Class GSSContext


  • public class GSSContext
    extends java.lang.Object
    This class represents the JGSS security context and its associated operations. JGSS security contexts are established between peers using locally established credentials. Multiple contexts may exist simultaneously between a pair of peers, using the same or different set of credentials. The JGSS is independent of the underlying transport protocols and depends on its callers to transport the tokens between peers.

    The context object can be thought of as having 3 implicit states: before it is established, during its context establishment, and after a fully established context exists.

    Before the context establishment phase is initiated, the context initiator may request specific characteristics desired of the established context. These can be set using the set methods. After the context is established, the caller can check the actual characteristic and services offered by the context using the query methods.

    The context establishment phase begins with the first call to the init method by the context initiator. During this phase the init and accept methods will produce GSS-API authentication tokens which the calling application needs to send to its peer. The init and accept methods may return a CONTINUE_NEEDED code which indicates that a token is needed from its peer in order to continue the context establishment phase. A return code of COMPLETE signals that the local end of the context is established. This may still require that a token be sent to the peer, depending if one is produced by GSS-API. The isEstablished method can also be used to determine if the local end of the context has been fully established. During the context establishment phase, the isProtReady method may be called to determine if the context can be used for the per-message operations. This allows implementation to use per-message operations on contexts which aren't fully established.

    After the context has been established or the isProtReady method returns "true", the query routines can be invoked to determine the actual characteristics and services of the established context. The application can also start using the per-message methods of wrap and getMIC to obtain cryptographic operations on application supplied data.

    When the context is no longer needed, the application should call dispose to release any system resources the context may be using.

    RFC 2078
    This class corresponds to the context level calls together with the per message calls of RFC 2078. The gss_init_sec_context and gss_accept_sec_context calls have been made simpler by only taking required parameters. The context can have its properties set before the first call to init. The supplementary status codes for the per-message operations are returned in an instance of the MessageProp class, which is used as an argument in these calls.
    • Field Summary

      Fields 
      Modifier and Type Field Description
      static int ANON
      Context option flag - anonymity.
      static int COMPLETE
      Return value from either accept or init stating that the context creation phase is complete for this peer.
      static int CONF
      Context option flag - confidentiality.
      static int CONTINUE_NEEDED
      Return value from either accept or init stating that another token is required from the peer to continue context creation.
      static int CRED_DELEG
      Context option flag - credential delegation.
      static int INDEFINITE
      Indefinite lifetime value for a context.
      static int INTG
      Context option flag - integrity.
      static int MUTUAL_AUTH
      Context option flag - mutual authentication.
      static int REPLAY_DET
      Context option flag - replay detection.
      static int SEQUENCE_DET
      Context option flag - sequence detection.
      static int TRANS
      Context option flag - transferability (output flag only).
    • Constructor Summary

      Constructors 
      Constructor Description
      GSSContext​(byte[] interProcessToken)
      Constructor for creating a GSSContext from a previously exported context.
      GSSContext​(GSSCredential myCred)
      Constructor for creating a context on the acceptor' side.
      GSSContext​(GSSName peer, Oid mechOid, GSSCredential myCred, int lifetime)
      Constructor for creating a context on the initiator's side.
    • Method Summary

      All Methods Instance Methods Concrete Methods 
      Modifier and Type Method Description
      byte[] accept​(byte[] inTok, int offset, int length)
      Called by the context acceptor upon receiving a token from the peer.
      int accept​(java.io.InputStream inputBuf, java.io.OutputStream outputBuf)
      Called by the context acceptor upon receiving a token from the peer.
      void dispose()
      Release any system resources and cryptographic information stored in the context object.
      byte[] export()
      Provided to support the sharing of work between multiple processes.
      boolean getAnonymityState()
      Returns true if this is an anonymous context.
      boolean getConfState()
      Returns the confidentiality service state over the context.
      GSSCredential getDelegCred()
      Returns the delegated credential object on the acceptor's side.
      boolean getDelegCredState()
      Returns the state of the delegated credentials for the context.
      boolean getIntegState()
      Returns the integrity service state over the context.
      int getLifetime()
      Returns the context lifetime in seconds.
      Oid getMech()
      Returns the mechanism oid for the context.
      byte[] getMIC​(byte[] inMsg, int offset, int length, MessageProp msgProp)
      Returns a token containing a cryptographic MIC for the supplied message, for transfer to the peer application.
      void getMIC​(java.io.InputStream inBuf, java.io.OutputStream outBuf, MessageProp msgProp)
      Produces a token containing a cryptographic MIC for the supplied message, for transfer to the peer application.
      boolean getMutualAuthState()
      Returns the state of the mutual authentication option for the context.
      boolean getReplayDetState()
      Returns the state of the replay detection service for the context.
      boolean getSequenceDetState()
      Returns the state of the sequence detection service for the context.
      GSSName getSrcName()
      Retrieves the name of the context initiator.
      GSSName getTargName()
      Retrieves the name of the context target (acceptor).
      int getWrapSizeLimit​(int qop, boolean confReq, int maxTokenSize)
      Returns the maximum message size that, if presented to the wrap method with the same confReq and qop parameters will result in an output token containing no more then maxTokenSize bytes.
      byte[] init​(byte[] inputBuf, int offset, int length)
      Called by the context initiator to start the context creation process.
      int init​(java.io.InputStream inputBuf, java.io.OutputStream outputBuf)
      Called by the context initiator to start the context creation process.
      boolean isEstablished()
      Returns true is this is a fully established context.
      boolean isInitiator()
      Returns true if this is the initiator of the context.
      boolean isProtReady()
      Indicates if the per message operations can be applied over the context.
      boolean isTransferable()
      Indicates if the context is transferable to other processes through the use of the export method.
      void requestAnonymity​(boolean state)
      Requests anonymous support over the context.
      void requestConf​(boolean state)
      Requests that confidentiality service be available over the context.
      void requestCredDeleg​(boolean state)
      Sets the request state of the credential delegation flag for the context.
      void requestInteg​(boolean state)
      Requests that integrity service be available over the context.
      void requestLifetime​(int lifetime)
      Sets the desired lifetime for the context in seconds.
      void requestMutualAuth​(boolean state)
      Sets the request state of the mutual authentication flag for the context.
      void requestReplayDet​(boolean state)
      Sets the request state of the replay detection service for the context.
      void requestSequenceDet​(boolean state)
      Sets the request state of the sequence checking service for the context.
      void setChannelBinding​(ChannelBinding cb)
      Sets the channel bindings to be used during context establishment.
      byte[] unwrap​(byte[] inBuf, int offset, int length, MessageProp msgProp)
      Used by the peer application to process tokens generated with the wrap call.
      void unwrap​(java.io.InputStream inBuf, java.io.OutputStream outBuf, MessageProp msgProp)
      Used by the peer application to process tokens generated with the wrap call.
      void verifyMIC​(byte[] inTok, int tokOffset, int tokLen, byte[] inMsg, int msgOffset, int msgLen, MessageProp msgProp)
      Verifies the cryptographic MIC, contained in the token parameter, over the supplied message.
      void verifyMIC​(java.io.InputStream inTok, java.io.InputStream inMsg, MessageProp msgProp)
      Verifies the cryptographic MIC, contained in the token parameter, over the supplied message.
      byte[] wrap​(byte[] inBuf, int offset, int length, MessageProp msgProp)
      Allows to apply per-message security services over the established security context.
      void wrap​(java.io.InputStream inBuf, java.io.OutputStream outBuf, MessageProp msgProp)
      Allows to apply per-message security services over the established security context.
      • Methods inherited from class java.lang.Object

        clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
    • Constructor Detail

      • GSSContext

        public GSSContext​(GSSName peer,
                          Oid mechOid,
                          GSSCredential myCred,
                          int lifetime)
                   throws GSSException
        Constructor for creating a context on the initiator's side. Context flags may be modified through the set methods prior to calling init().
        Parameters:
        peer - Name of the target peer.
        mechOid - Oid of the desired mechanism; may be null to indicate the default mechanism
        myCred - the credentials for the initiator; may be null to indicate desire to use the default credentials
        lifetime - the request lifetime, in seconds, for the context
        Throws:
        GSSException - with possible major codes of BAD_NAME, BAD_MECH, BAD_NAMETYPE.
        See Also:
        init(byte[], int, int)
      • GSSContext

        public GSSContext​(GSSCredential myCred)
                   throws GSSException
        Constructor for creating a context on the acceptor' side. The context's properties will be determined from the input token supplied to accept().
        Parameters:
        myCred - GSSCredential for the acceptor. Use null to request usage of default credentials.
        Throws:
        GSSException - with possible major codes of BAD_NAME, BAD_MECH, BAD_NAMETYPE.
        See Also:
        accept(byte[], int, int)
      • GSSContext

        public GSSContext​(byte[] interProcessToken)
                   throws GSSException
        Constructor for creating a GSSContext from a previously exported context. The context properties will be determined from the input token.

        RFC 2078
        equivalent to gss_import_sec_context
        Parameters:
        interProcessToken - the token emitted from export routine
        Throws:
        GSSException - with possible major codes of CONTEXT_EXPIRED, NO_CONTEXT, DEFECTIVE_TOKEN, UNAVAILABLE, UNAUTHORIZED, FAILURE
        See Also:
        export()
    • Method Detail

      • init

        public byte[] init​(byte[] inputBuf,
                           int offset,
                           int length)
                    throws GSSException
        Called by the context initiator to start the context creation process. This is equivalent to the stream based method except that the token buffers are handled as byte arrays instead of using stream objects. This method may return an output token which the application will need to send to the peer for processing by the accept call. "null" return value indicates that no token needs to be sent to the peer. The application can call isEstablished to determine if the context establishment phase is complete for this peer. A return value of "false" from isEstablished indicates that more tokens are expected to be supplied to the init method. Please note that the init method may return a token for the peer, and isEstablished return "true" also. This indicates that the token needs to be sent to the peer, but the local end of the context is now fully established.

