jboss-sasl 1.0.0.Beta1

org.jboss.sasl.digest
Class DigestMD5Server

java.lang.Object
  extended by org.jboss.sasl.digest.DigestMD5Server
All Implemented Interfaces:
SaslServer

public final class DigestMD5Server
extends Object
implements SaslServer

An implementation of the DIGEST-MD5 server SASL mechanism. (RFC 2831)

The DIGEST-MD5 SASL mechanism specifies two modes of authentication.

Required callbacks: - RealmCallback used as key by handler to fetch password - NameCallback used as key by handler to fetch password - PasswordCallback handler must enter password for username/realm supplied - AuthorizeCallback handler must verify that authid/authzids are allowed and set authorized ID to be the canonicalized authzid (if applicable). Environment properties that affect the implementation: javax.security.sasl.qop: specifies list of qops; default is "auth"; typically, caller should set this to "auth, auth-int, auth-conf". javax.security.sasl.strength specifies low/medium/high strength of encryption; default is all available ciphers [high,medium,low]; high means des3 or rc4 (128); medium des or rc4-56; low is rc4-40. javax.security.sasl.maxbuf specifies max receive buf size; default is 65536 javax.security.sasl.sendmaxbuffer specifies max send buf size; default is 65536 (min of this and client's max recv size) com.sun.security.sasl.digest.utf8: "true" means to use UTF-8 charset; "false" to use ISO-8859-1 encoding; default is "true". com.sun.security.sasl.digest.realm: space-separated list of realms; default is server name (fqdn parameter)

Author:
Rosanna Lee

Field Summary
protected  byte allQop
           
protected  String authzid
           
protected  CallbackHandler cbh
           
protected static byte[] CIPHER_MASKS
           
protected static String[] CIPHER_TOKENS
           
protected  boolean completed
           
protected static int DEFAULT_MAXBUF
           
protected static int DES
           
protected static byte DES_3_STRENGTH
           
protected static byte DES_STRENGTH
           
protected static int DES3
           
protected  String digestUri
           
protected static byte[] EMPTY_BYTE_ARRAY
           
protected  String encoding
           
protected  byte[] H_A1
           
protected static byte HIGH_STRENGTH
           
protected  boolean integrity
           
protected static byte INTEGRITY_ONLY_PROTECTION
           
protected static byte LOW_STRENGTH
           
protected static int MAX_CHALLENGE_LENGTH
           
protected static int MAX_RESPONSE_LENGTH
           
protected static String MAX_SEND_BUF
           
protected static byte MEDIUM_STRENGTH
           
protected  String myClassName
           
protected  String negotiatedCipher
           
protected  String negotiatedQop
           
protected  String negotiatedRealm
           
protected  String negotiatedStrength
           
protected static byte NO_PROTECTION
           
protected  byte[] nonce
           
protected  boolean privacy
           
protected static byte PRIVACY_PROTECTION
           
protected  byte[] qop
           
protected  int rawSendSize
           
protected static int RC4
           
protected static int RC4_40
           
protected static byte RC4_40_STRENGTH
           
protected static int RC4_56
           
protected static byte RC4_56_STRENGTH
           
protected static byte RC4_STRENGTH
           
protected  int recvMaxBufSize
           
protected  org.jboss.sasl.digest.SecurityCtx secCtx
           
protected  int sendMaxBufSize
           
protected  int step
           
protected  byte[] strength
           
protected static byte UNSET
           
protected  boolean useUTF8
           
 
Method Summary
protected  byte[] binaryToHex(byte[] digest)
          Convert a byte array to hexadecimal string.
protected static byte combineMasks(byte[] in)
           
 void dispose()
           
 byte[] evaluateResponse(byte[] response)
           
protected static byte findPreferredMask(byte pref, byte[] in)
           
protected static byte[] generateNonce()
           
protected  byte[] generateResponseValue(String authMethod, String digestUriValue, String qopValue, String usernameValue, String realmValue, char[] passwdValue, byte[] nonceValue, byte[] cNonceValue, int nonceCount, byte[] authzidValue)
          Assembles response-value for digest-response.
 String getAuthorizationID()
           
