Advanced Security Programming in Java™ SE Authentication, Secure Communication and Single Sign-On

Java SE offers a rich set of APIs and features for developing secure Java applications and services. The exercise sessions listed here can help you to use the Java SE GSS APIs to build applications that authenticate their users, to communicate securely with other applications and services, and help you to configure your applications in a Kerberos environment to achieve Single Sign-On. In addition, you will also learn how to use stronger encryption algorithms in a Kerberos environment, and how to use Java GSS mechanisms such as SPNEGO to secure the association.

Setting up your Development Environment

Please download, install and configure the software listed below:

  1. Download and unzip the exercises in jgss-sample.zip.
  2. Install and set up a Solaris 10 machine (required for exercise 7)
  3. Configure a Kerberos server on a Solaris 10 machine with accounts used by the exercises. See Appendix A.
  4. Set the %JAVA_HOME% environment variable to point to the installation directory of your Java SE JDK
    Example: /usr/jdk/jdk6.0/

Exercises

This session includes five lessons. Each part contains one or more coding exercises.

Things to check: 

Make sure you have verified the following configuration settings before proceding to the first Exercise:

  1. Set up the Key Distribution Center (KDC) on your Solaris 10 machine and start the Kerberos server.
  2. Set up the Kerberos configuration on your client machine.
  3. Ensure that JDK 6.0 is available.

Please work through these exercises in sequence.

Part I:   Secure Authentication using the Java Authentication and Authorization Service (JAAS):

  1. Using the JAAS API
  2. Configuring JAAS for Kerberos Authentication

Part II:  Secure Communications using Java SE 1.5 Security APIs

  1. Using the Java Generic Security Services (GSS) API
  2. Using the Java Simple Authentication and Security Layer (SASL) API
  3. Using the Java Secure Socket Extension (JSSE) with Kerberos

Part III:  Deploying for Single Sign-On in a Kerberos Environment: 

  1. Deploying for Single Sign-On

Part IV:  Secure Communications using stronger encryption algorithms (Java SE 6.0):

  1. Configuring to use stronger Kerberos encryption algorithms, to secure the communication

Part V:  Secure Authentication using SPNEGO Java GSS mechanism (Java SE 6.0):

  1. Using the Java Generic Security Services (GSS) API with other GSS mechanisms, such as SPNEGO

Part VI:  HTTP/SPNEGO authentication:

  1. Using HTTP/SPNEGO Authentication

Resources:

Where to send questions or feedback on this exercise :

Please send your questions on this set of exercises to the following email alias:
java-security@sun.com

Appendix A: Setting up Kerberos Accounts

Kerberos accounts are set up on the Key Distribution Center (KDC). Each entry in the Kerberos database contains a Kerberos principal. You should create a host-based principal for the machine that you will be running the servers (e.g., "host/j1hol-001") and a client principal (e.g., "test") for accessing the servers.

For Solaris, please refer to following documentation on how to setup Kerberos principals.

  1. Administering Principals
  2. System Administration Guide: Security Services

For Windows, please refer to Microsoft documentation. Here are some pointers.

  1. How to Create an Active Directory Server in Windows 2000
  2. Microsoft Kerberos
  3. Interoperability with Microsoft Windows 2000 Active Directory and Kerberos Services

The exercises assume that the operating system has been configured to use the correct Kerberos server. This configuration typically requires administration privileges. If you cannot configure the operating system, then you can use a Kerberos configuration file with your java command by using the -Djava.security.krb5.conf option. Here is an example of how to invoke one of the commands from the exercises to use the krb5.conf configuration file.

 % java
  -Djava.security.auth.login.config=jaas-krb5.conf\
  -Djava.security.krb5.conf=krb5.conf\
   Jaas client