archive/jdk
1
0
Fork 0
mirror of https://github.com/openjdk/jdk.git synced 2025-08-27 06:45:07 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

8279842: HTTPS Channel Binding support for Java GSS/Kerberos

Browse source 
Co-authored-by: Weijun Wang <weijun.wang@oracle.com>
Reviewed-by: dfuchs, weijun, darcy
This commit is contained in:
Michael McMahon 2022-02-01 07:26:59 +00:00
parent 0e70d4504c
commit de3113b998
11 changed files with 587 additions and 37 deletions
Download patch file Download diff file Expand all files Collapse all files

16
src/java.base/share/classes/java/net/doc-files/net-properties.html
View file

@ -214,6 +214,22 @@ of proxies.</P>
property is defined, then its value will be used as the domain
name.</P>
</OL>
<LI><P><B>{@systemProperty jdk.https.negotiate.cbt}</B> (default: &lt;never&gt;)<BR>
This controls the generation and sending of TLS channel binding tokens (CBT) when Kerberos
or the Negotiate authentication scheme using Kerberos are employed over HTTPS with
{@code HttpsURLConnection}. There are three possible settings:</P>
<OL>
<LI><P>"never". This is also the default value if the property is not set. In this case,
CBTs are never sent.</P>
<LI><P>"always". CBTs are sent for all Kerberos authentication attempts over HTTPS.</P>
<LI><P>"domain:&lt;comma separated domain list&gt;" Each domain in the list specifies destination
host or hosts for which a CBT is sent. Domains can be single hosts like foo, or foo.com,
or literal IP addresses as specified in RFC 2732, or wildcards like *.foo.com which matches
all hosts under foo.com and its sub-domains. CBTs are not sent to any destinations
that don't match one of the list entries</P>
</OL>
<P>The channel binding tokens generated are of the type "tls-server-end-point" as defined in
RFC 5929.</P>
</UL>
<P>All these properties are checked only once at startup.</P>
<a id="AddressCache"></a>