Package org.opends.server.extensions

Class GSSAPISASLMechanismHandler

    • Constructor Detail

      • GSSAPISASLMechanismHandler

        public GSSAPISASLMechanismHandler()
        Creates a new instance of this SASL mechanism handler. No initialization should be done in this method, as it should all be performed in the initializeSASLMechanismHandler method.

    • Method Detail

      • handle

        public void handle​(Callback[] callbacks)
            throws UnsupportedCallbackException
        During login, callbacks are usually used to prompt for passwords. All of the GSSAPI login information is provided in the properties and login.conf file, so callbacks are ignored.
        Specified by:
        handle in interface CallbackHandler
        Parameters:
        callbacks - An array of callbacks to process.
        Throws:
        UnsupportedCallbackException - if an error occurs.

      • processSASLBind

        public void processSASLBind​(BindOperation bindOp)
        Description copied from class: SASLMechanismHandler
        Processes the SASL bind operation. SASL mechanism implementations must ensure that the following actions are taken during the processing of this method:
        • The BindOperation.setResultCode method must be used to set the appropriate result code.
        • If the SASL processing gets far enough to be able to map the request to a user entry (regardless of whether the authentication is ultimately successful), then this method must call the BindOperation.setSASLAuthUserEntry method to provide it with the entry for the user that attempted to authenticate.
        • If the bind processing was successful, then the BindOperation.setAuthenticationInfo method must be used to set the authentication info for the bind operation.
        • If the bind processing was not successful, then the BindOperation.setAuthFailureReason method should be used to provide a message explaining why the authentication failed.
        Specified by:
        processSASLBind in class SASLMechanismHandler<GSSAPISASLMechanismHandlerCfg>
        Parameters:
        bindOp - The SASL bind operation to be processed.

      • getGSSExceptionMessage

        public static org.forgerock.i18n.LocalizableMessage getGSSExceptionMessage​(GSSException gex)
        Get the underlying GSSException messages that really tell what the problem is. The major code is the GSS-API status and the minor is the mechanism specific error.
        Parameters:
        gex - The GSSException thrown.
        Returns:
        The message containing the major and (optional) minor codes and strings.

      • isPasswordBased

        public boolean isPasswordBased​(String mechanism)
        Description copied from class: SASLMechanismHandler
        Indicates whether the specified SASL mechanism is password-based or uses some other form of credentials (e.g., an SSL client certificate or Kerberos ticket).
        Specified by:
        isPasswordBased in class SASLMechanismHandler<GSSAPISASLMechanismHandlerCfg>
        Parameters:
        mechanism - The name of the mechanism for which to make the determination. This will only be invoked with names of mechanisms for which this handler has previously registered.
        Returns:
        true if this SASL mechanism is password-based, or false if it uses some other form of credentials.

      • isSecure

        public boolean isSecure​(String mechanism)
        Description copied from class: SASLMechanismHandler
        Indicates whether the specified SASL mechanism should be considered secure (i.e., it does not expose the authentication credentials in a manner that is useful to a third-party observer, and other aspects of the authentication are generally secure).
        Specified by:
        isSecure in class SASLMechanismHandler<GSSAPISASLMechanismHandlerCfg>
        Parameters:
        mechanism - The name of the mechanism for which to make the determination. This will only be invoked with names of mechanisms for which this handler has previously registered.
        Returns:
        true if this SASL mechanism should be considered secure, or false if not.

      • isConfigurationAcceptable

        public boolean isConfigurationAcceptable​(SASLMechanismHandlerCfg configuration,
                                         List<org.forgerock.i18n.LocalizableMessage> unacceptableReasons)
        Description copied from class: SASLMechanismHandler
        Indicates whether the provided configuration is acceptable for this SASL mechanism handler. It should be possible to call this method on an uninitialized SASL mechanism handler instance in order to determine whether the SASL mechanism handler would be able to use the provided configuration.

        Note that implementations which use a subclass of the provided configuration class will likely need to cast the configuration to the appropriate subclass type.
        Overrides:
        isConfigurationAcceptable in class SASLMechanismHandler<GSSAPISASLMechanismHandlerCfg>
        Parameters:
        configuration - The SASL mechanism handler configuration for which to make the determination.
        unacceptableReasons - A list that may be used to hold the reasons that the provided configuration is not acceptable.
        Returns:
        true if the provided configuration is acceptable for this SASL mechanism handler, or false if not.

      • isConfigurationChangeAcceptable

        public boolean isConfigurationChangeAcceptable​(GSSAPISASLMechanismHandlerCfg newConfiguration,
                                               List<org.forgerock.i18n.LocalizableMessage> unacceptableReasons)
        Description copied from interface: ConfigurationChangeListener
        Indicates whether the proposed change to the configuration is acceptable to this change listener.
        Specified by:
        isConfigurationChangeAcceptable in interface ConfigurationChangeListener<GSSAPISASLMechanismHandlerCfg>
        Parameters:
        newConfiguration - The new configuration containing the changes.
        unacceptableReasons - A list that can be used to hold messages about why the provided configuration is not acceptable.
        Returns:
        Returns true if the proposed change is acceptable, or false if it is not.