Re: [security-dev 00429]: Request for comment: How to enable credentials delegation in HTTP Negotiate?

[Max (Weijun) Wang]

Ping again, any suggestions?

Thanks
Max
On Nov 25, 2008, at 3:01 PM, Weijun Wang wrote:

Hi All

The current implementation of HTTP Negotiate authentication has not
enabled credential delegation (it simply acquires a new one using  
either
a cached TGT or username/password from Authenticator). This means that
in a multi-tier application, a middle tier cannot start an HTTP  
request
(to the backend server) on behalf of the client.

Currently, java.net.Authenticator can only authenticate using a  
username/password pair, but cannot use an established credential.


I'm suggesting the following updates:

1. In java.net.Authenticator, add 2 methods

   protected GSSCredential getGSSCredential() { // To be overrided
       return null;
   }
   public static GSSCredential requestGSSCredential() {
       Authenticator a = theAuthenticator;
       if (a == null) {
           return null;
       } else {
           return a.getGSSCredential();
       }
   }

2. In the implementation of the HTTP Negotiate auth scheme
(sun.net.www.protocol.http.NegotiatorImpl),

   GSSCredential deleg = Authenticator.requestGSSCredential();
   context = manager.createContext(serverName,
                                   oid,
                                   deleg,   // this used to be null
                                   GSSContext.DEFAULT_LIFETIME);

Then, when an application developer is creating a GSS server that  
wants
to start an HTTP request using a delegated credential, she can write:

   // establish the GSSContext
   final GSSCredential deleg = context.getDelegCred();
   Authenticator.setDefault(new Authenticator() {
           @Override
           protected GSSCredential getGSSCredential() {
               return deleg;
           }
   });
   new URL("http://somewhere";).openConnection().getInputStream();

What's your comment?

Thanks
Max