/* * Copyright (c) 1999, 2010, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License version 2 only, as * published by the Free Software Foundation. Oracle designates this * particular file as subject to the "Classpath" exception as provided * by Oracle in the LICENSE file that accompanied this code. * * This code is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License * version 2 for more details (a copy is included in the LICENSE file that * accompanied this code). * * You should have received a copy of the GNU General Public License version * 2 along with this work; if not, write to the Free Software Foundation, * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. * * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA * or visit www.oracle.com if you need additional information or have any * questions. */package com.sun.security.sasl;import javax.security.sasl.*;import java.security.NoSuchAlgorithmException;import java.util.logging.Logger;import java.util.logging.Level;/** * Implements the CRAM-MD5 SASL client-side mechanism. * (<A HREF="http://www.ietf.org/rfc/rfc2195.txt">RFC 2195</A>). * CRAM-MD5 has no initial response. It receives bytes from * the server as a challenge, which it hashes by using MD5 and the password. * It concatenates the authentication ID with this result and returns it * as the response to the challenge. At that point, the exchange is complete. * * @author Vincent Ryan * @author Rosanna Lee */final class CramMD5Client extends CramMD5Base implements SaslClient { private String username; /** * Creates a SASL mechanism with client credentials that it needs * to participate in CRAM-MD5 authentication exchange with the server. * * @param authID A non-null string representing the principal * being authenticated. * * @param pw A non-null String or byte[] * containing the password. If it is an array, it is first cloned. */ CramMD5Client(String authID, byte[] pw) throws SaslException { if (authID == null || pw == null) { throw new SaslException( "CRAM-MD5: authentication ID and password must be specified"); } username = authID; this.pw = pw; // caller should have already cloned } /** * CRAM-MD5 has no initial response. */ public boolean hasInitialResponse() { return false; } /** * Processes the challenge data. * * The server sends a challenge data using which the client must * compute an MD5-digest with its password as the key. * * @param challengeData A non-null byte array containing the challenge * data from the server. * @return A non-null byte array containing the response to be sent to * the server. * @throws SaslException If platform does not have MD5 support * @throw IllegalStateException if this method is invoked more than once. */ public byte[] evaluateChallenge(byte[] challengeData) throws SaslException { // See if we've been here before if (completed) { throw new IllegalStateException( "CRAM-MD5 authentication already completed"); } if (aborted) { throw new IllegalStateException( "CRAM-MD5 authentication previously aborted due to error"); } // generate a keyed-MD5 digest from the user's password and challenge. try { if (logger.isLoggable(Level.FINE)) { logger.log(Level.FINE, "CRAMCLNT01:Received challenge: {0}", new String(challengeData, "UTF8")); } String digest = HMAC_MD5(pw, challengeData); // clear it when we no longer need it clearPassword(); // response is username + " " + digest String resp = username + " " + digest; logger.log(Level.FINE, "CRAMCLNT02:Sending response: {0}", resp); completed = true; return resp.getBytes("UTF8"); } catch (java.security.NoSuchAlgorithmException e) { aborted = true; throw new SaslException("MD5 algorithm not available on platform", e); } catch (java.io.UnsupportedEncodingException e) { aborted = true; throw new SaslException("UTF8 not available on platform", e); } }}
/*
* Copyright (c) 1999, 2010, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation. Oracle designates this
* particular file as subject to the "Classpath" exception as provided
* by Oracle in the LICENSE file that accompanied this code.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
package com.sun.security.sasl;
import javax.security.sasl.*;
import java.security.NoSuchAlgorithmException;
import java.util.logging.Logger;
import java.util.logging.Level;
/**
* Implements the CRAM-MD5 SASL client-side mechanism.
* (<A HREF="http://www.ietf.org/rfc/rfc2195.txt">RFC 2195</A>).
* CRAM-MD5 has no initial response. It receives bytes from
* the server as a challenge, which it hashes by using MD5 and the password.
* It concatenates the authentication ID with this result and returns it
* as the response to the challenge. At that point, the exchange is complete.
*
* @author Vincent Ryan
* @author Rosanna Lee
*/
final class CramMD5Client extends CramMD5Base implements SaslClient {
private String username;
/**
* Creates a SASL mechanism with client credentials that it needs
* to participate in CRAM-MD5 authentication exchange with the server.
*
* @param authID A non-null string representing the principal
* being authenticated.
*
* @param pw A non-null String or byte[]
* containing the password. If it is an array, it is first cloned.
*/
CramMD5Client(String authID, byte[] pw) throws SaslException {
if (authID == null || pw == null) {
throw new SaslException(
"CRAM-MD5: authentication ID and password must be specified");
}
username = authID;
this.pw = pw; // caller should have already cloned
}
/**
* CRAM-MD5 has no initial response.
*/
public boolean hasInitialResponse() {
return false;
}
/**
* Processes the challenge data.
*
* The server sends a challenge data using which the client must
* compute an MD5-digest with its password as the key.
*
* @param challengeData A non-null byte array containing the challenge
* data from the server.
* @return A non-null byte array containing the response to be sent to
* the server.
* @throws SaslException If platform does not have MD5 support
* @throw IllegalStateException if this method is invoked more than once.
*/
public byte[] evaluateChallenge(byte[] challengeData)
throws SaslException {
// See if we've been here before
if (completed) {
throw new IllegalStateException(
"CRAM-MD5 authentication already completed");
}
if (aborted) {
throw new IllegalStateException(
"CRAM-MD5 authentication previously aborted due to error");
}
// generate a keyed-MD5 digest from the user's password and challenge.
try {
if (logger.isLoggable(Level.FINE)) {
logger.log(Level.FINE, "CRAMCLNT01:Received challenge: {0}",
new String(challengeData, "UTF8"));
}
String digest = HMAC_MD5(pw, challengeData);
// clear it when we no longer need it
clearPassword();
// response is username + " " + digest
String resp = username + " " + digest;
logger.log(Level.FINE, "CRAMCLNT02:Sending response: {0}", resp);
completed = true;
return resp.getBytes("UTF8");
} catch (java.security.NoSuchAlgorithmException e) {
aborted = true;
throw new SaslException("MD5 algorithm not available on platform", e);
} catch (java.io.UnsupportedEncodingException e) {
aborted = true;
throw new SaslException("UTF8 not available on platform", e);
}
}
}