Java 类org.apache.http.auth.KerberosCredentials 实例源码

/**
 * @since 4.4
 */
protected byte[] generateGSSToken(
        final byte[] input, final Oid oid, final String authServer,
        final Credentials credentials) throws GSSException {
    byte[] inputBuff = input;
    if (inputBuff == null) {
        inputBuff = new byte[0];
    }
    final GSSManager manager = getManager();
    final GSSName serverName = manager.createName(service + "@" + authServer, GSSName.NT_HOSTBASED_SERVICE);

    final GSSCredential gssCredential;
    if (credentials instanceof KerberosCredentials) {
        gssCredential = ((KerberosCredentials) credentials).getGSSCredential();
    } else {
        gssCredential = null;
    }

    final GSSContext gssContext = manager.createContext(
            serverName.canonicalize(oid), oid, gssCredential, GSSContext.DEFAULT_LIFETIME);
    gssContext.requestMutualAuth(true);
    gssContext.requestCredDeleg(true);
    return gssContext.initSecContext(inputBuff, 0, inputBuff.length);
}

/**
 * Constructs an HTTP client with user specified by the given credentials.
 *
 * @param url The URL for the Avatica server
 * @param credential The GSS credentials
 */
public AvaticaCommonsHttpClientSpnegoImpl(URL url, GSSCredential credential) {
  this.url = Objects.requireNonNull(url);

  pool = new PoolingHttpClientConnectionManager();
  // Increase max total connection to 100
  final String maxCnxns =
      System.getProperty(CACHED_CONNECTIONS_MAX_KEY, CACHED_CONNECTIONS_MAX_DEFAULT);
  pool.setMaxTotal(Integer.parseInt(maxCnxns));
  // Increase default max connection per route to 25
  final String maxCnxnsPerRoute = System.getProperty(CACHED_CONNECTIONS_MAX_PER_ROUTE_KEY,
      CACHED_CONNECTIONS_MAX_PER_ROUTE_DEFAULT);
  pool.setDefaultMaxPerRoute(Integer.parseInt(maxCnxnsPerRoute));

  this.host = new HttpHost(url.getHost(), url.getPort());

  this.authRegistry = RegistryBuilder.<AuthSchemeProvider>create().register(AuthSchemes.SPNEGO,
      new SPNegoSchemeFactory(STRIP_PORT_ON_SERVER_LOOKUP, USE_CANONICAL_HOSTNAME)).build();

  this.credentialsProvider = new BasicCredentialsProvider();
  if (null != credential) {
    // Non-null credential should be used directly with KerberosCredentials.
    this.credentialsProvider.setCredentials(AuthScope.ANY, new KerberosCredentials(credential));
  } else {
    // A null credential implies that the user is logged in via JAAS using the
    // java.security.auth.login.config system property
    this.credentialsProvider.setCredentials(AuthScope.ANY, EmptyCredentials.INSTANCE);
  }

  this.authCache = new BasicAuthCache();

  // A single thread-safe HttpClient, pooling connections via the ConnectionManager
  this.client = HttpClients.custom()
      .setDefaultAuthSchemeRegistry(authRegistry)
      .setConnectionManager(pool).build();
}

@Test
public void testAllowedClient() throws Exception {
  // Create the subject for the client
  final Subject clientSubject = JaasKrbUtil.loginUsingKeytab(CLIENT_PRINCIPAL, clientKeytab);
  final Set<Principal> clientPrincipals = clientSubject.getPrincipals();
  // Make sure the subject has a principal
  assertFalse(clientPrincipals.isEmpty());

  // Get a TGT for the subject (might have many, different encryption types). The first should
  // be the default encryption type.
  Set<KerberosTicket> privateCredentials =
          clientSubject.getPrivateCredentials(KerberosTicket.class);
  assertFalse(privateCredentials.isEmpty());
  KerberosTicket tgt = privateCredentials.iterator().next();
  assertNotNull(tgt);

  // The name of the principal
  final String principalName = clientPrincipals.iterator().next().getName();

  // Run this code, logged in as the subject (the client)
  HttpResponse resp = Subject.doAs(clientSubject,
      new PrivilegedExceptionAction<HttpResponse>() {
    @Override
    public HttpResponse run() throws Exception {
      // Logs in with Kerberos via GSS
      GSSManager gssManager = GSSManager.getInstance();
      // jGSS Kerberos login constant
      Oid oid = new Oid("1.2.840.113554.1.2.2");
      GSSName gssClient = gssManager.createName(principalName, GSSName.NT_USER_NAME);
      GSSCredential credential = gssManager.createCredential(gssClient,
          GSSCredential.DEFAULT_LIFETIME, oid, GSSCredential.INITIATE_ONLY);

      HttpClientContext context = HttpClientContext.create();
      Lookup<AuthSchemeProvider> authRegistry = RegistryBuilder.<AuthSchemeProvider>create()
          .register(AuthSchemes.SPNEGO, new SPNegoSchemeFactory(true, true))
          .build();

      HttpClient client = HttpClients.custom().setDefaultAuthSchemeRegistry(authRegistry).build();
      BasicCredentialsProvider credentialsProvider = new BasicCredentialsProvider();
      credentialsProvider.setCredentials(AuthScope.ANY, new KerberosCredentials(credential));

      URL url = new URL(getServerURL(server), "/echo?a=b");
      context.setTargetHost(new HttpHost(url.getHost(), url.getPort()));
      context.setCredentialsProvider(credentialsProvider);
      context.setAuthSchemeRegistry(authRegistry);

      HttpGet get = new HttpGet(url.toURI());
      return client.execute(get, context);
    }
  });

  assertNotNull(resp);
  assertEquals(HttpURLConnection.HTTP_OK, resp.getStatusLine().getStatusCode());
  assertEquals("a:b", EntityUtils.toString(resp.getEntity()).trim());
}