X-Git-Url: https://git.argeo.org/?a=blobdiff_plain;f=org.argeo.cms%2Fsrc%2Forg%2Fargeo%2Fcms%2Fauth%2FRemoteAuthUtils.java;h=cf30d8a715ea72cca0d8916ce9d9925081e478e8;hb=4e548693acc16f97b74eaaa95d6841054a172b85;hp=6274bb146e736165214fcabd52f49c20edb3e5d8;hpb=c2366f32052deada7d96f635e86f745f438f094e;p=lgpl%2Fargeo-commons.git

diff --git a/org.argeo.cms/src/org/argeo/cms/auth/RemoteAuthUtils.java b/org.argeo.cms/src/org/argeo/cms/auth/RemoteAuthUtils.java
index 6274bb146..cf30d8a71 100644
--- a/org.argeo.cms/src/org/argeo/cms/auth/RemoteAuthUtils.java
+++ b/org.argeo.cms/src/org/argeo/cms/auth/RemoteAuthUtils.java
@@ -3,17 +3,34 @@ package org.argeo.cms.auth;
 import java.security.AccessControlContext;
 import java.security.AccessController;
 import java.security.PrivilegedAction;
+import java.util.Base64;
 import java.util.function.Supplier;
 
 import javax.security.auth.Subject;
+import javax.security.auth.kerberos.KerberosTicket;
 
 import org.argeo.api.cms.CmsSession;
 import org.argeo.cms.internal.runtime.CmsContextImpl;
+import org.ietf.jgss.GSSContext;
+import org.ietf.jgss.GSSException;
+import org.ietf.jgss.GSSManager;
+import org.ietf.jgss.GSSName;
+import org.ietf.jgss.Oid;
 
 /** Remote authentication utilities. */
 public class RemoteAuthUtils {
 	static final String REMOTE_USER = "org.osgi.service.http.authentication.remote.user";
-//	private static BundleContext bundleContext = FrameworkUtil.getBundle(RemoteAuthUtils.class).getBundleContext();
+	private final static Oid KERBEROS_OID;
+//	private final static Oid KERB_V5_OID, KRB5_PRINCIPAL_NAME_OID;
+	static {
+		try {
+			KERBEROS_OID = new Oid("1.3.6.1.5.5.2");
+//			KERB_V5_OID = new Oid("1.2.840.113554.1.2.2");
+//			KRB5_PRINCIPAL_NAME_OID = new Oid("1.2.840.113554.1.2.2.1");
+		} catch (GSSException e) {
+			throw new IllegalStateException("Cannot create Kerberos OID", e);
+		}
+	}
 
 	/**
 	 * Execute this supplier, using the CMS class loader as context classloader.
@@ -59,4 +76,45 @@ public class RemoteAuthUtils {
 		CmsSession cmsSession = CmsContextImpl.getCmsContext().getCmsSession(subject);
 		return cmsSession;
 	}
+
+	public static String getGssToken(Subject subject, String service, String server) {
+		if (subject.getPrivateCredentials(KerberosTicket.class).isEmpty())
+			throw new IllegalArgumentException("Subject " + subject + " is not GSS authenticated.");
+		return Subject.doAs(subject, (PrivilegedAction<String>) () -> {
+			// !! different format than Kerberos
+			String serverPrinc = service + "@" + server;
+			GSSContext context = null;
+			String tokenStr = null;
+
+			try {
+				// Get service's principal name
+				GSSManager manager = GSSManager.getInstance();
+				// GSSName serverName = manager.createName(serverPrinc,
+				// GSSName.NT_HOSTBASED_SERVICE, KERBEROS_OID);
+				GSSName serverName = manager.createName(serverPrinc, GSSName.NT_HOSTBASED_SERVICE);
+
+				// Get the context for authentication
+				context = manager.createContext(serverName, KERBEROS_OID, null, GSSContext.DEFAULT_LIFETIME);
+				// context.requestMutualAuth(true); // Request mutual authentication
+				// context.requestConf(true); // Request confidentiality
+				context.requestCredDeleg(true);
+
+				byte[] token = new byte[0];
+
+				// token is ignored on the first call
+				token = context.initSecContext(token, 0, token.length);
+
+				// Send a token to the server if one was generated by
+				// initSecContext
+				if (token != null) {
+					tokenStr = Base64.getEncoder().encodeToString(token);
+					// complete=true;
+				}
+				return tokenStr;
+
+			} catch (GSSException e) {
+				throw new IllegalStateException("Cannot authenticate to " + serverPrinc, e);
+			}
+		});
+	}
 }