When using Kerberos (JGSS AP) authentication, AS400ConectionPool should allow empty user id. For example, the following works just fine when using AS400 directly:
AS400 as400 = new AS400("some.host");
as400.connectService(AS400.DATABASE);
When obtaining connection using AS400ConectionPool using getConnection(AS400 system) method, the user id cannot be null or empty on AS400:
if (userID == null) throw new NullPointerException("userID");
if (userID.length() == 0) throw new ExtendedIllegalArgumentException("userID", ExtendedIllegalArgumentException.LENGTH_NOT_VALID);
I currently use a workaround where I retrieve user id from GSSCredential class object using below method:
private String obtainGSSPrincipal() {
GSSManager manager = GSSManager.getInstance();
GSSCredential cred = manager.createCredential(null, GSSCredential.DEFAULT_LIFETIME, (Oid) null, GSSCredential.INITIATE_ONLY);
GSSName principal = cred.getName();
return StringUtils.substringBefore(principal.toString(), "@").toUpperCase();
}
and then retrieve connection like this:
AS400ConnectionPool pool = new AS400ConnectionPool()
AS400 as400 = new SecureAS400(host);
as400.setUserId(obtainGSSPrincipal());
as400.setGuiAvailable(false);
connection = pool.getConnection(as400);
but I do not like this solution and I do not know how it is going to behave when GSS principal would not match user id on IBM i.
I do not see easy solution here, maybe adding support for AS400.AUTHENTICATION_SCHEME_GSS_TOKEN to AS400ConnectionPoolAuthentication and adjusting logic accordingly in PoolItem and AS400ConnectionPool classes would work. Bypassing user id check when rootSystem is not null could also work.
When using Kerberos (JGSS AP) authentication, AS400ConectionPool should allow empty user id. For example, the following works just fine when using AS400 directly:
When obtaining connection using AS400ConectionPool using getConnection(AS400 system) method, the user id cannot be null or empty on AS400:
I currently use a workaround where I retrieve user id from GSSCredential class object using below method:
and then retrieve connection like this:
but I do not like this solution and I do not know how it is going to behave when GSS principal would not match user id on IBM i.
I do not see easy solution here, maybe adding support for AS400.AUTHENTICATION_SCHEME_GSS_TOKEN to AS400ConnectionPoolAuthentication and adjusting logic accordingly in PoolItem and AS400ConnectionPool classes would work. Bypassing user id check when rootSystem is not null could also work.