Difference between revisions of "Stardust/Knowledge Base/Security/Single Sign-on/SSO using JAAS and GSS API with Apache DS and Kerberos"

package com.gyan.rs;
 
import org.apache.cxf.jaxrs.JAXRSServerFactoryBean;
import org.apache.cxf.jaxrs.lifecycle.SingletonResourceProvider;
 
public class Server {
 
 protected Server() throws Exception {
 JAXRSServerFactoryBean sf = new JAXRSServerFactoryBean();
 sf.setResourceClasses(EchoService.class);
 sf.setResourceProvider(EchoService.class, 
 new SingletonResourceProvider(new EchoService()));
 sf.setAddress("http://localhost:9000/");
 
 sf.create();
 }
 
 public static void main(String args[]) throws Exception {
 new Server();
 System.out.println("Server ready...");
 Thread.sleep(5 * 60 * 1000);
 System.out.println("Server exiting");
 System.exit(0);
 }
}

package com.gyan.rs;
 
import javax.ws.rs.DefaultValue;
import javax.ws.rs.GET;
import javax.ws.rs.HeaderParam;
import javax.ws.rs.Path;
import javax.ws.rs.PathParam;
 
import org.apache.commons.codec.binary.Base64;
import org.gyan.server.GSSServer;
import org.ietf.jgss.GSSException;
 
@Path("/echoservice/")
public class EchoService {
 
 private GSSServer gssServer; 
 public EchoService(){
 gssServer = new GSSServer();
 gssServer.startServer();
 }
 @GET
 @Path("/{msg}/")
 public String saySomthing(@PathParam("msg") String clientMsg, @DefaultValue("NA") 
 @HeaderParam("Authorization") String kerberosToken) throws GSSException {
 
 System.out.println("auth:"+ kerberosToken);
 System.out.println("Encrypted message as is: "+ clientMsg);
 byte[] convert = Base64.decodeBase64(kerberosToken);
 try {
 gssServer.authenticate(convert);
 byte[] unWrapMessage = gssServer.unWrapMessage(Base64.decodeBase64(clientMsg));
 clientMsg = new String(unWrapMessage);
 } catch (GSSException e) {
 e.printStackTrace();
 }
 System.out.println("Decrypted Msg: "+ clientMsg);
 return Base64.encodeBase64URLSafeString(gssServer.wrapMessage(
 ("You said '" + clientMsg + "'").getBytes()));
 } 
}

package org.gyan.server;
 
import java.io.DataInputStream;
import java.io.DataOutputStream;
import java.io.IOException;
import java.net.ServerSocket;
import java.util.Properties;
 
import javax.security.auth.Subject;
import javax.security.auth.login.LoginContext;
 
import org.gyan.BeanCallbackHandler;
import org.ietf.jgss.GSSContext;
import org.ietf.jgss.GSSCredential;
import org.ietf.jgss.GSSException;
import org.ietf.jgss.GSSManager;
import org.ietf.jgss.GSSName;
import org.ietf.jgss.MessageProp;
import org.ietf.jgss.Oid;
 
public class GSSServer implements java.security.PrivilegedAction {
 
 // Handles callback from the JAAS framework.
 BeanCallbackHandler beanCallbackHandler = null;
 
 // The main object that handles all JAAS login.
 LoginContext serverLC = null;
 
 // The context for secure communication with client.
 GSSContext serverGSSContext = null;
 
 // Socket and streams used for communication.
 ServerSocket serverSocket = null;
 DataInputStream inStream = null;
 DataOutputStream outStream = null;
 
 // Name and port of server.
 String serverName = null;
 int serverPort;
 
 // Configuration file and the name of the client configuration.
 String confFile = null;
 String confName = null;
 
 private String clientName;
 
 public static void main(String[] args) throws IOException, GSSException {
 // Starting the server.
 new GSSServer().startServer();
 
 }// main
 
 // GSSServer constructor
 public GSSServer() {
 Properties env = new Properties();
 try {
 env.load(this.getClass().getClassLoader()
 .getResourceAsStream("gssserver.properties"));
 } catch (IOException e) {
 e.printStackTrace();
 }
 
 this.serverName = (String) env.getProperty("Server.SPN");
 this.confName = (String) env.getProperty("JAAS.Config.Name");
 
 beanCallbackHandler = new BeanCallbackHandler(this.serverName,
 (String) env.getProperty("Server.Password"));
 setSystemProperties((String) env.getProperty("KDC.Realm"),
 (String) env.getProperty("KDC.Address"),
 (String) env.getProperty("JAAS.Config.Path"));
 }// GSSServer
 
 private void setSystemProperties(String kerberosRealm, String kdcAddress,
 String confFile) {
 System.setProperty("java.security.krb5.realm", kerberosRealm);
 System.setProperty("java.security.krb5.kdc", kdcAddress);
 System.setProperty("java.security.auth.login.config", confFile);
 System.setProperty("sun.security.krb5.debug", "true");
 }
 
 public boolean startServer() {
 try {
 serverLC = new LoginContext(confName, beanCallbackHandler);
 serverLC.login();
 Subject.doAs(serverLC.getSubject(), this);
 return true;
 } catch (Exception e) {
 e.printStackTrace();
 System.out
 .println(">>> GSSServer...Secure Context not established..");
 return false;
 }// catch
 
 }// start
 
 public Object run() {
 try {
 GSSManager manager = GSSManager.getInstance();
 Oid kerberos = new Oid("1.2.840.113554.1.2.2");
 GSSName serverGSSName = manager.createName(serverName,
 GSSName.NT_USER_NAME);
 GSSCredential serverGSSCreds = manager.createCredential(
 serverGSSName, GSSCredential.INDEFINITE_LIFETIME, kerberos,
 // The server accepts secure context request.
 GSSCredential.ACCEPT_ONLY);
 serverGSSContext = manager.createContext(serverGSSCreds);
 }// try
 catch (java.lang.Exception e) {
 e.printStackTrace();
 }
 return null;
 }// run
 
 public void authenticate(byte[] kerberosToken) throws GSSException {
 if (!serverGSSContext.isEstablished()) {
 serverGSSContext.acceptSecContext(kerberosToken, 0,
 kerberosToken.length);
 clientName = serverGSSContext.getTargName().toString();
 }
 }
 
 public byte[] wrapMessage(byte[] msg) throws GSSException {
 MessageProp msgProp = new MessageProp(0, false);
 return serverGSSContext.wrap(msg, 0, msg.length, msgProp);
 }
 
 public byte[] unWrapMessage(byte[] msg) throws GSSException {
 MessageProp msgProp = new MessageProp(0, false);
 return serverGSSContext.unwrap(msg, 0, msg.length, msgProp);
 }
 
 public void closeServerContext() throws GSSException {
 // Disposing and closing client and server sockets.
 serverGSSContext.dispose();
 }
 
 public String getClientName() {
 return clientName;
 }
}// End of GSSServer

package com.gyan.rs;
 
import java.io.IOException;
 
import org.apache.commons.codec.binary.Base64;
import org.apache.commons.httpclient.HttpClient;
import org.apache.commons.httpclient.HttpException;
import org.apache.commons.httpclient.methods.GetMethod;
import org.gyan.GSSClient;
import org.ietf.jgss.GSSException;
 
public class Client1 {
 
 private static GSSClient gssClient;
 
 /**
 * @param args
 * @throws IOException
 * @throws HttpException
 * @throws InterruptedException 
 */
 public static void main(String[] args) throws HttpException, IOException, InterruptedException {
 
 String theClientCred = authenticateAndGetKerberosToken();
 
