| Frames | No Frames |
1: /* SaslServer.java 2: Copyright (C) 2003, 2005, Free Software Foundation, Inc. 3: 4: This file is part of GNU Classpath. 5: 6: GNU Classpath is free software; you can redistribute it and/or modify 7: it under the terms of the GNU General Public License as published by 8: the Free Software Foundation; either version 2, or (at your option) 9: any later version. 10: 11: GNU Classpath is distributed in the hope that it will be useful, but 12: WITHOUT ANY WARRANTY; without even the implied warranty of 13: MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14: General Public License for more details. 15: 16: You should have received a copy of the GNU General Public License 17: along with GNU Classpath; see the file COPYING. If not, write to the 18: Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 19: 02110-1301 USA. 20: 21: Linking this library statically or dynamically with other modules is 22: making a combined work based on this library. Thus, the terms and 23: conditions of the GNU General Public License cover the whole 24: combination. 25: 26: As a special exception, the copyright holders of this library give you 27: permission to link this library with independent modules to produce an 28: executable, regardless of the license terms of these independent 29: modules, and to copy and distribute the resulting executable under 30: terms of your choice, provided that you also meet, for each linked 31: independent module, the terms and conditions of the license of that 32: module. An independent module is a module which is not derived from 33: or based on this library. If you modify this library, you may extend 34: this exception to your version of the library, but you are not 35: obligated to do so. If you do not wish to do so, delete this 36: exception statement from your version. */ 37: 38: 39: package javax.security.sasl; 40: 41: /** 42: * <p>Performs SASL authentication as a server.</p> 43: * 44: * <p>A server such as an LDAP server gets an instance of this class in order to 45: * perform authentication defined by a specific SASL mechanism. Invoking methods 46: * on the <code>SaslServer</code> instance generates challenges corresponding to 47: * the SASL mechanism implemented by the <code>SaslServer</code> instance. As 48: * the authentication proceeds, the instance encapsulates the state of a SASL 49: * server's authentication exchange.</p> 50: * 51: * <p>Here's an example of how an LDAP server might use a <code>SaslServer</code> 52: * instance. It first gets an instance of a <code>SaslServer</code> for the SASL 53: * mechanism requested by the client:</p> 54: * 55: * <pre> 56: *SaslServer ss = 57: * Sasl.createSaslServer(mechanism, "ldap", myFQDN, props, callbackHandler); 58: * </pre> 59: * 60: * <p>It can then proceed to use the server for authentication. For example, 61: * suppose the LDAP server received an LDAP BIND request containing the name of 62: * the SASL mechanism and an (optional) initial response. It then might use the 63: * server as follows:</p> 64: * 65: * <pre> 66: *while (!ss.isComplete()) { 67: * try { 68: * byte[] challenge = ss.evaluateResponse(response); 69: * if (ss.isComplete()) { 70: * status = ldap.sendBindResponse(mechanism, challenge, SUCCESS); 71: * } else { 72: * status = ldap.sendBindResponse(mechanism, challenge, SASL_BIND_IN_PROGRESS); 73: * response = ldap.readBindRequest(); 74: * } 75: * } catch (SaslException x) { 76: * status = ldap.sendErrorResponse(x); 77: * break; 78: * } 79: *} 80: *if (ss.isComplete() && (status == SUCCESS)) { 81: * String qop = (String) sc.getNegotiatedProperty(Sasl.QOP); 82: * if (qop != null 83: * && (qop.equalsIgnoreCase("auth-int") 84: * || qop.equalsIgnoreCase("auth-conf"))) { 85: * // Use SaslServer.wrap() and SaslServer.unwrap() for future 86: * // communication with client 87: * ldap.in = new SecureInputStream(ss, ldap.in); 88: * ldap.out = new SecureOutputStream(ss, ldap.out); 89: * } 90: *} 91: * </pre> 92: * 93: * @see Sasl 94: * @see SaslServerFactory 95: * 96: * @since 1.5 97: */ 98: public interface SaslServer 99: { 100: 101: /** 102: * Returns the IANA-registered mechanism name of this SASL server (e.g. 103: * "CRAM-MD5", "GSSAPI"). 104: * 105: * @return a non-null string representing the IANA-registered mechanism name. 106: */ 107: String getMechanismName(); 108: 109: /** 110: * Evaluates the response data and generates a challenge. If a response is 111: * received from the client during the authentication process, this method is 112: * called to prepare an appropriate next challenge to submit to the client. 113: * The challenge is <code>null</code> if the authentication has succeeded and 114: * no more challenge data is to be sent to the client. It is non-null if the 115: * authentication must be continued by sending a challenge to the client, or 116: * if the authentication has succeeded but challenge data needs to be 117: * processed by the client. {@link #isComplete()} should be called after each 118: * call to <code>evaluateResponse()</code>,to determine if any further 119: * response is needed from the client. 