|
||||||||||
| PREV CLASS NEXT CLASS | FRAMES NO FRAMES | |||||||||
| SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD | |||||||||
java.lang.Object![]()
![]()
![]()
javax.security.auth.kerberos.KerberosTicket
, Destroyable
, Refreshable

public class KerberosTicket

, Refreshable
, Serializable

This class encapsulates a Kerberos ticket and associated information as viewed from the client's point of view. It captures all information that the Key Distribution Center (KDC) sends to the client in the reply message KDC-REP defined in the Kerberos Protocol Specification (RFC 1510).
All Kerberos JAAS login modules that authenticate a user to a KDC should
use this class. Where available, the login module might even read this
information from a ticket cache in the operating system instead of
directly communicating with the KDC. During the commit phase of the JAAS
authentication process, the JAAS login module should instantiate this
class and store the instance in the private credential set of a
Subject
.
It might be necessary for the application to be granted a
PrivateCredentialPermission
if it needs to access a KerberosTicket
instance from a Subject. This permission is not needed when the
application depends on the default JGSS Kerberos mechanism to access the
KerberosTicket. In that case, however, the application will need an
appropriate
ServicePermission
.
Note that this class is applicable to both ticket granting tickets and other regular service tickets. A ticket granting ticket is just a special case of a more generalized service ticket.
Subject
,
PrivateCredentialPermission
,
LoginContext
,
GSSCredential
,
GSSManager
,
Serialized Form| Constructor Summary | |
|---|---|
KerberosTicket
Constructs a KerberosTicket using credentials information that a client either receives from a KDC or reads from a cache. |
|
| Method Summary | |
|---|---|
void |
destroy
Destroys the ticket and destroys any sensitive information stored in it. |
Date |
getAuthTime
Returns the time that the client was authenticated. |
KerberosPrincipal |
getClient
Returns the client principal associated with this ticket. |
InetAddress |
getClientAddresses
Returns a list of addresses from where the ticket can be used. |
byte[] |
getEncoded
Returns an ASN.1 encoding of the entire ticket. |
Date |
getEndTime
Returns the expiration time for this ticket's validity period. |
boolean[] |
getFlags
Returns the flags associated with this ticket. |
Date |
getRenewTill
Returns the latest expiration time for this ticket, including all renewals. |
KerberosPrincipal |
getServer
Returns the service principal associated with this ticket. |
javax.crypto.SecretKey |
getSessionKey
Returns the session key associated with this ticket. |
int |
getSessionKeyType
Returns the key type of the session key associated with this ticket as defined by the Kerberos Protocol Specification. |
Date |
getStartTime
Returns the start time for this ticket's validity period. |
boolean |
isCurrent
Determines if this ticket is still current. |
boolean |
isDestroyed
Determines if this ticket has been destroyed. |
boolean |
isForwardable
Determines if this ticket is forwardable. |
boolean |
isForwarded
Determines if this ticket had been forwarded or was issued based on authentication involving a forwarded ticket-granting ticket. |
boolean |
isInitial
Determines if this ticket was issued using the Kerberos AS-Exchange protocol, and not issued based on some ticket-granting ticket. |
boolean |
isPostdated
Determines is this ticket is post-dated. |
boolean |
isProxiable
Determines if this ticket is proxiable. |
boolean |
isProxy
Determines is this ticket is a proxy-ticket. |
boolean |
isRenewable
Determines is this ticket is renewable. |
void |
refresh
Extends the validity period of this ticket. |
String |
toString
Returns a string representation of the object. |
Methods inherited from class java.lang.Object ![]() |
|---|
clone |
| Constructor Detail |
|---|

public KerberosTicket(byte[] asn1Encoding,
KerberosPrincipal
client,
KerberosPrincipal
server,
byte[] sessionKey,
int keyType,
boolean[] flags,
Date
authTime,
Date
startTime,
Date
endTime,
Date
renewTill,
InetAddress
[] clientAddresses)
asn1Encoding - the ASN.1 encoding of the ticket as defined by
the Kerberos protocol specification.client - the client that owns this service
ticketserver - the service that this ticket is forsessionKey - the raw bytes for the session key that must be
used to encrypt the authenticator that will be sent to the serverkeyType - the key type for the session key as defined by the
Kerberos protocol specification.flags - the ticket flags. Each element in this array indicates
the value for the corresponding bit in the ASN.1 BitString that
represents the ticket flags. If the number of elements in this array
is less than the number of flags used by the Kerberos protocol,
then the missing flags will be filled in with false.authTime - the time of initial authentication for the clientstartTime - the time after which the ticket will be valid. This
may be null in which case the value of authTime is treated as the
startTime.endTime - the time after which the ticket will no longer be
validrenewTill - an absolute expiration time for the ticket,
including all renewal that might be possible. This field may be null
for tickets that are not renewable.clientAddresses - the addresses from where the ticket may be
used by the client. This field may be null when the ticket is usable
from any address.| Method Detail |
|---|

public final KerberosPrincipal![]()
![]()
getClient()

public final KerberosPrincipal![]()
![]()
getServer()

public final javax.crypto.SecretKey getSessionKey()

public final int getSessionKeyType()
getSessionKey()


public final boolean isForwardable()

public final boolean isForwarded()

public final boolean isProxiable()

public final boolean isProxy()

public final boolean isPostdated()

public final boolean isRenewable()
refresh
method can be called, assuming the validity period for
renewing is not already over.

public final boolean isInitial()

public final boolean[] getFlags()

public final Date![]()
![]()
getAuthTime()

public final Date![]()
![]()
getStartTime()

public final Date![]()
![]()
getEndTime()

public final Date![]()
![]()
getRenewTill()

public final InetAddress![]()
![]()
[] getClientAddresses()

public final byte[] getEncoded()

public boolean isCurrent()
isCurrent

in interface Refreshable

Object is currently current,
false otherwise.

public void refresh()
throws RefreshFailedException

refresh

in interface Refreshable

RefreshFailedException

- if the ticket is not renewable, or
the latest allowable renew time has passed, or the KDC returns some
error.isRenewable()
,
getRenewTill()


public void destroy()
throws DestroyFailedException

destroy

in interface Destroyable

DestroyFailedException

- if the destroy operation fails.

public boolean isDestroyed()
isDestroyed

in interface Destroyable

Object has been destroyed,
false otherwise.

public String![]()
![]()
toString()
Object

toString method returns a string that
"textually represents" this object. The result should
be a concise but informative representation that is easy for a
person to read.
It is recommended that all subclasses override this method.
The toString method for class Object
returns a string consisting of the name of the class of which the
object is an instance, the at-sign character `@', and
the unsigned hexadecimal representation of the hash code of the
object. In other words, this method returns a string equal to the
value of:
getClass().getName() + '@' + Integer.toHexString(hashCode())
toString

in class Object

|
||||||||||
| PREV CLASS NEXT CLASS | FRAMES NO FRAMES | |||||||||
| SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD | |||||||||