Skip to content

AS400ConnectionPool should allow empty user id when using JGSS authentication scheme #272

Description

@rgala

When using Kerberos (JGSS AP) authentication, AS400ConectionPool should allow empty user id. For example, the following works just fine when using AS400 directly:

AS400 as400 = new AS400("some.host");
as400.connectService(AS400.DATABASE);

When obtaining connection using AS400ConectionPool using getConnection(AS400 system) method, the user id cannot be null or empty on AS400:

if (userID == null) throw new NullPointerException("userID");
if (userID.length() == 0) throw new ExtendedIllegalArgumentException("userID", ExtendedIllegalArgumentException.LENGTH_NOT_VALID);

I currently use a workaround where I retrieve user id from GSSCredential class object using below method:

private String obtainGSSPrincipal() {
    GSSManager manager = GSSManager.getInstance();
    GSSCredential cred = manager.createCredential(null, GSSCredential.DEFAULT_LIFETIME, (Oid) null, GSSCredential.INITIATE_ONLY);
    GSSName principal = cred.getName();
    return StringUtils.substringBefore(principal.toString(), "@").toUpperCase();
}

and then retrieve connection like this:

AS400ConnectionPool pool = new AS400ConnectionPool()
AS400 as400 = new SecureAS400(host);
as400.setUserId(obtainGSSPrincipal());
as400.setGuiAvailable(false);
connection = pool.getConnection(as400);

but I do not like this solution and I do not know how it is going to behave when GSS principal would not match user id on IBM i.

I do not see easy solution here, maybe adding support for AS400.AUTHENTICATION_SCHEME_GSS_TOKEN to AS400ConnectionPoolAuthentication and adjusting logic accordingly in PoolItem and AS400ConnectionPool classes would work. Bypassing user id check when rootSystem is not null could also work.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions