
|
||||
* identity. Refer to the <code>Subject</code> class for more information
|
||||
* on how to achieve this. Authorization decisions can then be based upon
|
||||
* the Principals associated with a <code>Subject</code>.
|
||||
*
|
||||
* @see java.security.Principal
|
||||
* @see javax.security.auth.Subject
|
||||
*/
|
||||
public class SamplePrincipal implements Principal, java.io.Serializable {
|
||||
|
||||
/**
|
||||
* @serial
|
||||
*/
|
||||
private String name;
|
||||
|
||||
/**
|
||||
* Create a SamplePrincipal with a Sample username.
|
||||
*
|
||||
* <p>
|
||||
*
|
||||
* @param name the Sample username for this user.
|
||||
*
|
||||
* @exception NullPointerException if the <code>name</code>
|
||||
* is <code>null</code>.
|
||||
*/
|
||||
public SamplePrincipal(String name) {
|
||||
if (name == null)
|
||||
throw new NullPointerException("illegal null input");
|
||||
|
||||
this.name = name;
|
||||
}
|
||||
|
||||
/**
|
||||
* Return the Sample username for this <code>SamplePrincipal</code>.
|
||||
*
|
||||
* <p>
|
||||
*
|
||||
* @return the Sample username for this <code>SamplePrincipal</code>
|
||||
*/
|
||||
public String getName() {
|
||||
return name;
|
||||
}
|
||||
|
||||
/**
|
||||
* Return a string representation of this <code>SamplePrincipal</code>.
|
||||
*
|
||||
* <p>
|
||||
*
|
||||
* @return a string representation of this <code>SamplePrincipal</code>.
|
||||
*/
|
||||
public String toString() {
|
||||
return("SamplePrincipal: " + name);
|
||||
}
|
||||
|
||||
/**
|
||||
* Compares the specified Object with this <code>SamplePrincipal</code>
|
||||
* for equality. Returns true if the given object is also a
|
||||
* <code>SamplePrincipal</code> and the two SamplePrincipals
|
||||
* have the same username.
|
||||
*
|
||||
* <p>
|
||||
*
|
||||
* @param o Object to be compared for equality with this
|
||||
* <code>SamplePrincipal</code>.
|
||||
*
|
||||
* @return true if the specified Object is equal equal to this
|
||||
* <code>SamplePrincipal</code>.
|
||||
*/
|
||||
public boolean equals(Object o) {
|
||||
if (o == null)
|
||||
return false;
|
||||
|
||||
if (this == o)
|
||||
return true;
|
||||
|
||||
if (!(o instanceof SamplePrincipal))
|
||||
return false;
|
||||
SamplePrincipal that = (SamplePrincipal)o;
|
||||
|
||||
if (this.getName().equals(that.getName()))
|
||||
return true;
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Return a hash code for this <code>SamplePrincipal</code>.
|
||||
*
|
||||
* <p>
|
||||
*
|
||||
* @return a hash code for this <code>SamplePrincipal</code>.
|
||||
*/
|
||||
public int hashCode() {
|
||||
return name.hashCode();
|
||||
}
|
||||
}
|
||||
+112
@@ -0,0 +1,112 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Reset
|
||||
rm -rf ./CA
|
||||
rm ./client/certificat_request.csr \
|
||||
./client/certificat_signed.cer \
|
||||
./client/certificat.cer \
|
||||
./client/keystore.jks \
|
||||
./client/Source_Signed.jar
|
||||
|
||||
##########################################
|
||||
|
||||
# Création des dossiers CA et client s'ils n'existent pas déjà
|
||||
mkdir -p CA client
|
||||
|
||||
# Génération de la clé privée de la CA
|
||||
openssl genrsa -out CA/ca.key 2048
|
||||
echo "[CA] - génération de la clé privée : OK"
|
||||
|
||||
# Génération du certificat auto-signé de la CA
|
||||
openssl req -x509 -new -nodes \
|
||||
-key CA/ca.key -sha256 -days 365 \
|
||||
-out CA/ca.crt \
|
||||
-subj "/CN=SimulatedCA/O=MyCA/C=FR"
|
||||
echo "[CA] - génération du certificat auto-signé : OK"
|
||||
|
||||
# Génération du keystore du client
|
||||
keytool -genkeypair \
|
||||
-alias KeyAlias \
|
||||
-keyalg RSA \
|
||||
-keysize 2048 \
|
||||
-keystore client/keystore.jks \
|
||||
-validity 365 \
|
||||
