Serializable
, Destroyable
, Refreshable
public class KerberosTicket extends Object implements Destroyable, Refreshable, Serializable
All Kerberos JAAS login modules that authenticate a user to a KDC should use this class. Where available, the login module might even read this information from a ticket cache in the operating system instead of directly communicating with the KDC. During the commit phase of the JAAS authentication process, the JAAS login module should instantiate this class and store the instance in the private credential set of a Subject
.
It might be necessary for the application to be granted a PrivateCredentialPermission
if it needs to access a KerberosTicket
instance from a Subject
. This permission is not needed when the application depends on the default JGSS Kerberos mechanism to access the KerberosTicket
. In that case, however, the application will need an appropriate ServicePermission
.
Note that this class is applicable to both ticket granting tickets and other regular service tickets. A ticket granting ticket is just a special case of a more generalized service ticket.
Constructor | Description |
---|---|
KerberosTicket |
Constructs a KerberosTicket using credentials information that a client either receives from a KDC or reads from a cache. |
Modifier and Type | Method | Description |
---|---|---|
void |
destroy() |
Destroys the ticket and destroys any sensitive information stored in it. |
boolean |
equals |
Compares the specified object with this KerberosTicket for equality. |
final Date |
getAuthTime() |
Returns the time that the client was authenticated. |
final KerberosPrincipal |
getClient() |
Returns the client principal associated with this ticket. |
final InetAddress[] |
getClientAddresses() |
Returns a list of addresses from where the ticket can be used. |
final byte[] |
getEncoded() |
Returns an ASN.1 encoding of the entire ticket. |
final Date |
getEndTime() |
Returns the expiration time for this ticket's validity period. |
final boolean[] |
getFlags() |
Returns the flags associated with this ticket. |
final Date |
getRenewTill() |
Returns the latest expiration time for this ticket, including all renewals. |
final KerberosPrincipal |
getServer() |
Returns the service principal associated with this ticket. |
final SecretKey |
getSessionKey() |
Returns the session key associated with this ticket. |
final int |
getSessionKeyType() |
Returns the key type of the session key associated with this ticket as defined by the Kerberos Protocol Specification. |
final Date |
getStartTime() |
Returns the start time for this ticket's validity period. |
int |
hashCode() |
Returns a hash code for this KerberosTicket . |
boolean |
isCurrent() |
Determines if this ticket is still current. |
boolean |
isDestroyed() |
Determines if this ticket has been destroyed. |
final boolean |
isForwardable() |
Determines if this ticket is forwardable. |
final boolean |
isForwarded() |
Determines if this ticket had been forwarded or was issued based on authentication involving a forwarded ticket-granting ticket. |
final boolean |
isInitial() |
Determines if this ticket was issued using the Kerberos AS-Exchange protocol, and not issued based on some ticket-granting ticket. |
final boolean |
isPostdated() |
Determines is this ticket is post-dated. |
final boolean |
isProxiable() |
Determines if this ticket is proxiable. |
final boolean |
isProxy() |
Determines is this ticket is a proxy-ticket. |
final boolean |
isRenewable() |
Determines is this ticket is renewable. |
void |
refresh() |
Extends the validity period of this ticket. |
String |
toString() |
Returns an informative textual representation of this KerberosTicket . |
public KerberosTicket(byte[] asn1Encoding, KerberosPrincipal client, KerberosPrincipal server, byte[] sessionKey, int keyType, boolean[] flags, Date authTime, Date startTime, Date endTime, Date renewTill, InetAddress[] clientAddresses)
KerberosTicket
using credentials information that a client either receives from a KDC or reads from a cache.asn1Encoding
- the ASN.1 encoding of the ticket as defined by the Kerberos protocol specification.client
- the client that owns this service ticketserver
- the service that this ticket is forsessionKey
- the raw bytes for the session key that must be used to encrypt the authenticator that will be sent to the serverkeyType
- the key type for the session key as defined by the Kerberos protocol specification.flags
- the ticket flags. Each element in this array indicates the value for the corresponding bit in the ASN.1 BitString that represents the ticket flags. If the number of elements in this array is less than the number of flags used by the Kerberos protocol, then the missing flags will be filled in with false.authTime
- the time of initial authentication for the clientstartTime
- the time after which the ticket will be valid. This may be null in which case the value of authTime is treated as the startTime.endTime
- the time after which the ticket will no longer be validrenewTill
- an absolute expiration time for the ticket, including all renewal that might be possible. This field may be null for tickets that are not renewable.clientAddresses
- the addresses from where the ticket may be used by the client. This field may be null when the ticket is usable from any address.public final KerberosPrincipal getClient()
null
if destroyed.public final KerberosPrincipal getServer()
null
if destroyed.public final SecretKey getSessionKey()
EncryptionKey
object.IllegalStateException
- if this ticket is destroyedpublic final int getSessionKeyType()
IllegalStateException
- if this ticket is destroyedpublic final boolean isForwardable()
public final boolean isForwarded()
public final boolean isProxiable()
public final boolean isProxy()
public final boolean isPostdated()
public final boolean isRenewable()
refresh
method can be called, assuming the validity period for renewing is not already over.public final boolean isInitial()
public final boolean[] getFlags()
null
if destroyed.public final Date getAuthTime()
null
if the field is not set or this ticket is destroyed.public final Date getStartTime()
null
if the field is not set or this ticket is destroyed.public final Date getEndTime()
null
if destroyed.public final Date getRenewTill()
null
if destroyed.public final InetAddress[] getClientAddresses()
null
if the field was not provided or this ticket is destroyed.public final byte[] getEncoded()
IllegalStateException
- if this ticket is destroyedpublic boolean isCurrent()
isCurrent
in interface Refreshable
public void refresh() throws RefreshFailedException
refresh
in interface Refreshable
IllegalStateException
- if this ticket is destroyedRefreshFailedException
- if the ticket is not renewable, or the latest allowable renew time has passed, or the KDC returns some error.public void destroy() throws DestroyFailedException
destroy
in interface Destroyable
DestroyFailedException
- if the destroy operation fails.public boolean isDestroyed()
isDestroyed
in interface Destroyable
Object
has been destroyed, false otherwise.public String toString()
KerberosTicket
.public int hashCode()
KerberosTicket
.public boolean equals(Object other)
KerberosTicket
for equality. Returns true if the given object is also a KerberosTicket
and the two KerberosTicket
instances are equivalent. A destroyed KerberosTicket
object is only equal to itself.
© 1993, 2023, Oracle and/or its affiliates. All rights reserved.
Documentation extracted from Debian's OpenJDK Development Kit package.
Licensed under the GNU General Public License, version 2, with the Classpath Exception.
Various third party code in OpenJDK is licensed under different licenses (see Debian package).
Java and OpenJDK are trademarks or registered trademarks of Oracle and/or its affiliates.
https://docs.oracle.com/en/java/javase/21/docs/api/java.security.jgss/javax/security/auth/kerberos/KerberosTicket.html