-
Bug
-
Resolution: Unresolved
-
Undefined
-
None
-
rhel-8.4.0
-
None
-
Low
-
rhel-sst-java
-
None
-
False
-
False
-
-
None
-
None
-
None
-
None
-
If docs needed, set a value
-
-
Unspecified
-
None
-
57,005
With FIPS enabled, the example code below returns the following exception:
$ java -Djava.security.auth.login.config=./gssapi_jaas.conf -Djava.security.krb5.conf=/etc/krb5.conf -jar sasl.jar
Callback called
Setting username
Callback called
Setting password
Authentication attempt failed javax.security.auth.loging.LogInException: java.lang.IllegalArgumentException: EncryptionKey: Key bytes cannot be null!
at sun.security.krb5.EncryptionKey.<init>(EncryptionKey.java:208)
...
Sample code:
1. main method:
LoginContext lc = null; try { lc = new LoginContext(ServerSasl.class.getName(), new MyHandler()); lc.login(); } catch (LoginException le) { System.err.println("Authentication attempt failed" + le); System.exit(-1); } Subject.doAs(lc.getSubject(), new JndiAction(args));
2. javax.security.auth.callback.CallbackHandler implementation
public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
for (int i = 0; i < callbacks.length; i++) {
if (callbacks[i] instanceof NameCallback) {
NameCallback cb = (NameCallback)callbacks[i];
cb.setName("ADuser realm");
} else if (callbacks[i] instanceof PasswordCallback) {
PasswordCallback cb = (PasswordCallback)callbacks[i];
String pw = "AD user password";
char[] passwd = new char[pw.length()];
pw.getChars(0, passwd.length, passwd, 0);
cb.setPassword(passwd);
} else {
throw new UnsupportedCallbackException(callbacks[i]);
}
}
}
3. java.security.PrivilegedAction implementation
...
private static void performJndiOperation(String[] args) {
Hashtable env = new Hashtable();
env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
env.put(Context.PROVIDER_URL, "ldap://ldap-server:636");
env.put(Context.SECURITY_PROTOCOL, "ssl");
env.put(Context.SECURITY_AUTHENTICATION, "GSSAPI");
env.put(Context.SECURITY_PRINCIPAL, "ADuser");
env.put(Context.SECURITY_CREDENTIALS, "ADuser password".getBytes());
try {
DirContext ctx = new InitialDirContext(env);
//Sample query
System.out.println(ctx.getAttributes("ldap://ldap-server:636", new String[]{"supportedSASLMechanisms"}));
ctx.close();
} catch (NamingException e) {
e.printStackTrace();
}
}
- depends on
-
JDK-8330842 Support AES CBC with Ciphertext Stealing (CTS) in SunPKCS11
- external trackers