Security Service

module CORBA {
       // Extensions to CORBA
       interface Current {
       };
};

// This information is taken from CORBAservices: Common Object 
// Services Specification, page 15-230. Revised Edition: 
// March 31, 1995. Updated: November 1997. Used with permission by OMG.

TimeBase Module

// From time service
module TimeBase {
       // interim definition of type ulonglong pending the
       // adoption of the type extension by all client ORBs.
       struct ulonglong {
              unsigned long      low;
              unsigned long      high;
       };
       typedef ulonglong         TimeT;
       typedef short             TdfT;
       struct UtcT { 
              TimeT              time;     // 8 octets
              unsigned long      inacclo;  // 4 octets
              unsigned short     inacchi;  // 2 octets
              TdfT              tdf;       // 2 octets
                                          // total 16 octets
       };
};

// This information is taken from CORBAservices: Common Object 
// Services Specification, p. 14-5. Revised Edition: 
// March 31, 1995. Updated: November 1997. Used with permission by OMG.

module Security {
        typedef sequence<octet>   Opaque;

       // Extensible families for standard data types
       struct ExtensibleFamily {
              unsigned short       family_definer;
              unsigned short       family;
        };

       //security attributes
       typedef unsigned long        SecurityAttributeType;

       // identity attributes; family = 0
       const SecurityAttributeType  AuditId = 1;
       const SecurityAttributeType  AccountingId = 2;
       const SecurityAttributeType  NonRepudiationId = 3;

       // privilege attributes; family = 1
       const SecurityAttributeType  Public = 1;
       const SecurityAttributeType  AccessId = 2;
       const SecurityAttributeType  PrimaryGroupId = 3;
       const SecurityAttributeType  GroupId = 4;
       const SecurityAttributeType  Role = 5;
       const SecurityAttributeType  AttributeSet = 6;
       const SecurityAttributeType  Clearance = 7;
       const SecurityAttributeType  Capability = 8;

       struct AttributeType {
               ExtensibleFamily       attribute_family;
               SecurityAttributeType  attribute_type;
       };

       typedef sequence <AttributeType>   AttributeTypeLists;
       struct SecAttribute {
              AttributeType   attribute_type;
              Opaque          defining_authority;
              Opaque          value;
              // The value of this attribute can be
             // interpreted only with knowledge of type
       };

       typedef sequence<SecAttribute>  AttributeList;

       // Authentication return status
       enum AuthenticationStatus {
              SecAuthSuccess,
              SecAuthFailure,
              SecAuthContinue,
              SecAuthExpired
       };

       // Authentication method
        typedef unsigned long      AuthenticationMethod;

        enum CredentialType {
              SecInvocationCredentials;
              SecOwnCredentials;
              SecNRCredentials

       // Pick up from TimeBase
       typedef TimeBase::UtcT      UtcT;
};

// This information is taken from CORBAservices: Common Object 
// Services Specification, pp. 15-193 to195. Revised Edition: 
// March 31, 1995. Updated: November 1997. Used with permission by OMG.

module SecurityLevel1 {
       interface Current : CORBA::Current {	// PIDL
             Security::AttributeList get_attributes(
               in Security::AttributeTypeList  attributes
            );
       };
};

// This information is taken from CORBAservices: Common Object 
// Services Specification, p. 15-198. Revised Edition: 
// March 31, 1995. Updated: November 1997. Used with permission by OMG.

Security Level 2 Module

module SecurityLevel2 {
       // Forward declaration of interfaces
       interface PrincipalAuthenticator;
       interface Credentials;
       interface Current;

      // Interface Principal Authenticator
       interface PrincipalAuthenticator {
            Security::AuthenticationStatus authenticate(
                   in Security::AuthenticationMethod  method,
                   in string                   security_name,
                   in Security::Opaque         auth_data,
                   in Security::AttributeList  privileges,
                   out Credentials             creds,
                   out Security::Opaque        continuation_data,
                   out Security::Opaque        auth_specific_data
             );

             Security::AuthenticationStatus
                           continue_authentication(
                     in Security::Opaque       response_data,
                     inout Credentials         creds,
                     out Security::Opaque      continuation_data,
                     out Security::Opaque      auth_specific_data
             );
        };

       // Interface Credentials
       interface Credentials {
              Security::AttributeList get_attributes(
                   in Security::AttributeTypeList   attributes
              );
              boolean is_valid(
                     out Security::UtcT      expiry_time
              );
       };

       // Interface Current derived from SecurityLevel1::Current
       // providing additional operations on Current at this
       // security level. This is implemented by the ORB.
       interface Current : SecurityLevel1::Current { // PIDL
              void set_credentials(
                     in Security::CredentialType   cred_type,
                     in Credentials                cred
              );

              Credentials get_credentials(
                   in Security::CredentialType   cred_type
              );
              readonly attribute PrincipalAuthenticator
                        principal_authenticator;
      };
};

// This information is taken from CORBAservices: Common Object 
// Services Specification, pp. 15-198 to 200. Revised Edition: 
// March 31, 1995. Updated: November 1997. Used with permission by // OMG.

