Java GSI GSS-API Implementation Features and Limitations
The Java GSI implementation is an implementation of the Java GSS-API. It supports the GSS-API extensions and the new proxy certificate format specifications as defined by the Global Grid Forum.
The implementation is based on the PureTLS library (for SSL API) and the BouncyCastle library (for certificate processing API).
Features:
- Implements Java GSS-API
- wrap/unwrap support SSL and GSI wrapped tokens (GSI_BIG QoP)
- getMIC/verifyMIC support large blocks
- Implements most of the GSS-Extensions including:
- Context options
- Supports PROTECTION_FAIL_ON_CONTEXT_EXPIRATION (in Java GSI GSS-API called CHECK_CONTEXT_EXPIRATION)
- Supports DISALLOW_ENCRYPTION (but through other means than context option)
- Defined additional options:
- GSS_MODE
- DELEGATION_TYPE
- REJECT_LIMITED_PROXY
- REQUIRE_CLIENT_AUTH
- Delegation API
- both wrapped and unwrapped mode (SSL compatible mode)
- Import and export of credential
- both opaque and mechanism specific data import/export
- Supports GSI and SSL compatibility mode (set via context option interface - GSS_MODE)
- Supports limited and full delegation both using initSecContext/acceptSecContext
and initDelegation/acceptDelegation methods (set via context option interface
- DELEGATION_TYPE)
- Supports enabling / disabling checking of peer credential for limited proxy.
- Supports enabling / disabling client authentication for acceptors (set via context option interface - REQUIRE_CLIENT_AUTH)
- Supports checking GSSAPI credential usage, setting/getting context lifetime
- Supports anonymous authentication and anonymous credentials
- Supports internationalization of error messages
- Supports authorization check (on the initiating side, hostbased service, identity, etc.)
- Support certificate extension checking (certificate chain validation is performed by the ProxyPathValidation library)
- BasicConstraints and KeyUsage certificate extension are checked.
- Any certificates with unsupported critical extensions will be rejected.
Limitations:
- No GAA support. Additional certificate chain validation is performed by the ProxyPathValidation library (this is performed after the SSL library verified the chain)
- Only looks for a proxy file when asked to load default credentials.
- Does not support protection key parameter to credential import and export API
- Does not support extensions parameters in the delegation API
- There
is a few unimplemented methods (e.g.in GSSContext: getWrapSizeLimit(),
export(), isTransferable(), etc) All unimplemented methods return GSSException.UNAVAILABLE
error and are marked as unimplemented in JavaDoc. Most of stream based operations
defined in Java GSS-API are not implemented (but can be implemented easily)
- The org.ietf.jgss.Oid is not completely implemented (this might be
a problem if the library is used with Java 1.3.x, that class is built in
with Java 1.4.x)
Versions of software used:
- PureTLS: puretls-0.9b4 with a few custom modifications
- Cryptix: 3.2 (PureTLS depends on it)
- Cryptix ASN.1 Kit (Custom version provided by PureTLS)
-
BouncyCastle: 1.17