        Upon completion of the context establishment, the available context options may be queried through the get methods.

        RFC 2078
        equivalent to gss_init_sec_context; The requested context options can be set before the first call, and the available options can be obtained after the context is fully established.
        Parameters:
        inputBuf - token generated by the peer; this parameter is ignored on the first call
        outputBuf - token generated for the peer; this may be empty
        Returns:
        establishment state of either COMPLETE or CONTINUE_NEEDED
        Throws:
        GSSException - with possible major values of DEFECTIVE_TOKEN, DEFECTIVE_CREDENTIAL, BAD_SIG, NO_CRED, CREDENTIALS_EXPIRED, BAD_BINDINGS, OLD_TOKEN, DUPLICATE_ELEMENT, BAD_NAMETYPE, BAD_NAME, BAD_MECH, and FAILURE
        See Also:
        init(InputStream,OutputStream), setChannelBinding(com.sun.gssapi.ChannelBinding)
      • init

        public int init​(java.io.InputStream inputBuf,
                        java.io.OutputStream outputBuf)
                 throws GSSException
        Called by the context initiator to start the context creation process. This is equivalent to the byte array based method. This method may write an output token to the outputBuf, which the application will need to send to the peer for processing by the accept call. 0 bytes written to the output stream indicate that no token needs to be sent to the peer. The method will return either COMPLETE or CONTINUE_NEEDED indicating the status of the current context. A return value of COMPLETE indicates that the context establishment phase is complete for this peer, while CONTINUE_NEEDED means that another token is expected from the peer. The isEstablished method can also be used to determine this state. Note that it is possible to have a token for the peer while this method returns COMPLETE. This indicates that the local end of the context is established, but the token needs to be sent to the peer to complete the context establishment.

        The GSS-API authentication tokens contain a definitive start and end. This method will attempt to read one of these tokens per invocation, and may block on the stream if only part of the token is available.

        Upon completion of the context establishment, the available context options may be queried through the get methods.

        RFC 2078
        equivalent to gss_init_sec_context; The requested context options can be set before the first call, and the available options can be obtained after the context is fully established.
        Parameters:
        inputBuf - token generated by the peer; this parameter is ignored on the first call
        outputBuf - token generated for the peer; this may be empty
        Returns:
        establishment state of either COMPLETE or CONTINUE_NEEDED
        Throws:
        GSSException - with possible major values of DEFECTIVE_TOKEN, DEFECTIVE_CREDENTIAL, BAD_SIG, NO_CRED, CREDENTIALS_EXPIRED, BAD_BINDINGS, OLD_TOKEN, DUPLICATE_ELEMENT, BAD_NAMETYPE, BAD_NAME, BAD_MECH, and FAILURE
        See Also:
        init(byte[],int,int), accept(byte[],int,int), setChannelBinding(com.sun.gssapi.ChannelBinding)
      • accept

        public byte[] accept​(byte[] inTok,
                             int offset,
                             int length)
                      throws GSSException
        Called by the context acceptor upon receiving a token from the peer. This call is equivalent to the stream based method except that the token buffers are handled as byte arrays instead of using stream objects.

        This method may return an output token which the application will need to send to the peer for further processing by the init call. "null" return value indicates that no token needs to be sent to the peer. The application can call isEstablished to determine if the context establishment phase is complete for this peer. A return value of "false" from isEstablished indicates that more tokens are expected to be supplied to this method.

        Please note that the accept method may return a token for the peer, and isEstablished return "true" also. This indicates that the token needs to be sent to the peer, but the local end of the context is now fully established.

        Upon completion of the context establishment, the available context options may be queried through the get methods. Called by the context acceptor upon receiving a token from the peer. May need to be called again if returns CONTINUE_NEEDED.

        RFC 2078
        equivalent to gss_accept_sec_context; context options can obtained through the query methods
        Parameters:
        inputToken - token that was received from the initiator
        outputBut - token generated for the peer; may be empty
        Returns:
        creation state of either COMPLETE or CONTINUE_NEEDED
        Throws:
        GSSException - may be thrown with major status values of DEFECTIVE_TOKEN, DEFECTIVE_CREDENTIAL, BAD_SIG, NO_CRED, CREDENTIALS_EXPIRED, BAD_BINDINGS, OLD_TOKEN, DUPLICATE_ELEMENT, BAD_MECH, and FAILURE
        See Also:
        init(byte[],int,int), accept(InputStream,OutputStream), setChannelBinding(com.sun.gssapi.ChannelBinding)
      • accept