 String getMechanismName()
          Retrieves the SASL mechanism IANA name.
 Object getNegotiatedProperty(String propName)
          Retrieves the negotiated property.
protected static byte[] getPlatformCiphers()
           
protected static void intToNetworkByteOrder(int num, byte[] buf, int start, int count)
          Encodes an integer into 4 bytes in network byte order in the buffer supplied.
 boolean isComplete()
          Determines whether this mechanism has completed.
protected static int networkByteOrderToInt(byte[] buf, int start, int count)
          Returns the integer represented by 4 bytes in network byte order.
protected static String nonceCountToHex(int count)
          Takes 'nonceCount' value and returns HEX value of the value.
protected static byte[][] parseDirectives(byte[] buf, String[] keyTable, List<byte[]> realmChoices, int realmIndex)
          Parses digest-challenge string, extracting each token and value(s)
protected static byte[] parseQop(String qop, String[] saveTokens, boolean ignore)
           
protected static String quotedStringValue(String str)
           
protected  byte[] stringToByte_8859_1(String str)
          Used to convert username-value, passwd or realm to 8859_1 encoding if all chars in string are within the 8859_1 (Latin 1) encoding range.
 byte[] unwrap(byte[] incoming, int start, int len)
          Unwrap the incoming message using the wrap method of the secCtx object instance.
 byte[] wrap(byte[] outgoing, int start, int len)
          Wrap outgoing bytes using the wrap method of the secCtx object instance.
protected static void writeQuotedStringValue(ByteArrayOutputStream out, byte[] buf)
          Checks if a byte[] contains characters that must be quoted and write the resulting, possibly escaped, characters to out.
 
Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
 
Methods inherited from interface javax.security.sasl.SaslServer
dispose, getMechanismName, getNegotiatedProperty, isComplete, unwrap, wrap
 

Field Detail

MAX_CHALLENGE_LENGTH

protected static final int MAX_CHALLENGE_LENGTH
See Also:
Constant Field Values

MAX_RESPONSE_LENGTH

protected static final int MAX_RESPONSE_LENGTH
See Also:
Constant Field Values

DEFAULT_MAXBUF

protected static final int DEFAULT_MAXBUF
See Also:
Constant Field Values

DES3

protected static final int DES3
See Also:
Constant Field Values

RC4

protected static final int RC4
See Also:
Constant Field Values

DES

protected static final int DES
See Also:
Constant Field Values

RC4_56

protected static final int RC4_56
See Also:
Constant Field Values

RC4_40

protected static final int RC4_40
See Also:
Constant Field Values

CIPHER_TOKENS

protected static final String[] CIPHER_TOKENS

DES_3_STRENGTH

protected static final byte DES_3_STRENGTH
See Also:
Constant Field Values

RC4_STRENGTH

protected static final byte RC4_STRENGTH
See Also:
Constant Field Values

DES_STRENGTH

protected static final byte DES_STRENGTH
See Also:
Constant Field Values

RC4_56_STRENGTH

protected static final byte RC4_56_STRENGTH
See Also:
Constant Field Values

RC4_40_STRENGTH

protected static final byte RC4_40_STRENGTH
See Also:
Constant Field Values

UNSET

protected static final byte UNSET
See Also:
Constant Field Values

CIPHER_MASKS

protected static final byte[] CIPHER_MASKS

EMPTY_BYTE_ARRAY

protected static final byte[] EMPTY_BYTE_ARRAY

step

protected int step

cbh

protected CallbackHandler cbh

secCtx

protected org.jboss.sasl.digest.SecurityCtx secCtx

H_A1

protected byte[] H_A1

nonce

protected byte[] nonce

negotiatedStrength

protected String negotiatedStrength

negotiatedCipher

protected String negotiatedCipher

negotiatedQop

protected String negotiatedQop

negotiatedRealm

protected String negotiatedRealm

useUTF8

protected boolean useUTF8

encoding

protected String encoding

digestUri

protected String digestUri

authzid

protected String authzid

completed

protected boolean completed

privacy

protected boolean privacy

integrity

protected boolean integrity

qop

protected byte[] qop

allQop

protected byte allQop

strength

protected byte[] strength

sendMaxBufSize

protected int sendMaxBufSize

recvMaxBufSize

protected int recvMaxBufSize

rawSendSize

protected int rawSendSize

myClassName

protected String myClassName

MAX_SEND_BUF

protected static final String MAX_SEND_BUF
See Also:
Constant Field Values

NO_PROTECTION

protected static final byte NO_PROTECTION
See Also:
Constant Field Values

INTEGRITY_ONLY_PROTECTION

protected static final byte INTEGRITY_ONLY_PROTECTION
See Also:
Constant Field Values

PRIVACY_PROTECTION

protected static final byte PRIVACY_PROTECTION
See Also:
Constant Field Values

LOW_STRENGTH

protected static final byte LOW_STRENGTH
See Also:
Constant Field Values

MEDIUM_STRENGTH

protected static final byte MEDIUM_STRENGTH
See Also:
Constant Field Values

HIGH_STRENGTH

protected static final byte HIGH_STRENGTH
See Also:
Constant Field Values
Method Detail

evaluateResponse

public byte[] evaluateResponse(byte[] response)
                        throws SaslException
Specified by:
evaluateResponse in interface SaslServer
Throws:
SaslException

getAuthorizationID

public String getAuthorizationID()
Specified by:
getAuthorizationID in interface SaslServer

getMechanismName

public String getMechanismName()
Retrieves the SASL mechanism IANA name.