 
 String serviceAddress = "http://localhost:9000/echoservice/";
 String message = "Hi man, how are u?";
 System.out.println(message);
 try {
 byte[] wrapedMsg = gssClient.wrapMessage(message.getBytes());
 serviceAddress += Base64.encodeBase64URLSafeString(wrapedMsg);
 } catch (GSSException e) {
 e.printStackTrace();
 }
 GetMethod get = new GetMethod(serviceAddress);
 
 get.setRequestHeader("Authorization", theClientCred);
 HttpClient httpclient = new HttpClient();
 
 try {
 int result = httpclient.executeMethod(get);
 System.out.println("Response status code: " + result);
 System.out.println("Response body: ");
 System.out.println("Return message from server as is: "
 + get.getResponseBodyAsString());
 System.out.println("After decryptionm: "
 + new String(gssClient.unWrapMessage(Base64
 .decodeBase64(get.getResponseBodyAsString()))));
 } catch (GSSException e) {
 // TODO Auto-generated catch block
 e.printStackTrace();
 } finally {
 // Release current connection to the connection pool once you are done
 get.releaseConnection();
 }
// Thread.sleep(10000);
 }
 
 private static String authenticateAndGetKerberosToken() {
 gssClient = new GSSClient("monkey", "Password99");
 String serviceTicket = Base64.encodeBase64URLSafeString(gssClient.login());
 return serviceTicket;
 }
}//End of Class

package org.gyan;
 
 
import java.io.DataInputStream;
import java.io.DataOutputStream;
import java.io.IOException;
import java.net.Socket;
import java.util.Properties;
 
import javax.security.auth.Subject;
import javax.security.auth.login.LoginContext;
 
import org.ietf.jgss.GSSContext;
import org.ietf.jgss.GSSCredential;
import org.ietf.jgss.GSSException;
import org.ietf.jgss.GSSManager;
import org.ietf.jgss.GSSName;
import org.ietf.jgss.MessageProp;
import org.ietf.jgss.Oid;
 
public class GSSClient implements java.security.PrivilegedAction<byte[]> {
 
 // Handles callback from the JAAS framework.
 private BeanCallbackHandler beanCallbackHandler = null;
 
 // The main object that handles all JAAS login.
 LoginContext peerLC = null;
 
 // Socket and streams used for communication.
 Socket socket = null;
 DataInputStream inStream;
 DataOutputStream outStream;
 
 // This and remote clients.
 String clientName = null;
 String serverName = null;
 
 // Address and port of remote server.
 String serverAddress = null;
 int serverPort;
 
 // The name of the client configuration.
 String confName = null;
 
 private GSSContext clientGSSContext = null;
 
 /**
 * @param clientName, Client SPN 
 * @param password, client password
 */
 public GSSClient(String clientName, String password){
 Properties env = new Properties();
 try {
 env.load(this.getClass().getClassLoader().getResourceAsStream("gssclient.properties"));
 } catch (IOException e) {
 // TODO Auto-generated catch block
 e.printStackTrace();
 }
 this.clientName = clientName;
 this.serverName = (String)env.getProperty("Server.SPN");
 this.serverAddress = (String)env.getProperty("Server.Address");
 this.confName = (String)env.getProperty("JAAS.Config.Name");
 
 beanCallbackHandler = new BeanCallbackHandler(clientName, password);
 setSystemProperties((String)env.getProperty("KDC.Realm"),
 (String)env.getProperty("KDC.Address"),
 (String)env.getProperty("JAAS.Config.Path"));
 }
 /**
 * The GSSClient constructor only sets all the required parameters.
 * 
 * @param clientName, Client SPN 
 * @param password, client password
 * @param serverName, Remote server/service SPN
 * @param serverAddress, Remote Server address IP or Hostname 
 * @param kerberosRealm, KDC realm or domain name
 * @param kdcAddress, KDC Server address IP or Hostname 
 * @param confFile, fll path of JAAS COnfig file
 * @param confName, JAAS config name
 */
 public GSSClient(String clientName, String password, String serverName,
 String serverAddress, String kerberosRealm,
 String kdcAddress, String confFile, String confName){
 // The beanCallbackHandler will require the name and password of the
 // client.
 beanCallbackHandler = new BeanCallbackHandler(clientName, password);
 this.clientName = clientName;
 this.serverName = serverName;
 this.serverAddress = serverAddress;
 this.confName = confName;
 setSystemProperties(kerberosRealm, kdcAddress, confFile);
 }// KerberoseLoginBean
 