        public int accept​(java.io.InputStream inputBuf,
                          java.io.OutputStream outputBuf)
                   throws GSSException
        Called by the context acceptor upon receiving a token from the peer. This call is equivalent to the byte array method. It may write an output token to the outputBuf, which the application will need to send to the peer for processing by its init method. 0 bytes written to the output stream indicate that no token needs to be sent to the peer. The method will return either COMPLETE or CONTINUE_NEEDED indicating the status of the current context. A return value of COMPLETE indicates that the context establishment phase is complete for this peer, while CONTINUE_NEEDED means that another token is expected from the peer. The isEstablished method can also be used to determine this state. Note that it is possible to have a token for the peer while this method returns COMPLETE. This indicates that the local end of the context is established, but the token needs to be sent to the peer to complete the context establishment.

        The GSS-API authentication tokens contain a definitive start and end. This method will attempt to read one of these tokens per invocation, and may block on the stream if only part of the token is available.

        Upon completion of the context establishment, the available context options may be queried through the get methods.

        RFC 2078
        equivalent to gss_accept_sec_context; context options can obtained through the query methods
        Parameters:
        inputToken - token that was received from the initiator
        outputBut - token generated for the peer; may be empty
        Returns:
        creation state of either COMPLETE or CONTINUE_NEEDED
        Throws:
        GSSException - may be thrown with major status values of DEFECTIVE_TOKEN, DEFECTIVE_CREDENTIAL, BAD_SIG, NO_CRED, CREDENTIALS_EXPIRED, BAD_BINDINGS, OLD_TOKEN, DUPLICATE_ELEMENT, BAD_MECH, and FAILURE
        See Also:
        accept(byte[],int,int), init(InputStream,OutputStream), setChannelBinding(com.sun.gssapi.ChannelBinding)
      • isEstablished

        public boolean isEstablished()
        Returns true is this is a fully established context. Used after the init and accept methods to check if more tokens are needed from the peer.
        Returns:
        boolean indicating if this side of the context is fully established.
      • dispose

        public void dispose()
                     throws GSSException
        Release any system resources and cryptographic information stored in the context object. This will invalidate the context.

        RFC 2078
        equivalent to gss_delete_sec_context
        Throws:
        GSSException - with major codes NO_CONTEXT or FAILURE
      • getWrapSizeLimit

        public int getWrapSizeLimit​(int qop,
                                    boolean confReq,
                                    int maxTokenSize)
                             throws GSSException
        Returns the maximum message size that, if presented to the wrap method with the same confReq and qop parameters will result in an output token containing no more then maxTokenSize bytes.

        RFC 2078
        equivalent to gss_wrap_size_limit
        Parameters:
        qop - quality of protection to apply to the message
        confReq - boolean indicating if privacy should be applied
        maxTokenSize - the maximum size of the token to be emitted from wrap
        Returns:
        maximum input buffer size for encapsulation by wrap using the specified QOP and confReq without exceeding the maxTokenSize
        Throws:
        GSSException - with the possible major codes of BAD_QOP, CONTEXT_EXPIRED, and FAILURE.
        See Also:
        wrap(byte[], int, int, com.sun.gssapi.MessageProp)
      • wrap

        public byte[] wrap​(byte[] inBuf,
                           int offset,
                           int length,
                           MessageProp msgProp)
                    throws GSSException
        Allows to apply per-message security services over the established security context. The method will return a token with a cryptographic MIC and may optionally encrypt the specified inBuf. This method is equivalent i functionality to its stream counterpart. The returned byte array will contain both the MIC and the message. The msgProp object is used to specify a QOP value which selects cryptographic algorithms, and a privacy service, if supported by the chosen mechanism.

        Supports the wrapping and unwrapping of zero-length messages.

        The application will be responsible for sending the token to the peer.

        RFC 2078
        equivalent to gss_wrap; MessageProp object is used to select QOP and confidentiality
        Parameters:
        inBuf - the application data to be protected
        offset - the offset in the inBuf where the data begins
        length - the length of the data starting at offset
        msgPro - indicates the desired QOP and confidentiality state, and upon return the actual QOP and message confidentiality state
        Returns:
        buffer to be sent to the peer for processing by unwrap
        Throws:
        GSSException - with possible major codes of CONTEXT_EXPIRED, CREDENTIALS_EXPIRED, BAD_QOP, FAILURE.
        See Also:
        wrap(InputStream,OutputStream, MessageProp), unwrap(byte[],int,int,MessageProp), MessageProp
      • wrap

        public void wrap​(java.io.InputStream inBuf,
                         java.io.OutputStream outBuf,
                         MessageProp msgProp)
                  throws GSSException
        Allows to apply per-message security services over the established security context. The method will produce a token with a cryptographic MIC and may optionally encrypt the specified inBuf. The outBuf will contain both the MIC and the message. The msgProp object is used to specify a QOP value to select cryptographic algorithms, and a privacy service, if supported by the chosen mechanism.