-dname "CN=ClientName, OU=ClientUnit, O=ClientOrg, L=ClientCity, S=ClientState, C=FR" \
|
||||
-storepass changeit \
|
||||
-keypass changeit
|
||||
echo "[Client] - Génération du keystore : OK"
|
||||
|
||||
# Génération de la demande de certificat (CSR) pour le client
|
||||
keytool -certreq \
|
||||
-alias KeyAlias \
|
||||
-keystore client/keystore.jks \
|
||||
-file client/certificat_request.csr \
|
||||
-storepass changeit
|
||||
echo "[Client] - Génération de la demande de certification : OK"
|
||||
|
||||
# La CA signe la demande de certificat du client
|
||||
openssl x509 -req \
|
||||
-in client/certificat_request.csr \
|
||||
-CA CA/ca.crt -CAkey CA/ca.key -CAcreateserial \
|
||||
-out client/certificat_signed.cer -days 365 -sha256
|
||||
echo "[CA] - Signature de la demande de certificat : OK"
|
||||
|
||||
# Importation du certificat de la CA dans le keystore du client
|
||||
keytool -import \
|
||||
-trustcacerts \
|
||||
-alias SimulatedCA \
|
||||
-file CA/ca.crt \
|
||||
-keystore client/keystore.jks \
|
||||
-noprompt \
|
||||
-storepass changeit
|
||||
echo "[Client] - Import du certificat du CA : OK"
|
||||
|
||||
# Importation du certificat signé dans le keystore du client
|
||||
keytool -import \
|
||||
-alias KeyAlias \
|
||||
-keystore client/keystore.jks \
|
||||
-file client/certificat_signed.cer \
|
||||
-noprompt \
|
||||
-storepass changeit
|
||||
echo "[Client] - Import du certificat signé : OK"
|
||||
|
||||
# Exportation du certificat signé pour distribution
|
||||
keytool -export \
|
||||
-alias KeyAlias \
|
||||
-keystore client/keystore.jks \
|
||||
-file client/certificat.cer \
|
||||
-storepass changeit
|
||||
echo "[Client] - Export du certificat signé : OK"
|
||||
|
||||
##########################################
|
||||
|
||||
cd ./client/
|
||||
|
||||
# Compile notre fichier java
|
||||
javac ./Source.java
|
||||
echo "[Client] - Compilation du .java : OK"
|
||||
|
||||
# Créer un fichier MANIFEST.MF avec l'attribut Main-Class
|
||||
echo "Main-Class: Source" > ./MANIFEST.MF
|
||||
|
||||
# Créé le fichier Jar non signé
|
||||
jar cmf ./MANIFEST.MF ./Source.jar ./Source.class
|
||||
echo "[Client] - Creation du fichier .jar : OK"
|
||||
|
||||
# Convertis en fichier jar signé
|
||||
jarsigner -keystore ./keystore.jks \
|
||||
-storepass changeit \
|
||||
-signedjar ./Source_Signed.jar ./Source.jar KeyAlias
|
||||
echo "[Client] - Creation du fichier .jar signé : OK"
|
||||
|
||||
# Supprime les artéfacts
|
||||
rm ./Source.class ./Source.jar ./MANIFEST.MF
|
||||
|
||||
# On peut vérifier que notre certificat est bien valide
|
||||
jarsigner -verify ./Source_Signed.jar
|
||||
echo "[Client] - Vérification du certificat : OK"
|
||||
|
||||
cd ..
|
||||
|
||||
# Executer le jar signé
|
||||
java -jar ./client/Source_Signed.jar
|
||||
@@ -0,0 +1,29 @@
|
||||
# Reset
|
||||
rm ./keystore.jks ./Source_Signed.jar
|
||||
|
||||
# Génère un keystore
|
||||
keytool -genkeypair \
|
||||
-alias SourceKeyAlias \
|
||||
-keyalg RSA \
|
||||
-keysize 2048 \
|
||||
-keystore keystore.jks \
|
||||
-validity 365
|
||||
|
||||
# Compilation
|
||||
javac ./Source.java
|
||||
|
||||
# Créer un fichier MANIFEST.MF avec l'attribut Main-Class
|
||||
echo "Main-Class: Source" > MANIFEST.MF
|
||||
|
||||
# Crée le fichier JAR non signé avec le MANIFEST.MF modifié
|
||||
jar cmf MANIFEST.MF Source.jar Source.class
|
||||
|
||||
# Convertir en fichier JAR signé
|
||||
jarsigner -keystore keystore.jks \
|
||||
-signedjar Source_Signed.jar Source.jar SourceKeyAlias
|
||||
|
||||
# Supprime les artéfacts
|
||||
rm ./Source.class ./Source.jar MANIFEST.MF
|
||||
|
||||
# Essaye d'exécuter ton fichier JAR signé
|
||||
java -jar Source_Signed.jar
|
||||
Reference in New Issue
Block a user