Subject: The promised code fragment

From: Michael Smith <[email-masked]>
Date: Fri, 14 May 1999 13:08:26 -0400

In my previous message to the list, I promised a code fragment, 
which got chopped off the end of my message. Sorry. Here it is. 

import org.tiaa_cref.GSS.*;

[snippage]

// Initialization

// Get instance of local implementation class (only done once)

GSSImplementation imp = 
(Class.forName(System.getProperty("GSSImplementation"))).newInstance();

// Get a server security context hatchery (only done once) 

GSSContextHatchery h = imp.getContextHatchery();

// Following are per-request operations 

// Got an HTTP request
// Request must be represented as a byte[]

byte [] request = args[0].getBytes();

// Try to do a context accept with it. 
// Normal behavior is to throw an exception 
// with a challenge, if the request isn't authenticated,
// and return normally if the request is authenticated.

GSSSecurityContext ctxt;
GSSStatus status;

try
   {
   h.setCredential(imp.GSS_C_NO_CREDENTIAL());
   ctxt =  h.bindForAccept(request);
   status = h.getLastStatus();
   }
catch (GSSException e)
   {
   // .. and do something intelligent...
   e.printStackTrace();
   return "Exception on context create";
   }

// No signature? Then challenge will be returned

short flags = status.getFlags();
if ((flags & GSSStatus.GSS_S_CONTINUE_NEEDED) != 0)
   {
   return "Got challenge: " + new String(status.getOperationOutput());
   }
   
// No exception, and no challenge issued: request had auth info 
// and context is now ready for use

// So let's see if the authentication checks out

try 
   {
   ctxt.unwrap(request);
   }
catch (GSSException e)
   {
   status = e.getStatus();
   // Investigate and cope.
   e.printStackTrace();
   return "Exception unwrapping request";
   }

// If no exception, then auth checked out.   

// Now let's get ourselves a RACF passticket.

// Start with a RACF credential.

GSSCredential racfcred = ctxt.getDelegatedCredential();

// Define name of the application endpoint we want to get to

GSSName mainframeappname;
try
   {
   mainframeappname =
   imp.importName
      (
         args[1].getBytes(),
         DAAImplementation.RACFmechOID
      );
   }
catch (Exception e)
   {
   e.printStackTrace();
   return "Exception importing name";
   }
      
// Get the context

GSSSecurityContext racfctxt;
try
   {
   h.setCredential(racfcred);
   racfctxt = h.bindForInit(mainframeappname);
   }
catch (Exception e)
   {
   e.printStackTrace();
   return "Exception creating RACF context";
   }

// Now get the passticket, finally
// Message to be sent to mainframe is byte []

byte [] message = args[2].getBytes();
GSSPerMessageCallResult result;
try
   {
   result = racfctxt.getMIC(0, message);
   }
catch (GSSException e)
   {
   // .. and do something intelligent
   // for now..
   e.printStackTrace();
   return "Exception getting passticket";
   }
// No exception, then we have a passticket

byte[] passticket = result.getOperationOutput();

// Et consummatum est. 
return "Made it!";

[etc.]

--Michael Smith
  [email-masked]

==========================================================================
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]