        Supports the wrapping and unwrapping of zero-length messages.

        The application will be responsible for sending the token to the peer.

        RFC 2078
        equivalent to gss_wrap; MessageProp object is used to select QOP and confidentiality
        Parameters:
        inputBuf - the application data to be protected
        outputBuf - the token to be sent to the peer
        msgPro - indicates the desired QOP and confidentiality state, and upon return the actual QOP and message confidentiality state
        Throws:
        GSSException - with possible major codes of CONTEXT_EXPIRED, CREDENTIALS_EXPIRED, BAD_QOP, FAILURE.
        See Also:
        #wrap(byte,int,int,MessageProp), unwrap(InputStream,OutputStream,MessageProp), MessageProp
      • unwrap

        public byte[] unwrap​(byte[] inBuf,
                             int offset,
                             int length,
                             MessageProp msgProp)
                      throws GSSException
        Used by the peer application to process tokens generated with the wrap call. This call is equal in functionality to its stream counterpart. The method will return the message supplied in the peer application to the wrap call, verifying the embedded MIC. The msgProp instance will indicate whether the message was encrypted and will contain the QOP indicating the strength of protection that was used to provide the confidentiality and integrity services.

        Supports the wrapping and unwrapping of zero-length messages.

        RFC 2078
        equivalent to the gss_unwrap
        Parameters:
        inBuf - token received from peer application which was generated by call to wrap
        offset - within the inBuf where the token begins.
        length - The length of the token in inBuf.
        msgProp - Upon return from the this method, will contain QOP and privacy state of the supplied message as well as any supplementary status values.
        Returns:
        the application message used in the wrap call
        Throws:
        GSSException - with possible major codes of DEFECTIVE_TOKEN, BAD_SIG, CONTEXT_EXPIRED, CREDENTIALS_EXPIRED, and FAILURE.
        See Also:
        unwrap(InputStream,OutputStream,MessageProp), wrap(byte[],int,int,MessageProp), MessageProp
      • unwrap

        public void unwrap​(java.io.InputStream inBuf,
                           java.io.OutputStream outBuf,
                           MessageProp msgProp)
                    throws GSSException
        Used by the peer application to process tokens generated with the wrap call. This call is equal in functionality to its byte array counterpart. It will produce the message supplied in the peer application to the wrap call, verifying the embedded MIC. The msgProp parameter will indicate whether the message was encrypted and will contain the QOP indicating the strength of protection that was used to provide the confidentiality and integrity services. The msgProp object will also contain the supplementary status information for the token.

        Supports the wrapping and unwrapping of zero-length messages.

        RFC 2078
        equivalent to the gss_unwrap
        Parameters:
        inBuf - token received from peer application which was generated by call to wrap
        outBuf - original message passed into wrap
        msgProp - Upon return from the this method, will contain QOP and privacy state of the supplied message as well as any supplementary status values.
        Throws:
        GSSException - with possible major codes of DEFECTIVE_TOKEN, BAD_SIG, CONTEXT_EXPIRED, CREDENTIALS_EXPIRED, and FAILURE.
        See Also:
        unwrap(byte[],int,int,MessageProp), wrap(InputStream,OutputStream,MessageProp), MessageProp
      • getMIC

        public byte[] getMIC​(byte[] inMsg,
                             int offset,
                             int length,
                             MessageProp msgProp)
                      throws GSSException
        Returns a token containing a cryptographic MIC for the supplied message, for transfer to the peer application. Unlike wrap, which encapsulates the user message in the returned token, only the message MIC is returned in the output token. This method is identical in functionality to its stream counterpart.

        Note that privacy can only be applied through the wrap call.

        Supports the derivation of MICs from zero-length messages.

        RFC 2078
        equivalent to gss_getMIC
        Parameters:
        inBuf - message to apply security service to
        offset - The offset within the inMsg where the token begins.
        length - the length of the application message
        msgProp - Indicates the desired QOP to be used. Use QOP of 0 to indicate default value. The confidentiality flag is ignored. Upon return from this method, this object will contain the actual QOP applied (in case 0 was selected).
        Returns:
        token containing cryptographic information for the requested security service over the passed in message
        Throws:
        GSSException - with possible major codes of CONTEXT_EXPIRED, BAD_QOP, FAILURE.
        See Also:
        getMIC(InputStream,OutputStream,MessageProp), #verifyMIC(byte[],int,int,MessageProp), MessageProp
      • getMIC

        public void getMIC​(java.io.InputStream inBuf,
                           java.io.OutputStream outBuf,
                           MessageProp msgProp)
                    throws GSSException
        Produces a token containing a cryptographic MIC for the supplied message, for transfer to the peer application. Unlike wrap, which encapsulates the user message in the returned token, only the message MIC is produced in the output token. This method is identical in functionality to its byte array counterpart.

        Note that privacy can only be applied through the wrap call.

