org.jboss.sasl.digest

Class DigestMD5Client

java.lang.Object

org.jboss.sasl.digest.AbstractSaslImpl

org.jboss.sasl.digest.DigestMD5Base

org.jboss.sasl.digest.DigestMD5Client

All Implemented Interfaces:

javax.security.sasl.SaslClient

final class DigestMD5Client
extends DigestMD5Base
implements javax.security.sasl.SaslClient

An implementation of the DIGEST-MD5 (RFC 2831) SASL (RFC 2222) mechanism. The DIGEST-MD5 SASL mechanism specifies two modes of authentication. - Initial Authentication - Subsequent Authentication - optional, (currently unsupported) Required callbacks: - RealmChoiceCallback shows user list of realms server has offered; handler must choose one from list - RealmCallback shows user the only realm server has offered or none; handler must enter realm to use - NameCallback handler must enter username to use for authentication - PasswordCallback handler must enter password for username to use for authentication Environment properties that affect behavior of implementation: javax.security.sasl.qop quality of protection; list of auth, auth-int, auth-conf; default is "auth" javax.security.sasl.strength auth-conf strength; list of high, medium, low; default is highest available on platform ["high,medium,low"]. high means des3 or rc4 (128); medium des or rc4-56; low is rc4-40; choice of cipher depends on its availablility on platform javax.security.sasl.maxbuf max receive buffer size; default is 65536 javax.security.sasl.sendmaxbuffer max send buffer size; default is 65536; (min with server max recv size) com.sun.security.sasl.digest.cipher name a specific cipher to use; setting must be compatible with the setting of the javax.security.sasl.strength property.

See Also:

RFC 2222 - Simple Authentication and Security Layer (SASL), RFC 2831 - Using Digest Authentication as a SASL Mechanism, Java(TM) Cryptography Extension 1.2.1 (JCE), Java(TM) Authentication and Authorization Service (JAAS)

Nested Class Summary

Nested classes/interfaces inherited from class org.jboss.sasl.digest.DigestMD5Base

DigestMD5Base.DigestIntegrity, DigestMD5Base.DigestPrivacy

Field Summary

Fields

Modifier and Type	Field and Description
private static int	ALGORITHM
private byte[]	authzidBytes
private static int	CHARSET
private static int	CIPHER
private static java.lang.String	CIPHER_PROPERTY
private byte[]	cnonce
private java.lang.String	digestUri
private static java.lang.String[]	DIRECTIVE_KEY
private static org.jboss.logging.Logger	log
private static int	MAXBUF
private static java.lang.String	MY_CLASS_NAME
private static int	NONCE
private int	nonceCount
private char[]	passwd
private byte[]	preDigested
private boolean	preDigestedPasswords Should the impl request and use pre-digested passwords instead of generating the {username : realm : password} hash?
private static int	QOP
private static int	REALM
private static int	RESPONSE_AUTH
private java.lang.String	specifiedCipher
private static int	STALE
private java.lang.String	username

Fields inherited from class org.jboss.sasl.digest.DigestMD5Base

authzid, cbh, CIPHER_MASKS, CIPHER_TOKENS, DEFAULT_MAXBUF, DES, DES_3_STRENGTH, DES_STRENGTH, DES3, EMPTY_BYTE_ARRAY, encoding, H_A1, MAX_CHALLENGE_LENGTH, MAX_RESPONSE_LENGTH, negotiatedCipher, negotiatedQop, negotiatedRealm, negotiatedStrength, nonce, PRE_DIGESTED_PROPERTY, RC4, RC4_40, RC4_40_STRENGTH, RC4_56, RC4_56_STRENGTH, RC4_STRENGTH, secCtx, step, UNSET, useUTF8

Fields inherited from class org.jboss.sasl.digest.AbstractSaslImpl

allQop, completed, HIGH_STRENGTH, integrity, INTEGRITY_ONLY_PROTECTION, LOW_STRENGTH, MAX_SEND_BUF, MEDIUM_STRENGTH, myClassName, NO_PROTECTION, privacy, PRIVACY_PROTECTION, qop, rawSendSize, recvMaxBufSize, sendMaxBufSize, strength

Constructor Summary

Constructors

Constructor and Description
DigestMD5Client(java.lang.String authzid, java.lang.String protocol, java.lang.String serverName, java.util.Map props, javax.security.auth.callback.CallbackHandler cbh) Constructor for DIGEST-MD5 mechanism.

