1 / 6

GSSException :: getOutputToken ()

GSSException :: getOutputToken (). Wang Weijun weijun.wang@oracle.com. background.

gitel
Download Presentation

GSSException :: getOutputToken ()

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. GSSException::getOutputToken() Wang Weijun weijun.wang@oracle.com

  2. background • In JGSS-API (RFC 5653), the GSSContext::initSecContext() method could either return a token when the call succeeds or throw a GSSException if there is a failure, but NOT both. The same applies to acceptSecContext() of the same class. • On the other hand, the C function GSS_Init_sec_context() can fill out an output token even if there is an error.

  3. problem • Without the ability to emit an error token when there is a failure, a Java application has no chance to tell the other side what the error is. For example, a "reject" NegTokenResp token will never be able to sent out for the SPNEGO mechanism.

  4. solution • Embed the token into the GSSException: public byte[] getOutputToken() If the method (For example, initSecContext of GSSContext) that throws this GSSException also needs to generate an output token that should be sent to the peer, that token will be returned by this method. The return value should be null if no such token is generated. This method should never return an empty byte array. • An accompany method setOutputToken() will also be added to GSSException

  5. example try { do { byte[] outTok = context.initSecContext(inTok, 0, inTok.length); if (outTok != null) sendToken(outTok); if (context.isEstablished()) break; inTok = readToken(); } while (true); } catch (GSSException e) { print("GSSAPI error: " + e.getMessage());  if (e.getOutputToken() != null) { sendToken(e.getOutputToken());    } }

  6. references • The current RFC 5653http://tools.ietf.org/html/rfc5653 • Intended changeshttp://cr.openjdk.java.net/~weijun/spec/updates-error-token.txt

More Related