        Supports the derivation of MICs from zero-length messages.

        RFC 2078
        equivalent to gss_getMIC
        Parameters:
        inBuf - Buffer containing the message to generate MIC over.
        outBuf - The buffer to write the GSS-API output token into.
        msgProp - Indicates the desired QOP to be used. Use QOP of 0 to indicate default value. The confidentiality flag is ignored. Upon return from this method, this object will contain the actual QOP applied (in case 0 was selected).
        Throws:
        GSSException - with possible major codes of CONTEXT_EXPIRED, BAD_QOP, FAILURE.
        See Also:
        getMIC(byte[],int,int,MessageProp), verifyMIC(byte[],int,int,byte[],int,int,MessageProp), MessageProp
      • verifyMIC

        public void verifyMIC​(byte[] inTok,
                              int tokOffset,
                              int tokLen,
                              byte[] inMsg,
                              int msgOffset,
                              int msgLen,
                              MessageProp msgProp)
                       throws GSSException
        Verifies the cryptographic MIC, contained in the token parameter, over the supplied message. The msgProp parameter will contain the QOP indicating the strength of protection that was applied to the message and any supplementary status values for the token. This method is equivalent in functionality to its stream counterpart.

        RFC 2078
        equivalent to gss_verifyMIC
        Parameters:
        inTok - token generated by peer's getMIC method
        tokOffset - the offset within the inTok where the token begins
        tokLen - the length of the token
        inMsg - Application message to verify the Cryptographic MIC over.
        msgOffset - the offset within the inMsg where the message begins
        msgLen - the length of the message
        msgProp - upon return from this method, this object will contain the applied QOP and supplementary status values for the supplied token. The privacy state will always be set to false.
        Throws:
        GSSException - with possible major codes DEFECTIVE_TOKEN, BAD_SIG, CONTEXT_EXPIRED
        See Also:
        verifyMIC(InputStream,InputStream,MessageProp), wrap(byte[],int,int,MessageProp), MessageProp
      • verifyMIC

        public void verifyMIC​(java.io.InputStream inTok,
                              java.io.InputStream inMsg,
                              MessageProp msgProp)
                       throws GSSException
        Verifies the cryptographic MIC, contained in the token parameter, over the supplied message. The msgProp parameter will contain the QOP indicating the strength of protection that was applied to the message. This method is equivalent in functionality to its byte array counterpart.

        RFC 2078
        equivalent to gss_verifyMIC
        Parameters:
        inputTok - Contains the token generated by peer's getMIC method.
        inputMsg - Contains application message to verify the cryptographic MIC over.
        msgProp - upon return from this method, this object will contain the applied QOP and supplementary statustatus values for the supplied token. The privacy state will always be set to false.
        Throws:
        GSSException - with possible major codes DEFECTIVE_TOKEN, BAD_SIG, CONTEXT_EXPIRED
        See Also:
        verifyMIC(byte[],int,int,byte[],int,int,MessageProp), #wrap(InputStream,OutputStream), MessageProp
      • export

        public byte[] export()
                      throws GSSException
        Provided to support the sharing of work between multiple processes. This routine will typically be used by the context-acceptor, in an application where a single process receives incoming connection requests and accepts security contexts over them, then passes the established context to one or more other processes for message exchange.

        This method deactivates the security context and creates an interprocess token which, when passed to the byte array constructor of the GSSContext class in another process, will re-activate the context in the second process.

        Only a single instantiation of a given context may be active at any one time; a subsequent attempt by a context exporter to access the exported security context will fail.

        RFC 2078
        equivalent to gss_export_sec_context
        Returns:
        inter-process token representing the context in export form
        Throws:
        GSSException - with possible major codes of UNAVAILABLE, CONTEXT_EXPIRED, NO_CONTEXT, FAILURE.
        See Also:
        GSSContext(byte[]), isTransferable()
      • requestMutualAuth

        public void requestMutualAuth​(boolean state)
                               throws GSSException
        Sets the request state of the mutual authentication flag for the context. This method is only valid before the context creation process begins and only for the initiator.

        RFC 2078
        equivalent to the mutual_req_flag parameter in gss_init_sec_context
        Parameters:
        Boolean - representing if mutual authentication should be requested during context establishment.
        Throws:
        GSSException - may be thrown
        See Also:
        getMutualAuthState()
      • requestReplayDet

        public void requestReplayDet​(boolean state)
                              throws GSSException
        Sets the request state of the replay detection service for the context. This method is only valid before the context creation process begins and only for the initiator.

        RFC 2078
        equivalent to the replay_det_req_flag parameter in gss_init_sec_context
        Parameters:
        Boolean - representing if replay detection is desired over the established context.
        Throws:
        GSSException - may be thrown
        See Also:
        getReplayDetState()
      • requestSequenceDet

        public void requestSequenceDet​(boolean state)
                                throws GSSException
        Sets the request state of the sequence checking service for the context. This method is only valid before the context creation process begins and only for the initiator.