 private void setSystemProperties(String kerberosRealm, String kdcAddress,
 String confFile) {
 System.setProperty("java.security.krb5.realm", kerberosRealm);
 System.setProperty("java.security.krb5.kdc", kdcAddress);
 System.setProperty("java.security.auth.login.config", confFile);
 System.setProperty("sun.security.krb5.debug", "true");
 }
 
 public byte[] login() {
 try {
 peerLC = new LoginContext(confName, beanCallbackHandler);
 peerLC.login();
 return Subject.doAs(peerLC.getSubject(), this);
 } catch (Exception e) {
 System.out
 .println(">>>> GSSClient....Secure Context not established..");
 e.printStackTrace();
 return null;
 }// catch
 
 }// establishSecureContextWithServer
 
 // This is the only method in PrivilegedAction interface.
 // It receives control only in case of successful authentication of the
 // client.
 public byte[] run() {
 
 try {
 GSSManager manager = GSSManager.getInstance();
 Oid kerberos = new Oid("1.2.840.113554.1.2.2");
 GSSName clientPeerName = manager.createName(
 // Name of the client for which we want to create this GSSName
 // object.
 clientName,
 // Type of GSSName. Our client is a Windows user,
 // which we can specifiy using GSSName.NT_USER_NAME
 // property.
 GSSName.NT_USER_NAME);
 // GSSName remotePeerName2 = manager.createName("FakeSERver",
 // GSSName.NT_USER_NAME);
 GSSName remotePeerName = manager.createName(serverName,
 GSSName.NT_USER_NAME);
 System.out.println(">>> GSSClient... Getting client credentials");
 
 GSSCredential peerCredentials = manager.createCredential(
 // The GSSName object of the client.
 clientPeerName,
 // Time for which credentials whill be valid.
 10 * 600,
 // Kerberos mecahnism identifier.
 kerberos,
 // The client only intiates the secure context request.
 GSSCredential.INITIATE_ONLY);
 
 System.out
 .println(">>> GSSClient...GSSManager creating security context");
 clientGSSContext= manager.createContext(remotePeerName, kerberos,
 peerCredentials, GSSContext.DEFAULT_LIFETIME);
 
 // peerContext.requestCredDeleg(true);
 clientGSSContext.requestConf(true);
 clientGSSContext.requestMutualAuth(false);// I don't want to authenticate the 
 // Server.
 byte[] byteToken = new byte[0];
 
 byteToken = clientGSSContext.initSecContext(byteToken, 0,
 byteToken.length);
 return byteToken;
 }// try
 catch (org.ietf.jgss.GSSException ge) {
 ge.printStackTrace();
 System.out.println(">>> GSSClient... GSS Exception "
 + ge.getMessage());
 }
 
 catch (java.lang.Exception e) {
 e.printStackTrace();
 System.out.println(">>> GSSClient... Exception " + e.getMessage());
 }// catch
 return null;
 }// run
 
 // It returns the established login context to client.
 public LoginContext getLoginContext() {
 return peerLC;
 }// getloginContext
 
 public byte[] wrapMessage(byte[] msg) throws GSSException {
 MessageProp msgProp = new MessageProp(0, false);
 return clientGSSContext.wrap(msg, 0, msg.length, msgProp);
 }
 
 public byte[] unWrapMessage(byte[] msg) throws GSSException {
 MessageProp msgProp = new MessageProp(0, false);
 return clientGSSContext.unwrap(msg, 0, msg.length, msgProp);
 }
 
}// End of GSSClient