Method Summary

Modifier and Type	Method and Description
private void	checkQopSupport(byte[] qopInChallenge, byte[] ciphersInChallenge) Parses the 'qop' directive.
private void	checkStrengthSupport(byte[] ciphersInChallenge) Processes the 'cipher' digest-challenge directive.
private void	clearPassword()
byte[]	evaluateChallenge(byte[] challengeData) Process the challenge data.
private java.lang.String	findCipherAndStrength(byte[] supportedCiphers, java.lang.String[] tokens) Steps through the ordered 'strength' array, and compares it with the 'supportedCiphers' array.
private byte[]	generateClientResponse(byte[] charset) Returns digest-response suitable for an initial authentication.
private static int	getNonceCount(byte[] nonceValue) Returns the number of requests (including current request) that the client has sent in response to nonceValue.
boolean	hasInitialResponse() DIGEST-MD5 has no initial response
private void	processChallenge(byte[][] challengeVal, java.util.List<byte[]> realmChoices) Record information from the challengeVal array into variables/fields.
private void	validateResponseValue(byte[] fromServer) From RFC 2831, Section 2.1.3: Step Three [Server] sends a message formatted as follows: response-auth = "rspauth" "=" response-value where response-value is calculated as above, using the values sent in step two, except that if qop is "auth", then A2 is A2 = { ":", digest-uri-value } And if qop is "auth-int" or "auth-conf" then A2 is A2 = { ":", digest-uri-value, ":00000000000000000000000000000000" }

Methods inherited from class org.jboss.sasl.digest.DigestMD5Base

binaryToHex, dispose, generateNonce, generateResponseValue, generateResponseValue, getMechanismName, getNegotiatedProperty, getPlatformCiphers, nonceCountToHex, parseDirectives, quotedStringValue, unwrap, wrap, writeQuotedStringValue

Methods inherited from class org.jboss.sasl.digest.AbstractSaslImpl

combineMasks, findPreferredMask, intToNetworkByteOrder, isComplete, networkByteOrderToInt, parseQop

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface javax.security.sasl.SaslClient

dispose, getMechanismName, getNegotiatedProperty, isComplete, unwrap, wrap

Field Detail

MY_CLASS_NAME

private static final java.lang.String MY_CLASS_NAME

CIPHER_PROPERTY

private static final java.lang.String CIPHER_PROPERTY

See Also:

Constant Field Values

DIRECTIVE_KEY

private static final java.lang.String[] DIRECTIVE_KEY

REALM

private static final int REALM

See Also:

Constant Field Values

QOP

private static final int QOP

See Also:

Constant Field Values

ALGORITHM

private static final int ALGORITHM

See Also:

Constant Field Values

NONCE

private static final int NONCE

See Also:

Constant Field Values

MAXBUF

private static final int MAXBUF

See Also:

Constant Field Values

CHARSET

private static final int CHARSET

See Also:

Constant Field Values

CIPHER

private static final int CIPHER

See Also:

Constant Field Values

RESPONSE_AUTH

private static final int RESPONSE_AUTH

See Also:

Constant Field Values

STALE

private static final int STALE

See Also:

Constant Field Values

log

private static final org.jboss.logging.Logger log

nonceCount

private int nonceCount

specifiedCipher

private java.lang.String specifiedCipher

cnonce

private byte[] cnonce

username

private java.lang.String username

passwd

private char[] passwd

preDigested

private byte[] preDigested

authzidBytes

private byte[] authzidBytes

preDigestedPasswords

private boolean preDigestedPasswords

Should the impl request and use pre-digested passwords instead of generating the {username : realm : password} hash?

digestUri

private final java.lang.String digestUri

Constructor Detail

DigestMD5Client

DigestMD5Client(java.lang.String authzid,
                java.lang.String protocol,
                java.lang.String serverName,
                java.util.Map props,
                javax.security.auth.callback.CallbackHandler cbh)
         throws javax.security.sasl.SaslException

Constructor for DIGEST-MD5 mechanism.

Parameters:

authzid - A non-null String representing the principal for which authorization is being granted..

digestURI - A non-null String representing detailing the combined protocol and host being used for authentication.

props - The possibly null properties to be used by the SASL mechanism to configure the authentication exchange.

cbh - The non-null CallbackHanlder object for callbacks

Throws:

javax.security.sasl.SaslException - if no authentication ID or password is supplied

Method Detail

hasInitialResponse

public boolean hasInitialResponse()

DIGEST-MD5 has no initial response

Specified by:

hasInitialResponse in interface javax.security.sasl.SaslClient

Returns:

false

evaluateChallenge

public byte[] evaluateChallenge(byte[] challengeData)
                         throws javax.security.sasl.SaslException

Process the challenge data. The server sends a digest-challenge which the client must reply to in a digest-response. When the authentication is complete, the completed field is set to true.

Specified by:

evaluateChallenge in interface javax.security.sasl.SaslClient

Parameters:

challengeData - A non-null byte array containing the challenge data from the server.

Returns:

A possibly null byte array containing the response to be sent to the server.

Throws:

javax.security.sasl.SaslException - If the platform does not have MD5 digest support or if the server sends an invalid challenge.

processChallenge

private void processChallenge(byte[][] challengeVal,
                              java.util.List<byte[]> realmChoices)
                       throws javax.security.sasl.SaslException,
                              java.io.UnsupportedEncodingException

Record information from the challengeVal array into variables/fields. Check directive values that are multi-valued and ensure that mandatory directives not missing from the digest-challenge.

Throws:

javax.security.sasl.SaslException - if a sasl is a the mechanism cannot correcly handle a callbacks or if a violation in the digest challenge format is detected.

java.io.UnsupportedEncodingException

checkQopSupport

private void checkQopSupport(byte[] qopInChallenge,
                             byte[] ciphersInChallenge)
                      throws java.io.IOException

Parses the 'qop' directive. If 'auth-conf' is specified by the client and offered as a QOP option by the server, then a check is client-side supported ciphers is performed.

Throws:

java.io.IOException

checkStrengthSupport

private void checkStrengthSupport(byte[] ciphersInChallenge)
                           throws java.io.IOException

Processes the 'cipher' digest-challenge directive. This allows the mechanism to check for client-side support against the list of supported ciphers send by the server. If no match is found, the mechanism aborts.

Throws:

javax.security.sasl.SaslException - If an error is encountered in processing the cipher digest-challenge directive or if no client-side support is found.

java.io.IOException

findCipherAndStrength

private java.lang.String findCipherAndStrength(byte[] supportedCiphers,
                                               java.lang.String[] tokens)

Steps through the ordered 'strength' array, and compares it with the 'supportedCiphers' array. The cipher returned represents the best possible cipher based on the strength preference and the available ciphers on both the server and client environments.

Parameters:

tokens - The array of cipher tokens sent by server

Returns:

The agreed cipher.

generateClientResponse

private byte[] generateClientResponse(byte[] charset)
                               throws java.io.IOException

Returns digest-response suitable for an initial authentication. The following are qdstr-val (quoted string values) as per RFC 2831, which means that any embedded quotes must be escaped. realm-value nonce-value username-value cnonce-value authzid-value

Throws:

javax.security.sasl.SaslException - if there is an error generating the response value or the cnonce value.

java.io.IOException

validateResponseValue

private void validateResponseValue(byte[] fromServer)
                            throws javax.security.sasl.SaslException

From RFC 2831, Section 2.1.3: Step Three [Server] sends a message formatted as follows: response-auth = "rspauth" "=" response-value where response-value is calculated as above, using the values sent in step two, except that if qop is "auth", then A2 is A2 = { ":", digest-uri-value } And if qop is "auth-int" or "auth-conf" then A2 is A2 = { ":", digest-uri-value, ":00000000000000000000000000000000" }

Throws:

javax.security.sasl.SaslException

getNonceCount

private static int getNonceCount(byte[] nonceValue)

Returns the number of requests (including current request) that the client has sent in response to nonceValue. This is 1 the first time nonceValue is seen. We don't cache nonce values seen, and we don't support subsequent authentication, so the value is always 1.

clearPassword

private void clearPassword()