120: * 121: * @param response the non-null (but possibly empty) response sent by the 122: * client. 123: * @return the possibly <code>null</code> challenge to send to the client. 124: * It is <code>null</code> if the authentication has succeeded and there is 125: * no more challenge data to be sent to the client. 126: * @throws SaslException if an error occurred while processing the response 127: * or generating a challenge. 128: */ 129: byte[] evaluateResponse(byte[] response) throws SaslException; 130: 131: /** 132: * Determines if the authentication exchange has completed. This method is 133: * typically called after each invocation of {@link #evaluateResponse(byte[])} 134: * to determine whether the authentication has completed successfully or 135: * should be continued. 136: * 137: * @return <code>true</code> if the authentication exchange has completed; 138: * <code>false</code> otherwise. 139: */ 140: boolean isComplete(); 141: 142: /** 143: * Reports the authorization ID in effect for the client of this session This 144: * method can only be called if {@link #isComplete()} returns <code>true</code>. 145: * 146: * @return the authorization ID of the client. 147: * @throws IllegalStateException if this authentication session has not 148: * completed. 149: */ 150: String getAuthorizationID(); 151: 152: /** 153: * <p>Unwraps a byte array received from the client. This method can be called 154: * only after the authentication exchange has completed (i.e., when 155: * {@link #isComplete()} returns <code>true</code>) and only if the 156: * authentication exchange has negotiated integrity and/or privacy as the 157: * quality of protection; otherwise, an {@link IllegalStateException} is 158: * thrown.</p> 159: * 160: * <p><code>incoming</code> is the contents of the SASL buffer as defined in 161: * RFC 2222 without the leading four octet field that represents the length. 162: * <code>offset</code> and <code>len</code> specify the portion of incoming 163: * to use.</p> 164: * 165: * @param incoming a non-null byte array containing the encoded bytes from 166: * the client. 167: * @param offset the starting position at <code>incoming</code> of the bytes 168: * to use. 169: * @param len the number of bytes from <code>incoming</code> to use. 170: * @return a non-null byte array containing the decoded bytes. 171: * @throws SaslException if <code>incoming</code> cannot be successfully 172: * unwrapped. 173: * @throws IllegalStateException if the authentication exchange has not 174: * completed, or if the negotiated quality of protection has neither 175: * integrity nor privacy. 176: */ 177: byte[] unwrap(byte[] incoming, int offset, int len) throws SaslException; 178: 179: /** 180: * <p>Wraps a byte array to be sent to the client. This method can be called 181: * only after the authentication exchange has completed (i.e., when 182: * {@link #isComplete()} returns <code>true</code>) and only if the 183: * authentication exchange has negotiated integrity and/or privacy as the 184: * quality of protection; otherwise, an {@link IllegalStateException} is 185: * thrown.</p> 186: * 187: * <p>The result of this method will make up the contents of the SASL buffer 188: * as defined in RFC 2222 without the leading four octet field that 189: * represents the length. <code>offset</code> and <code>len</code> specify 190: * the portion of <code>outgoing</code> to use. 191: * 192: * @param outgoing a non-null byte array containing the bytes to encode. 193: * @param offset the starting position at <code>outgoing</code> of the bytes 194: * to use. 195: * @param len the number of bytes from <code>outgoing</code> to use. 196: * @return a non-null byte array containing the encoded bytes. 197: * @throws SaslException if <code>outgoing</code> cannot be successfully 198: * wrapped. 199: * @throws IllegalStateException if the authentication exchange has not 200: * completed, or if the negotiated quality of protection has neither 201: * integrity nor privacy. 202: */ 203: byte[] wrap(byte[] outgoing, int offset, int len) throws SaslException; 204: 205: /** 206: * Retrieves the negotiated property. This method can be called only after 207: * the authentication exchange has completed (i.e., when 208: * {@link #isComplete()} returns <code>true</code>); otherwise, an 209: * {@link IllegalStateException} is thrown. 210: * 211: * @return the value of the negotiated property. If <code>null</code>, the 212: * property was not negotiated or is not applicable to this mechanism. 213: * @throws IllegalStateException if this authentication exchange has not 214: * completed. 215: */ 216: Object getNegotiatedProperty(String propName); 217: 218: /** 219: * Disposes of any system resources or security-sensitive information the 220: * <code>SaslServer</code> might be using. Invoking this method invalidates 221: * the <code>SaslServer</code> instance. This method is idempotent. 222: * 223: * @throws SaslException if a problem was encountered while disposing of the 224: * resources. 225: */ 226: void dispose() throws SaslException; 227: }