        RFC 2078
        equivalent to the sequence_req_flag parameter in gss_init_sec_context
        Parameters:
        Boolean - representing if sequence checking service is desired over the established context.
        Throws:
        GSSException - may be thrown
        See Also:
        getSequenceDetState()
      • requestCredDeleg

        public void requestCredDeleg​(boolean state)
                              throws GSSException
        Sets the request state of the credential delegation flag for the context. This method is only valid before the context creation process begins and only for the initiator.

        RFC 2078
        equivalent to the deleg_req_flag parameter in gss_init_sec_context
        Parameters:
        Boolean - representing if credential delegation is desired.
        Throws:
        GSSException - may be thrown
        See Also:
        getDelegCredState()
      • requestAnonymity

        public void requestAnonymity​(boolean state)
                              throws GSSException
        Requests anonymous support over the context. This method is only valid before the context creation process begins and only for the initiator.

        RFC 2078
        equivalent to anon_req_flag parameter in gss_init_sec_context
        Parameters:
        Boolean - representing if anonymity support is desired.
        Throws:
        GSSException - may be thrown
        See Also:
        getAnonymityState()
      • requestConf

        public void requestConf​(boolean state)
                         throws GSSException
        Requests that confidentiality service be available over the context. This method is only valid before the context creation process begins and only for the initiator.

        RFC 2078
        equivalent to the conf_req_flag parameter in gss_init_sec_context
        Parameters:
        Boolean - indicating if confidentiality services are to be requested for the context.
        Throws:
        GSSException - may be thrown
        See Also:
        getConfState()
      • requestInteg

        public void requestInteg​(boolean state)
                          throws GSSException
        Requests that integrity service be available over the context. This method is only valid before the context creation process begins and only for the initiator.

        RFC 2078
        equivalent to the integ_req_flag parameter in gss_init_sec_context
        Parameters:
        Boolean - indicating if integrity services are to be requested for the context.
        Throws:
        GSSException - may be thrown
        See Also:
        getIntegState()
      • requestLifetime

        public void requestLifetime​(int lifetime)
                             throws GSSException
        Sets the desired lifetime for the context in seconds. This method is only valid before the context creation process begins and only for the initiator.

        RFC 2078
        equivalent to the lifetime_req parameter in gss_init_sec_context
        Parameters:
        The - desired context lifetime in seconds.
        Throws:
        GSSException - may be thrown
        See Also:
        getLifetime()
      • setChannelBinding

        public void setChannelBinding​(ChannelBinding cb)
                               throws GSSException
        Sets the channel bindings to be used during context establishment. This method is only valid before the context creation process begins.

        RFC 2078
        equivalent to the chan_bindings parameter in gss_init_sec_context and gss_accept_sec_context
        Parameters:
        Channel - binding to be used.
        Throws:
        GSSException - may be thrown
        See Also:
        ChannelBinding
      • getDelegCredState

        public boolean getDelegCredState()
        Returns the state of the delegated credentials for the context. When issued before context establishment completes or when the isProtReady method returns false, it returns the desired state, otherwise it will indicate the actual state over the established context.

        RFC 2078
        equivalent to the deleg_state flag output parameter in gss_init_sec_context, gss_accept_sec_context and gss_inquire_context
        Returns:
        boolean indicating if delegated credentials are available
        See Also:
        requestCredDeleg(boolean), isProtReady()
      • getMutualAuthState

        public boolean getMutualAuthState()
        Returns the state of the mutual authentication option for the context. When issued before context establishment completes or when the isProtReady method returns false, it returns the desired state, otherwise it will indicate the actual state over the established context.

        RFC 2078
        equivalent to the mutual_state flag output parameter in gss_init_sec_context, gss_accept_sec_context and gss_inquire_context
        Returns:
        boolean indicating state of mutual authentication option
        See Also:
        requestMutualAuth(boolean), isProtReady()
      • getReplayDetState

        public boolean getReplayDetState()
        Returns the state of the replay detection service for the context. When issued before context establishment completes or when the isProtReady method returns false, it returns the desired state, otherwise it will indicate the actual state over the established context.

        RFC 2078
        equivalent to the replay_det_state flag output parameter in gss_init_sec_context, gss_accept_sec_context and gss_inquire_context
        Returns:
        boolean indicating replay detection state
        See Also:
        requestReplayDet(boolean), isProtReady()
      • getSequenceDetState

        public boolean getSequenceDetState()
        Returns the state of the sequence detection service for the context. When issued before context establishment completes or when the isProtReady method returns false, it returns the desired state, otherwise it will indicate the actual state over the established context.

        RFC 2078
        equivalent to the sequence_state flag output parameter in gss_init_sec_context, gss_accept_sec_context and gss_inquire_context
        Returns:
        boolean indicating sequence detection state
        See Also:
        requestSequenceDet(boolean), isProtReady()
      • getAnonymityState

        public boolean getAnonymityState()
        Returns true if this is an anonymous context. When issued before context establishment completes or when the isProtReady method returns false, it returns the desired state, otherwise it will indicate the actual state over the established context.

