Skip to content

Set gss token#279

Open
irfanshar wants to merge 5 commits intoIBM:mainfrom
irfanshar:setGSSToken
Open

Set gss token#279
irfanshar wants to merge 5 commits intoIBM:mainfrom
irfanshar:setGSSToken

Conversation

@irfanshar
Copy link

Allow authentication by passing in GSSToken in password field

Irfan Sharif added 3 commits October 8, 2025 13:46
Signed-off-by: Irfan Sharif <IrfanSharif@ibm.com>
Signed-off-by: Irfan Sharif <IrfanSharif@ibm.com>
Signed-off-by: Irfan Sharif <IrfanSharif@ibm.com>
Signed-off-by: Irfan Sharif <IrfanSharif@ibm.com>
Copy link
Member

@ThePrez ThePrez left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overall functionality looks good.
Even though the naming was my suggestion, please name the new functions something else. Setting the token explicitly is actually bypassing GSS. So I'd propose something like setKerbTicket

@ThePrez ThePrez requested a review from jeber-ibm October 15, 2025 15:42
@jeber-ibm
Copy link
Member

Can you comment why you permit the kerberos ticket to be passed in the password field? Should a method be used to set the ticket, instead of passing it though the password?

Signed-off-by: Irfan Sharif <IrfanSharif@ibm.com>
@irfanshar irfanshar requested a review from ThePrez October 23, 2025 18:01
@jeber-ibm jeber-ibm self-requested a review October 23, 2025 19:10
Copy link
Member

@jeber-ibm jeber-ibm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need to make sure that the ticket is not visible for a long time in memory. We do not want an attacker to do a memory dump and gain access to the ticket.

The stored ticket should be encrypted so that it is not visible in a memory dump. Just look at how the password is encrypted so that it is not visible in a memory dump.

If the ticket is stored temporarily in a byte[], the byte[] should be cleared after using the ticket.

Also, do not clear the kerberos ticket if the JDBC connection is closed. The ticket should only be cleared when the AS400 object is closed. If the JDBC connection is closed, the AS400 object could attempt to connect to a different host server. If the ticket is encrypted anyway, it is not so vital to clear it out.

@julesyan
Copy link
Member

waiting on changes to be merged into @irfanshar branch: irfanshar#1

@julesyan julesyan mentioned this pull request Dec 1, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants