1 /* 2 * Copyright (c) 2014, 2018, Oracle and/or its affiliates. All rights reserved. 3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. 4 * 5 * This code is free software; you can redistribute it and/or modify it 6 * under the terms of the GNU General Public License version 2 only, as 7 * published by the Free Software Foundation. 8 * 9 * This code is distributed in the hope that it will be useful, but WITHOUT 10 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License 12 * version 2 for more details (a copy is included in the LICENSE file that 13 * accompanied this code). 14 * 15 * You should have received a copy of the GNU General Public License version 16 * 2 along with this work; if not, write to the Free Software Foundation, 17 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. 18 * 19 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA 20 * or visit www.oracle.com if you need additional information or have any 21 * questions. 22 */ 23 24 /* 25 * @test 26 * @bug 8022582 8194486 27 * @summary Relax response flags checking in sun.security.krb5.KrbKdcRep.check. 28 * @library /test/lib 29 * @compile -XDignore.symbol.file ForwardableCheck.java 30 * @run main jdk.test.lib.FileInstaller TestHosts TestHosts 31 * @run main/othervm -Djdk.net.hosts.file=TestHosts ForwardableCheck 32 */ 33 34 import org.ietf.jgss.GSSException; 35 import sun.security.jgss.GSSUtil; 36 37 import java.util.Arrays; 38 39 public class ForwardableCheck { 40 main(String[] args)41 public static void main(String[] args) throws Exception { 42 OneKDC kdc = new OneKDC(null); 43 kdc.writeJAASConf(); 44 45 // USER can impersonate someone else 46 kdc.setOption(KDC.Option.ALLOW_S4U2SELF, 47 Arrays.asList(OneKDC.USER + "@" + OneKDC.REALM)); 48 // USER2 is sensitive 49 kdc.setOption(KDC.Option.SENSITIVE_ACCOUNTS, 50 Arrays.asList(OneKDC.USER2 + "@" + OneKDC.REALM)); 51 52 Context c; 53 54 // USER2 is sensitive but it's still able to get a normal ticket 55 c = Context.fromUserPass(OneKDC.USER2, OneKDC.PASS2, false); 56 57 // ... and connect to another account 58 c.startAsClient(OneKDC.USER, GSSUtil.GSS_KRB5_MECH_OID); 59 c.x().requestCredDeleg(true); 60 c.x().requestMutualAuth(false); 61 62 c.take(new byte[0]); 63 64 if (!c.x().isEstablished()) { 65 throw new Exception("Context should have been established"); 66 } 67 68 // ... but will not be able to delegate itself 69 if (c.x().getCredDelegState()) { 70 throw new Exception("Impossible"); 71 } 72 73 // Although USER is allowed to impersonate other people, 74 // it cannot impersonate USER2 coz it's sensitive. 75 c = Context.fromUserPass(OneKDC.USER, OneKDC.PASS, false); 76 try { 77 c.impersonate(OneKDC.USER2); 78 throw new Exception("Should fail"); 79 } catch (GSSException e) { 80 e.printStackTrace(); 81 } 82 } 83 } 84