        RFC 2078
        equivalent to the anon_state flag output parameter in gss_init_sec_context, gss_accept_sec_context and gss_inquire_context
        Returns:
        boolean indicating anonymity state
        See Also:
        requestAnonymity(boolean), isProtReady()
      • isTransferable

        public boolean isTransferable()
                               throws GSSException
        Indicates if the context is transferable to other processes through the use of the export method. This call is only valid on fully established contexts.

        RFC 2078
        equivalent to the trans_state flag output parameter in gss_init_sec_context, gss_accept_sec_context and gss_inquire_context
        Returns:
        boolean indicating the transferability of the context
        Throws:
        GSSException - may be thrown
        See Also:
        export()
      • isProtReady

        public boolean isProtReady()
        Indicates if the per message operations can be applied over the context. Some mechanisms may allow to apply per-message operations before the context is fully established. This will also indicate that the get methods will return actual context state characteristics instead of the desired ones.

        RFC 2078
        equivalent to the prot_ready_state flag output parameter in gss_init_sec_context and gss_accept_sec_context
        Returns:
        boolean indicating if per message operations are available
      • getConfState

        public boolean getConfState()
        Returns the confidentiality service state over the context. When issued before context establishment completes or when the isProtReady method returns false, it returns the desired state, otherwise it will indicate the actual state over the established context.

        RFC 2078
        equivalent to the conf_avail flag output parameter in gss_init_sec_context, gss_accept_sec_context and gss_inquire_context
        Returns:
        boolean indicating confidentiality state
        See Also:
        requestConf(boolean), isProtReady()
      • getIntegState

        public boolean getIntegState()
        Returns the integrity service state over the context. When issued before context establishment completes or when the isProtReady method returns false, it returns the desired state, otherwise it will indicate the actual state over the established context.

        RFC 2078
        equivalent to the integ_avail flag output parameter in gss_init_sec_context, gss_accept_sec_context and gss_inquire_context
        Returns:
        boolean indicating integrity state
        See Also:
        requestInteg(boolean), isProtReady()
      • getLifetime

        public int getLifetime()
        Returns the context lifetime in seconds. When issued before context establishment completes or when the isProtReady method returns false, it returns the desired lifetime, otherwise it will indicate the actual lifetime over the established context.

        RFC 2078
        equivalent to the lifetime_rec output parameter in gss_init_sec_context, gss_accept_sec_context, gss_inquire_context and to gss_context_time call
        Returns:
        lifetime in seconds
        See Also:
        requestLifetime(int), isProtReady()
      • getSrcName

        public GSSName getSrcName()
                           throws GSSException
        Retrieves the name of the context initiator. This call is valid only after context has been fully established or when the isProtReady methods returns true.

        RFC 2078
        equivalent to the src_name parameter in gss_accept_sec_context and gss_inquire_context
        Returns:
        name of the context initiator
        Throws:
        GSSException - with possible major codes of CONTEXT_EXPIRED and FAILURE
        See Also:
        isProtReady()
      • getTargName

        public GSSName getTargName()
                            throws GSSException
        Retrieves the name of the context target (acceptor). This call is only valid on fully established contexts or when the isProtReady methods returns true.

        RFC 2078
        equivalent to the targ_name parameter in gss_inquire_context
        Returns:
        name of the context target (acceptor)
        Throws:
        GSSException - with possible major codes of CONTEXT_EXPIRED and FAILURE
        See Also:
        isProtReady()
      • getMech

        public Oid getMech()
                    throws GSSException
        Returns the mechanism oid for the context.

        RFC 2078
        equivalent to the mech_type parameter in gss_accept_sec_context and gss_inquire_context
        Returns:
        Oid object for the context's mechanism
        Throws:
        GSSException - may be thrown when the mechanism oid can't be determined
      • getDelegCred

        public GSSCredential getDelegCred()
                                   throws GSSException
        Returns the delegated credential object on the acceptor's side. To check for availability of delegated credentials call getDelegCredState. This call is only valid on fully established contexts.

        RFC 2078
        equivalent to delegated_cred_handle parameter in gss_accept_sec_context
        Returns:
        delegated credential object for the context
        Throws:
        GSSException - with possible major codes of CONTEXT_EXPIRED and FAILURE
        See Also:
        getDelegCredState()
      • isInitiator

        public boolean isInitiator()
                            throws GSSException
        Returns true if this is the initiator of the context. This call is only valid after the context creation process has started.

        RFC 2078
        equivalent to locally_initiated output parameter in gss_inquire_context
        Returns:
        true if this is the context initiator
        Throws:
        GSSException - with possible major codes of CONTEXT_EXPIRED and FAILURE