001/** 002 * Licensed to the Apache Software Foundation (ASF) under one or more 003 * contributor license agreements. See the NOTICE file distributed with this 004 * work for additional information regarding copyright ownership. The ASF 005 * licenses this file to you under the Apache License, Version 2.0 (the 006 * "License"); you may not use this file except in compliance with the License. 007 * You may obtain a copy of the License at 008 * 009 * http://www.apache.org/licenses/LICENSE-2.0 010 * 011 * Unless required by applicable law or agreed to in writing, software 012 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT 013 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the 014 * License for the specific language governing permissions and limitations under 015 * the License. 016 */ 017package org.apache.activemq.transport.https; 018 019 020/** 021 * Extend Jetty's {@link SslSocketConnector} to optionally also provide 022 * Kerberos5ized SSL sockets. The only change in behavior from superclass is 023 * that we no longer honor requests to turn off NeedAuthentication when running 024 * with Kerberos support. 025 */ 026public class Krb5AndCertsSslSocketConnector { 027// 028//extends SslSocketConnector { 029// public static final List<String> KRB5_CIPHER_SUITES = Collections.unmodifiableList(Collections.singletonList("TLS_KRB5_WITH_3DES_EDE_CBC_SHA")); 030// static { 031// System.setProperty("https.cipherSuites", KRB5_CIPHER_SUITES.get(0)); 032// } 033// 034// private static final Logger LOG = LoggerFactory.getLogger(Krb5AndCertsSslSocketConnector.class); 035// 036// private static final String REMOTE_PRINCIPAL = "remote_principal"; 037// 038// public enum MODE { 039// KRB, CERTS, BOTH 040// } // Support Kerberos, certificates or both? 041// 042// private boolean useKrb; 043// private boolean useCerts; 044// 045// public Krb5AndCertsSslSocketConnector() { 046// // By default, stick to cert based authentication 047// super(); 048// useKrb = false; 049// useCerts = true; 050// setPasswords(); 051// } 052// public Krb5AndCertsSslSocketConnector(SslContextFactory f, String auth) { 053// // By default, stick to cert based authentication 054// super(f); 055// useKrb = false; 056// useCerts = true; 057// setPasswords(); 058// setMode(auth); 059// } 060// 061// public static boolean isKrb(String mode) { 062// return mode == MODE.KRB.toString() || mode == MODE.BOTH.toString(); 063// } 064// 065// public void setMode(String mode) { 066// useKrb = mode == MODE.KRB.toString() || mode == MODE.BOTH.toString(); 067// useCerts = mode == MODE.CERTS.toString() || mode == MODE.BOTH.toString(); 068// logIfDebug("useKerb = " + useKrb + ", useCerts = " + useCerts); 069// } 070// 071// // If not using Certs, set passwords to random gibberish or else 072// // Jetty will actually prompt the user for some. 073// private void setPasswords() { 074// if (!useCerts) { 075// Random r = new Random(); 076// System.setProperty("jetty.ssl.password", String.valueOf(r.nextLong())); 077// System.setProperty("jetty.ssl.keypassword", String.valueOf(r.nextLong())); 078// } 079// } 080// 081// @Override 082// public SslContextFactory getSslContextFactory() { 083// final SslContextFactory factory = super.getSslContextFactory(); 084// 085// if (useCerts) { 086// return factory; 087// } 088// 089// try { 090// SSLContext context = factory.getProvider() == null ? SSLContext.getInstance(factory.getProtocol()) : SSLContext.getInstance(factory.getProtocol(), 091// factory.getProvider()); 092// context.init(null, null, null); 093// factory.setSslContext(context); 094// } catch (NoSuchAlgorithmException e) { 095// } catch (NoSuchProviderException e) { 096// } catch (KeyManagementException e) { 097// } 098// 099// return factory; 100// } 101// 102// /* 103// * (non-Javadoc) 104// * 105// * @see 106// * org.mortbay.jetty.security.SslSocketConnector#newServerSocket(java.lang 107// * .String, int, int) 108// */ 109// @Override 110// protected ServerSocket newServerSocket(String host, int port, int backlog) throws IOException { 111// logIfDebug("Creating new KrbServerSocket for: " + host); 112// SSLServerSocket ss = null; 113// 114// if (useCerts) // Get the server socket from the SSL super impl 115// ss = (SSLServerSocket) super.newServerSocket(host, port, backlog); 116// else { // Create a default server socket 117// try { 118// ss = (SSLServerSocket) super.newServerSocket(host, port, backlog); 119// } catch (Exception e) { 120// LOG.warn("Could not create KRB5 Listener", e); 121// throw new IOException("Could not create KRB5 Listener: " + e.toString()); 122// } 123// } 124// 125// // Add Kerberos ciphers to this socket server if needed. 126// if (useKrb) { 127// ss.setNeedClientAuth(true); 128// String[] combined; 129// if (useCerts) { // combine the cipher suites 130// String[] certs = ss.getEnabledCipherSuites(); 131// combined = new String[certs.length + KRB5_CIPHER_SUITES.size()]; 132// System.arraycopy(certs, 0, combined, 0, certs.length); 133// System.arraycopy(KRB5_CIPHER_SUITES.toArray(new String[0]), 0, combined, certs.length, KRB5_CIPHER_SUITES.size()); 134// } else { // Just enable Kerberos auth 135// combined = KRB5_CIPHER_SUITES.toArray(new String[0]); 136// } 137// 138// ss.setEnabledCipherSuites(combined); 139// } 140// return ss; 141// }; 142// 143// @Override 144// public void customize(EndPoint endpoint, Request request) throws IOException { 145// if (useKrb) { // Add Kerberos-specific info 146// SSLSocket sslSocket = (SSLSocket) endpoint.getTransport(); 147// Principal remotePrincipal = sslSocket.getSession().getPeerPrincipal(); 148// logIfDebug("Remote principal = " + remotePrincipal); 149// request.setScheme(HttpSchemes.HTTPS); 150// request.setAttribute(REMOTE_PRINCIPAL, remotePrincipal); 151// 152// if (!useCerts) { // Add extra info that would have been added by 153// // super 154// String cipherSuite = sslSocket.getSession().getCipherSuite(); 155// Integer keySize = Integer.valueOf(ServletSSL.deduceKeyLength(cipherSuite)); 156// ; 157// 158// request.setAttribute("javax.servlet.request.cipher_suite", cipherSuite); 159// request.setAttribute("javax.servlet.request.key_size", keySize); 160// } 161// } 162// 163// if (useCerts) 164// super.customize(endpoint, request); 165// } 166// 167// private void logIfDebug(String s) { 168// if (LOG.isDebugEnabled()) 169// LOG.debug(s); 170// } 171}