- All Superinterfaces:
Cloneable
Credentials are instantiated using one of the
createCredential
methods in the GSSManager
class. GSS-API credential creation is not
intended to provide a "login to the network" function, as such a
function would involve the creation of new credentials rather than
merely acquiring a handle to existing credentials. The
section on credential
acquisition in the package level description describes
how existing credentials are acquired in the Java platform. GSS-API
implementations must impose a local access-control policy on callers to
prevent unauthorized callers from acquiring credentials to which they
are not entitled.
Applications will create a credential object passing the desired
parameters. The application can then use the query methods to obtain
specific information about the instantiated credential object.
When the credential is no longer needed, the application should call
the dispose
method to release any resources held by
the credential object and to destroy any cryptographically sensitive
information.
This example code demonstrates the creation of a GSSCredential implementation for a specific entity, querying of its fields, and its release when it is no longer needed:
GSSManager manager = GSSManager.getInstance(); // start by creating a name object for the entity GSSName name = manager.createName("myusername", GSSName.NT_USER_NAME); // now acquire credentials for the entity GSSCredential cred = manager.createCredential(name, GSSCredential.ACCEPT_ONLY); // display credential information - name, remaining lifetime, // and the mechanisms it has been acquired over System.out.println(cred.getName().toString()); System.out.println(cred.getRemainingLifetime()); Oid [] mechs = cred.getMechs(); if (mechs != null) { for (int i = 0; i< mechs.length; i++) System.out.println(mechs[i].toString()); } // release system resources held by the credential cred.dispose();
- Since:
- 1.4
- See Also:
-
Field Summary
Modifier and TypeFieldDescriptionstatic final int
Credential usage flag requesting that it be usable for context acceptance only.static final int
A lifetime constant representing the default credential lifetime.static final int
A lifetime constant representing indefinite credential lifetime.static final int
Credential usage flag requesting that it be usable for both context initiation and acceptance.static final int
Credential usage flag requesting that it be usable for context initiation only. -
Method Summary
Modifier and TypeMethodDescriptionvoid
Adds a mechanism specific credential-element to an existing credential.void
dispose()
Releases any sensitive information that the GSSCredential object may be containing.boolean
Tests if this GSSCredential asserts the same entity as the supplied object.Oid[]
getMechs()
Returns a list of mechanisms supported by this credential.getName()
Retrieves the name of the entity that the credential asserts.Retrieves a Mechanism Name of the entity that the credential asserts.int
Returns the lifetime in seconds for the credential to remain capable of accepting security contexts using the specified mechanism.int
getRemainingInitLifetime
(Oid mech) Returns the lifetime in seconds for the credential to remain capable of initiating security contexts using the specified mechanism.int
Returns the remaining lifetime in seconds for a credential.int
getUsage()
Returns the credential usage mode.int
Returns the credential usage mode for a specific mechanism.int
hashCode()
Returns a hashcode value for this GSSCredential.
-
Field Details
-
INITIATE_AND_ACCEPT
static final int INITIATE_AND_ACCEPTCredential usage flag requesting that it be usable for both context initiation and acceptance.- See Also:
-
INITIATE_ONLY
static final int INITIATE_ONLYCredential usage flag requesting that it be usable for context initiation only.- See Also:
-
ACCEPT_ONLY
static final int ACCEPT_ONLYCredential usage flag requesting that it be usable for context acceptance only.- See Also:
-
DEFAULT_LIFETIME
static final int DEFAULT_LIFETIMEA lifetime constant representing the default credential lifetime. This value it set to 0.- See Also:
-
INDEFINITE_LIFETIME
static final int INDEFINITE_LIFETIMEA lifetime constant representing indefinite credential lifetime. This value must is set to the maximum integer value in Java -Integer.MAX_VALUE
.- See Also:
-
-
Method Details
-
dispose
Releases any sensitive information that the GSSCredential object may be containing. Applications should call this method as soon as the credential is no longer needed to minimize the time any sensitive information is maintained.- Throws:
GSSException
- containing the following major error codes:GSSException.FAILURE
-
getName
Retrieves the name of the entity that the credential asserts.- Returns:
- a GSSName representing the entity
- Throws:
GSSException
- containing the following major error codes:GSSException.FAILURE
-
getName
Retrieves a Mechanism Name of the entity that the credential asserts. This is equivalent to callingcanonicalize
on the value returned by the other form ofgetName
.- Parameters:
mech
- the Oid of the mechanism for which the Mechanism Name should be returned.- Returns:
- a GSSName representing the entity canonicalized for the desired mechanism
- Throws:
GSSException
- containing the following major error codes:GSSException.BAD_MECH
,GSSException.FAILURE
-
getRemainingLifetime
Returns the remaining lifetime in seconds for a credential. The remaining lifetime is the minimum lifetime amongst all the underlying mechanism specific credential elements.- Returns:
- the minimum remaining lifetime in seconds for this
credential. A return value of
