java.lang.Object
- com.sun.security.auth.module.Krb5LoginModule

All Implemented Interfaces:

LoginModule
```
public class Krb5LoginModule
extends Object
implements LoginModule
```
此LoginModule使用Kerberos协议对用户进行身份验证。
Krb5LoginModule的配置条目有几个选项可以控制身份验证过程，并添加到Subject的私有凭据集。不考虑这些选项， Subject的主体集和私有凭证集仅在commit时更新。当commit ， KerberosPrincipal被添加到Subject的主体集合（除非principal被指定为“*”）。如果isInitiator是真的，那么KerberosTicket被添加到Subject的私有凭据。

如果KerberosLoginModule的配置条目的选项为storeKey设置为true，那么KerberosKey或KeyTab也将添加到主体的私有凭据。 KerberosKey ，校长的密钥将来自用户的密码，而KeyTab是useKeyTab设置为true时使用的密钥表。 KeyTab对象被限制为由指定的主体使用，除非主体值为“*”。

此LoginModule识别doNotPrompt选项。如果设置为true，则不会提示用户输入密码。

用户可以使用配置条目中的选项ticketCache来指定ticketCache单缓存的位置。

用户可以使用配置条目中的选项keyTab指定密钥表位置。

可以使用选项principal在配置条目中指定主体名称。主体名称可以是简单的用户名，服务名称，如host/mission.eng.sun.com或“*”。 sun.security.krb5.principal也可以使用系统属性sun.security.krb5.principal进行设置。此登录过程中检查此属性。如果未设置此属性，则使用配置中的主体名称。在未设置主体属性并且主体条目也不存在的情况下，将提示用户输入名称。当此条目的属性设置为useTicketCache ，仅使用属于此主体的TGT。

以下是Krb5LoginModule支持的配置选项列表：

refreshKrb5Config:

Set this to true, if you want the configuration to be refreshed before the login method is called.

useTicketCache:

Set this to true, if you want the TGT to be obtained from the ticket cache. Set this option to false if you do not want this module to use the ticket cache. (Default is False). This module will search for the ticket cache in the following locations: On Solaris and Linux it will look for the ticket cache in /tmp/krb5cc_ uid where the uid is numeric user identifier. If the ticket cache is not available in the above location, or if we are on a Windows platform, it will look for the cache as {user.home}{file.separator}krb5cc_{user.name}. You can override the ticket cache location by using ticketCache. For Windows, if a ticket cannot be retrieved from the file ticket cache, it will use Local Security Authority (LSA) API to get the TGT.

ticketCache:

Set this to the name of the ticket cache that contains user's TGT. If this is set, useTicketCache must also be set to true; Otherwise a configuration error will be returned.

renewTGT:

Set this to true, if you want to renew the TGT when it's more than half-way expired (the time until expiration is less than the time since start time). If this is set, useTicketCache must also be set to true; otherwise a configuration error will be returned.

doNotPrompt:

Set this to true if you do not want to be prompted for the password if credentials can not be obtained from the cache, the keytab, or through shared state.(Default is false) If set to true, credential must be obtained through cache, keytab, or shared state. Otherwise, authentication will fail.

useKeyTab:

Set this to true if you want the module to get the principal's key from the the keytab.(default value is False) If keytab is not set then the module will locate the keytab from the Kerberos configuration file. If it is not specified in the Kerberos configuration file then it will look for the file {user.home}{file.separator}krb5.keytab.

keyTab:

Set this to the file name of the keytab to get principal's secret key.

storeKey:

Set this to true to if you want the keytab or the principal's key to be stored in the Subject's private credentials. For isInitiator being false, if principal is "*", the KeyTab stored can be used by anyone, otherwise, it's restricted to be used by the specified principal only.

principal:

The name of the principal that should be used. The principal can be a simple username such as " testuser" or a service name such as " host/testhost.eng.sun.com". You can use the principal option to set the principal when there are credentials for multiple principals in the keyTab or when you want a specific ticket cache only. The principal can also be set using the system property sun.security.krb5.principal. In addition, if this system property is defined, then it will be used. If this property is not set, then the principal name from the configuration will be used. The principal name can be set to "*" when isInitiator is false. In this case, the acceptor is not bound to a single principal. It can act as any principal an initiator requests if keys for that principal can be found. When isInitiator is true, the principal name cannot be set to "*".

isInitiator:

Set this to true, if initiator. Set this to false, if acceptor only. (Default is true). Note: Do not set this value to false for initiators.

此LoginModule还可以识别以下额外的Configuration选项，使您能够在不同的身份验证模块之间共享用户名和密码：

useFirstPass:

if, true, this LoginModule retrieves the username and password from the module's shared state, using "javax.security.auth.login.name" and "javax.security.auth.login.password" as the respective keys. The retrieved values are used for authentication. If authentication fails, no attempt for a retry is made, and the failure is reported back to the calling application.

tryFirstPass:

if, true, this LoginModule retrieves the the username and password from the module's shared state using "javax.security.auth.login.name" and "javax.security.auth.login.password" as the respective keys. The retrieved values are used for authentication. If authentication fails, the module uses the CallbackHandler to retrieve a new username and password, and another attempt to authenticate is made. If the authentication fails, the failure is reported back to the calling application

storePass:

if, true, this LoginModule stores the username and password obtained from the CallbackHandler in the modules shared state, using "javax.security.auth.login.name" and "javax.security.auth.login.password" as the respective keys. This is not performed if existing values already exist for the username and password in the shared state, or if authentication fails.

clearPass:

if, true, this LoginModule clears the username and password stored in the module's shared state after both phases of authentication (login and commit) have completed.

如果已经提供了主体系统属性或键，共享状态中的“javax.security.auth.login.name”值将被忽略。

当提供多个检索机票或密钥的机制时，优先级顺序为：
1. 票缓存
2. 密钥表
3. 共享状态
4. 用户提示
请注意，如果任何步骤失败，它将回退到下一步。只有一个例外，如果共享状态步骤失败，并且useFirstPass = true没有用户提示。

在JAAS配置文件中Krb5LoginModule的某些配置值的示例，其结果如下：
doNotPrompt = true
This is an illegal combination since none of useTicketCache, useKeyTab, useFirstPass and tryFirstPass is set and the user can not be prompted for the password.

ticketCache = <filename>
This is an illegal combination since useTicketCache is not set to true and the ticketCache is set. A configuration error will occur.

renewTGT = true
This is an illegal combination since useTicketCache is not set to true and renewTGT is set. A configuration error will occur.

storeKey = true useTicketCache = true doNotPrompt = true
This is an illegal combination since storeKey is set to true but the key can not be obtained either by prompting the user or from the keytab, or from the shared state. A configuration error will occur.

keyTab = <filename> doNotPrompt = true
This is an illegal combination since useKeyTab is not set to true and the keyTab is set. A configuration error will occur.

debug = true
Prompt the user for the principal name and the password. Use the authentication exchange to get TGT from the KDC and populate the Subject with the principal and TGT. Output debug messages.

useTicketCache = true doNotPrompt = true
Check the default cache for TGT and populate the Subject with the principal and TGT. If the TGT is not available, do not prompt the user, instead fail the authentication.

principal = <name> useTicketCache = true doNotPrompt = true
Get the TGT from the default cache for the principal and populate the Subject's principal and private creds set. If ticket cache is not available or does not contain the principal's TGT authentication will fail.

useTicketCache = true ticketCache = <file name> useKeyTab = true keyTab = <keytab filename> principal = <principal name> doNotPrompt = true
Search the cache for the principal's TGT. If it is not available use the key in the keytab to perform authentication exchange with the KDC and acquire the TGT. The Subject will be populated with the principal and the TGT. If the key is not available or valid then authentication will fail.

useTicketCache = true ticketCache = <filename>
The TGT will be obtained from the cache specified. The Kerberos principal name used will be the principal name in the Ticket cache. If the TGT is not available in the ticket cache the user will be prompted for the principal name and the password. The TGT will be obtained using the authentication exchange with the KDC. The Subject will be populated with the TGT.

useKeyTab = true keyTab=<keytab filename> principal = <principal name> storeKey = true
The key for the principal will be retrieved from the keytab. If the key is not available in the keytab the user will be prompted for the principal's password. The Subject will be populated with the principal's key either from the keytab or derived from the password entered.

useKeyTab = true keyTab = <keytabname> storeKey = true doNotPrompt = false
The user will be prompted for the service principal name. If the principal's longterm key is available in the keytab , it will be added to the Subject's private credentials. An authentication exchange will be attempted with the principal name and the key from the Keytab. If successful the TGT will be added to the Subject's private credentials set. Otherwise the authentication will fail.

isInitiator = false useKeyTab = true keyTab = <keytabname> storeKey = true principal = *
The acceptor will be an unbound acceptor and it can act as any principal as long that principal has keys in the keytab.

