org.apache.kerby.kerberos.kerb.server.preauth

Interface KdcPreauth

All Superinterfaces:

PreauthPluginMeta

All Known Implementing Classes:

AbstractPreauthPlugin, EncTsPreauth, PkinitPreauth, TgtPreauth, TokenPreauth

public interface KdcPreauth
extends PreauthPluginMeta

KDC side preauth plugin module

Method Summary

Methods

Modifier and Type	Method and Description
void	destroy() When exiting...
PaFlags	getFlags(KdcRequest kdcRequest, PluginRequestContext requestContext, org.apache.kerby.kerberos.kerb.type.pa.PaDataType paType) Return PA_REAL if pa_type is a real preauthentication type or PA_INFO if it is an informational type.
PluginRequestContext	initRequestContext(KdcRequest kdcRequest) Initializing request context
void	initWith(KdcContext context) Initializing plugin context for each realm
void	provideEdata(KdcRequest kdcRequest, PluginRequestContext requestContext, org.apache.kerby.kerberos.kerb.type.pa.PaData outPaData) Optional: provide pa_data to send to the client as part of the "you need to use preauthentication" error.
void	providePaData(KdcRequest kdcRequest, PluginRequestContext requestContext, org.apache.kerby.kerberos.kerb.type.pa.PaData paData) Optional: generate preauthentication response data to send to the client as part of the AS-REP.
boolean	verify(KdcRequest kdcRequest, PluginRequestContext requestContext, org.apache.kerby.kerberos.kerb.type.pa.PaDataEntry paData) Optional: verify preauthentication data sent by the client, setting the TKT_FLG_PRE_AUTH or TKT_FLG_HW_AUTH flag in the enc_tkt_reply's "flags" field as appropriate.

Methods inherited from interface org.apache.kerby.kerberos.kerb.preauth.PreauthPluginMeta

getName, getPaTypes, getVersion

Method Detail

initWith

void initWith(KdcContext context)

Initializing plugin context for each realm

Parameters:

context - kdc context

initRequestContext

PluginRequestContext initRequestContext(KdcRequest kdcRequest)

Initializing request context

Parameters:

kdcRequest - kdc context

Returns:

request context

provideEdata

void provideEdata(KdcRequest kdcRequest,
                PluginRequestContext requestContext,
                org.apache.kerby.kerberos.kerb.type.pa.PaData outPaData)
                  throws KrbException

Optional: provide pa_data to send to the client as part of the "you need to use preauthentication" error.

Parameters:

kdcRequest - kdc request

requestContext - request context

outPaData - out preauthentication data

Throws:

KrbException - e

verify

boolean verify(KdcRequest kdcRequest,
             PluginRequestContext requestContext,
             org.apache.kerby.kerberos.kerb.type.pa.PaDataEntry paData)
               throws KrbException

Optional: verify preauthentication data sent by the client, setting the TKT_FLG_PRE_AUTH or TKT_FLG_HW_AUTH flag in the enc_tkt_reply's "flags" field as appropriate.

Parameters:

kdcRequest - kdc request

requestContext - request context

paData - preauthentication data

Returns:

true if verify success

Throws:

KrbException - e

providePaData

void providePaData(KdcRequest kdcRequest,
                 PluginRequestContext requestContext,
                 org.apache.kerby.kerberos.kerb.type.pa.PaData paData)

Optional: generate preauthentication response data to send to the client as part of the AS-REP.

Parameters:

kdcRequest - kdc request

requestContext - request context

paData - preauthentication data

getFlags

PaFlags getFlags(KdcRequest kdcRequest,
               PluginRequestContext requestContext,
               org.apache.kerby.kerberos.kerb.type.pa.PaDataType paType)

Return PA_REAL if pa_type is a real preauthentication type or PA_INFO if it is an informational type.

Parameters:

kdcRequest - kdc request

requestContext - request context

paType - preauthentication type

Returns:

PaFlags

destroy

void destroy()

When exiting...