INDEFINITE_LIFETIME
indicates that the credential does not expire. A return value of 0 indicates that the credential is already expired. - Throws:
GSSException
- containing the following major error codes:GSSException.FAILURE
- See Also:
-
getRemainingInitLifetime
Returns the lifetime in seconds for the credential to remain capable of initiating security contexts using the specified mechanism. This method queries the initiator credential element that belongs to the specified mechanism.- Parameters:
mech
- the Oid of the mechanism whose initiator credential element should be queried.- Returns:
- the number of seconds remaining in the life of this credential
element. A return value of
INDEFINITE_LIFETIME
indicates that the credential element does not expire. A return value of 0 indicates that the credential element is already expired. - Throws:
GSSException
- containing the following major error codes:GSSException.BAD_MECH
,GSSException.FAILURE
-
getRemainingAcceptLifetime
Returns the lifetime in seconds for the credential to remain capable of accepting security contexts using the specified mechanism. This method queries the acceptor credential element that belongs to the specified mechanism.- Parameters:
mech
- the Oid of the mechanism whose acceptor credential element should be queried.- Returns:
- the number of seconds remaining in the life of this credential
element. A return value of
INDEFINITE_LIFETIME
indicates that the credential element does not expire. A return value of 0 indicates that the credential element is already expired. - Throws:
GSSException
- containing the following major error codes:GSSException.BAD_MECH
,GSSException.FAILURE
-
getUsage
Returns the credential usage mode. In other words, it tells us if this credential can be used for initiating or accepting security contexts. It does not tell us which mechanism(s) has to be used in order to do so. It is expected that an application will allow the GSS-API to pick a default mechanism after calling this method.- Returns:
- The return value will be one of
INITIATE_ONLY
,ACCEPT_ONLY
, andINITIATE_AND_ACCEPT
. - Throws:
GSSException
- containing the following major error codes:GSSException.FAILURE
-
getUsage
Returns the credential usage mode for a specific mechanism. In other words, it tells us if this credential can be used for initiating or accepting security contexts with a given underlying mechanism.- Parameters:
mech
- the Oid of the mechanism whose credentials usage mode is to be determined.- Returns:
- The return value will be one of
INITIATE_ONLY
,ACCEPT_ONLY
, andINITIATE_AND_ACCEPT
. - Throws:
GSSException
- containing the following major error codes:GSSException.BAD_MECH
,GSSException.FAILURE
-
getMechs
Returns a list of mechanisms supported by this credential. It does not tell us which ones can be used to initiate contexts and which ones can be used to accept contexts. The application must call thegetUsage
method with each of the returned Oid's to determine the possible modes of usage.- Returns:
- an array of Oid's corresponding to the supported mechanisms.
- Throws:
GSSException
- containing the following major error codes:GSSException.FAILURE
-
add
void add(GSSName name, int initLifetime, int acceptLifetime, Oid mech, int usage) throws GSSException Adds a mechanism specific credential-element to an existing credential. This method allows the construction of credentials, one mechanism at a time.This routine is envisioned to be used mainly by context acceptors during the creation of acceptor credentials which are to be used with a variety of clients using different security mechanisms.
This routine adds the new credential element "in-place". To add the element in a new credential, first call
clone
to obtain a copy of this credential, then call itsadd
method.As always, GSS-API implementations must impose a local access-control policy on callers to prevent unauthorized callers from acquiring credentials to which they are not entitled. Non-default values for initLifetime and acceptLifetime cannot always be honored by the underlying mechanisms, thus callers should be prepared to call
getRemainingInitLifetime
andgetRemainingAcceptLifetime
on the credential.- Parameters:
name
- the name of the principal for whom this credential is to be acquired. Usenull
to specify the default principal.initLifetime
- the number of seconds that the credential element should remain valid for initiating of security contexts. UseGSSCredential.INDEFINITE_LIFETIME
to request that the credentials have the maximum permitted lifetime for this. UseGSSCredential.DEFAULT_LIFETIME
to request default credential lifetime for this.acceptLifetime
- the number of seconds that the credential element should remain valid for accepting security contexts. UseGSSCredential.INDEFINITE_LIFETIME
to request that the credentials have the maximum permitted lifetime for this. UseGSSCredential.DEFAULT_LIFETIME
to request default credential lifetime for this.mech
- the mechanism over which the credential is to be acquired.usage
- the usage mode that this credential element should add to the credential. The value of this parameter must be one of:INITIATE_AND_ACCEPT
,ACCEPT_ONLY
, andINITIATE_ONLY
.- Throws:
GSSException
- containing the following major error codes:GSSException.DUPLICATE_ELEMENT
,GSSException.BAD_MECH
,GSSException.BAD_NAMETYPE
,GSSException.NO_CRED
,GSSException.CREDENTIALS_EXPIRED
,GSSException.FAILURE
-
equals
Tests if this GSSCredential asserts the same entity as the supplied object. The two credentials must be acquired over the same mechanisms and must refer to the same principal. -
hashCode
-