useTicketCache = true ticketCache = <file name> useKeyTab = true keyTab = <file name> storeKey = true principal = <principal name>
The client's TGT will be retrieved from the ticket cache and added to the Subject's private credentials. If the TGT is not available in the ticket cache, or the TGT's client name does not match the principal name, Java will use a secret key to obtain the TGT using the authentication exchange and added to the Subject's private credentials. This secret key will be first retrieved from the keytab. If the key is not available, the user will be prompted for the password. In either case, the key derived from the password will be added to the Subject's private credentials set.

isInitiator = false
Configured to act as acceptor only, credentials are not acquired via AS exchange. For acceptors only, set this value to false. For initiators, do not set this value to false.

isInitiator = true
Configured to act as initiator, credentials are acquired via AS exchange. For initiators, set this value to true, or leave this option unset, in which case default value (true) will be used.

构造方法摘要

构造方法
Constructor	描述
`Krb5LoginModule()`

方法摘要

所有方法接口方法具体的方法
Modifier and Type	方法	描述
`boolean`	`abort()`	如果LoginContext的整体身份验证失败，则调用此方法。
`boolean`	`commit()`	如果LoginContext的整体身份验证成功（相关的请求，REQUISITE，SUPPICIENT和可选LoginModules成功），则调用此方法。
`void`	`initialize(Subject subject, CallbackHandler callbackHandler, Map<String,?> sharedState, Map<String,?> options)`	初始化 `LoginModule` 。
`boolean`	`login()`	验证用户
`boolean`	`logout()`	注销用户。

Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

- 构造方法详细信息
  - Krb5LoginModule
```
public Krb5LoginModule()
```
- 方法详细信息
  - initialize
```
public void initialize(Subject subject,
                       CallbackHandler callbackHandler,
                       Map<String,?> sharedState,
                       Map<String,?> options)
```
    初始化这个 LoginModule 。
    
    Specified by:
    
    initialize在接口 LoginModule
    
    参数
    
    subject - 要验证的 Subject 。
    
    callbackHandler - 用于与最终用户通信的 CallbackHandler （例如提示用户名和密码）。
    
    sharedState - 共享 LoginModule状态。
    
    options - 在特定 LoginModule的登录 Configuration指定的选项。
  - login
```
public boolean login()
              throws LoginException
```
    验证用户
    
    Specified by:
    
    login在接口 LoginModule
    
    结果
    
    在所有情况下都是真实的，因为这个 LoginModule不应该被忽略。
    
    异常
    
    FailedLoginException - 如果认证失败。
    
    LoginException - 如果这个 LoginModule无法执行认证。
  - commit
```
public boolean commit()
               throws LoginException
```
    如果LoginContext的整体身份验证成功（相关的请求，REQUISITE，SUPPICIENT和可选LoginModules成功），则调用此方法。
    如果此LoginModule自己的身份验证尝试成功（通过检索由login方法保存的私有状态进行检查），则此方法将Krb5Principal与位于Subject中的LoginModule相关联。它将Kerberos凭据添加到主体的私有凭据集中。如果此LoginModule自身的身份验证尝试失败，则此方法将删除原始保存的任何状态。
    
    Specified by:
    
    commit在接口 LoginModule
    
    结果
    
    如果此LoginModule自己的登录和提交尝试成功，则为true，否则为false。
    
    异常
    
    LoginException - 如果提交失败。
  - abort
```
public boolean abort()
              throws LoginException
```
    如果LoginContext的整体身份验证失败，则调用此方法。（相关要求，必要，有效和可选的LoginModules没有成功）。
    如果此LoginModule自己的身份验证尝试成功（通过检索由login和commit方法保存的私有状态检查），则此方法将清除最初保存的任何状态。
    
    Specified by:
    
    abort在接口 LoginModule
    
    结果
    
    如果此LoginModule自己的登录和/或提交尝试失败，则为false，否则为true。
    
    异常
    
    LoginException - 如果中止失败。
  - logout
```
public boolean logout()
               throws LoginException
```
    注销用户。
    这种方法消除了Krb5Principal ，是由加入的commit方法。
    
    Specified by:
    
    logout在接口 LoginModule
    
    结果
    
    在所有情况下都是这样，因为这个 LoginModule不应该被忽略。
    
    异常
    
    LoginException - 如果注销失败。

Class Krb5LoginModule

构造方法摘要

方法摘要

Methods inherited from class java.lang.Object

构造方法详细信息

Krb5LoginModule

方法详细信息

initialize

login

commit

abort

logout