Returns:
The String "DIGEST-MD5"

unwrap

public byte[] unwrap(byte[] incoming,
                     int start,
                     int len)
              throws SaslException
Unwrap the incoming message using the wrap method of the secCtx object instance.

Parameters:
incoming - The byte array containing the incoming bytes.
start - The offset from which to read the byte array.
len - The number of bytes to read from the offset.
Returns:
The unwrapped message according to either the integrity or privacy quality-of-protection specifications.
Throws:
SaslException - if an error occurs when unwrapping the incoming message

wrap

public byte[] wrap(byte[] outgoing,
                   int start,
                   int len)
            throws SaslException
Wrap outgoing bytes using the wrap method of the secCtx object instance.

Parameters:
outgoing - The byte array containing the outgoing bytes.
start - The offset from which to read the byte array.
len - The number of bytes to read from the offset.
Returns:
The wrapped message according to either the integrity or privacy quality-of-protection specifications.
Throws:
SaslException - if an error occurs when wrapping the outgoing message

dispose

public void dispose()
             throws SaslException
Throws:
SaslException

getNegotiatedProperty

public Object getNegotiatedProperty(String propName)
Retrieves the negotiated property.


generateNonce

protected static byte[] generateNonce()

writeQuotedStringValue

protected static void writeQuotedStringValue(ByteArrayOutputStream out,
                                             byte[] buf)
Checks if a byte[] contains characters that must be quoted and write the resulting, possibly escaped, characters to out.


quotedStringValue

protected static String quotedStringValue(String str)

binaryToHex

protected byte[] binaryToHex(byte[] digest)
                      throws UnsupportedEncodingException
Convert a byte array to hexadecimal string.

Parameters:
digest - a non-null byte array
Returns:
a non-null String contain the HEX value
Throws:
UnsupportedEncodingException

stringToByte_8859_1

protected byte[] stringToByte_8859_1(String str)
                              throws SaslException
Used to convert username-value, passwd or realm to 8859_1 encoding if all chars in string are within the 8859_1 (Latin 1) encoding range.

Parameters:
str - a non-null String
Returns:
a non-null byte array containing the correct character encoding for username, paswd or realm.
Throws:
SaslException

getPlatformCiphers

protected static byte[] getPlatformCiphers()

generateResponseValue

protected byte[] generateResponseValue(String authMethod,
                                       String digestUriValue,
                                       String qopValue,
                                       String usernameValue,
                                       String realmValue,
                                       char[] passwdValue,
                                       byte[] nonceValue,
                                       byte[] cNonceValue,
                                       int nonceCount,
                                       byte[] authzidValue)
                                throws NoSuchAlgorithmException,
                                       IOException
Assembles response-value for digest-response.

Parameters:
authMethod - "AUTHENTICATE" for client-generated response; "" for server-generated response
Returns:
A non-null byte array containing the repsonse-value.
Throws:
NoSuchAlgorithmException - if the platform does not have MD5 digest support.
UnsupportedEncodingException - if a an error occurs encoding a string into either Latin-1 or UTF-8.
IOException - if an error occurs writing to the output byte array buffer.

nonceCountToHex

protected static String nonceCountToHex(int count)
Takes 'nonceCount' value and returns HEX value of the value.

Returns:
A non-null String representing the current NONCE-COUNT

parseDirectives

protected static byte[][] parseDirectives(byte[] buf,
                                          String[] keyTable,
                                          List<byte[]> realmChoices,
                                          int realmIndex)
                                   throws SaslException
Parses digest-challenge string, extracting each token and value(s)

Parameters:
buf - A non-null digest-challenge string.
multipleAllowed - true if multiple qop or realm or QOP directives are allowed.
Throws:
SaslException - if the buf cannot be parsed according to RFC 2831

isComplete

public boolean isComplete()
Determines whether this mechanism has completed.

Returns:
true if has completed; false otherwise;

combineMasks

protected static final byte combineMasks(byte[] in)

findPreferredMask

protected static final byte findPreferredMask(byte pref,
                                              byte[] in)

parseQop

protected static final byte[] parseQop(String qop,
                                       String[] saveTokens,
                                       boolean ignore)
                                throws SaslException
Throws:
SaslException

networkByteOrderToInt

protected static final int networkByteOrderToInt(byte[] buf,
                                                 int start,
                                                 int count)
Returns the integer represented by 4 bytes in network byte order.


intToNetworkByteOrder

protected static final void intToNetworkByteOrder(int num,
                                                  byte[] buf,
                                                  int start,
                                                  int count)
Encodes an integer into 4 bytes in network byte order in the buffer supplied.


jboss-sasl 1.0.0.Beta1

Copyright © 2011 JBoss, a division of Red Hat, Inc.. All Rights Reserved.