Tobj Module

//Tobj Specific definitions

module Tobj {
       const Security::AuthenticationMethod   TuxedoSecurity =
                                                     0x54555800;

        //get_auth_type () return values
        enum AuthType {
              TOBJ_NOAUTH,
              TOBJ_SYSAUTH,
              TOBJ_APPAUTH
       };

       typedef sequence<octet>    UserAuthData;

      interface PrincipalAuthenticator :
              SecurityLevel2::PrincipalAuthenticator { // PIDL
               AuthType get_auth_type();

              Security::AuthenticationStatus logon(
                     in string            user_name,
                     in string            client_name,
                     in string            system_password,
                     in string            user_password,
                     in UserAuthData      user_data
               );
               void logoff();

              void build_auth_data(
                     in string                    user_name,
                     in string                    client_name,
                     in string                    system_password,
                     in string                    user_password,
                     in UserAuthData              user_data,
                     out Security::Opaque         auth_data,
                     out Security::AttributeList  privileges
              );
        };
};

Java Programming Examples

/*     Copyright (c) 1998 BEA Systems, Inc.
       All rights reserved
       THIS IS PROPRIETARY
       SOURCE CODE OF BEA Systems, Inc.
       The copyright notice above does not
       evidence any actual or intended
       publication of such source code.
*/

//*************************************************************************** //File:		SECURITY_CLIENT_EXAMPLE.JAVA       
//Description:	JAVA  Client program.                          //**************************************************************************

import org.omg.CORBA.*;
import com.beasys.Tobj.*;
import com.beasys.*;
import com.beasys.TobjInternal.*;
import java.io.*;

public class security_client_example {
         public static void main(String args[])
         {
            
              try {

                 // Initialize ORB
                 ORB orb = ORB.init();

                 // Create Bootstrap Object
                 Tobj_Bootstrap bs = new Tobj_Bootstrap(orb, "");

                 // Get the Security Current Object
                 org.omg.CORBA.Object secCurObj = bs.resolve_initial_references(
                                                          "SecurityCurrent");

                 org.omg.SecurityLevel2.Current secCur =
                       org.omg.SecurityLevel2.CurrentHelper.narrow(secCurObj);

                 // Get a principalauthenticator
                 org.omg.SecurityLevel2.PrincipalAuthenticator authlev2=
                        secCur.principal_authenticator();

                 com.beasys.Tobj.PrincipalAuthenticator auth =
            org.omg.SecurityLevel2.PrincipalAuthenticatorHelper.narrow(authlev2);

                 // Get the auth type
                 com.beasys.Tobj.AuthType authType = auth.get_auth_type(); 
                 System.out.println( "authType =" + authType);
                 byte[] userData = new byte[0];
                 String userName = "guest";
                 String clientName = "simpclt";
                 String systemPassword = null;
                 String userPassword = null;

                 // Set args according to security level
                 switch (authType.value())
                 {
                         case com.beasys.Tobj.AuthType._TOBJ_NOAUTH:
                                System.out.println(" No Password Required ");
                                break;
                         case com.beasys.Tobj.AuthType._TOBJ_SYSAUTH:
                                System.out.println("System Password Required ");
                                systemPassword = "security";
                                break;
                         case com.beasys.Tobj.AuthType._TOBJ_APPAUTH:
                                System.out.println("System Password Required & ");
                                System.out.println("User Password Required ");
                                systemPassword = "security";
                                userPassword = "hello";
                                break;
                 }
                 // Perform Tuxedo style logon
                 org.omg.Security.AuthenticationStatus status =
                 auth.logon(userName, clientName, systemPassword,
                              userPassword, userData);

                 // Prepare args CORBA Seciop style for authentication
                    com.beasys.Tobj.UserAuthData  userData;
                    org.omg.Security.Opaque_var authData;
                    org.omg.Security.AttributeList_var privileges;
                    org.omg.SecurityLevel2.Credentials_var creds;
                    org.omg.Security.Opaque_var continueData;
                    org.omg.CORBA.ULong method = com.beasys.Tobj.TuxedoSecurity;
                    org.omg.Security.Opaque_var authSpecificData;
 
                    // Use helper to build the authentication data
                    BeaPa->build_auth_data(userName, clientName,
                                          systemPassword,
                                          userPassword,
                                          userData, authData, privileges);
                    // Perform Corba Seciop authentication
                    Security.AuthenticationStatus Status = 
                    BeaPa->authenticate(method, userName, authData, 
                                          privileges, creds, continueData,
                                          authSpecificData); 

                System.out.println( "logon status =" + status);
             if (status != org.omg.Security.AuthenticationStatus.SecAuthSuccess)
                     System.exit(1);
              }
              catch (UserException e){
                      System.err.println("User exception: " + e);
                      e.printStackTrace();
                      System.exit(1);
}
              catch (SystemException e){
                      System.err.println("System exception: " + e);
                      e.printStackTrace();
                      System.exit(1);
              }
       }
}

Getting Information from Privileges

try {

      // Build empty attribute list to return all privileges
      org.omg.Security.AttributeType[] type_list =
                     new org.omg.Security.AttributeType[0];
      // Get attributes from current
      org.omg.Security.SecAttribute[] privs =
                     secCur.get_attributes(type_list);
      // Print attributes contents
      for (int i = 0 ; i < privs.length ; i++){
             switch( privs[i].attribute_type.attribute_type){
             case org.omg.Security.Public.value:
                     // No security was specified.
                     // Nothing to print.
                     continue;
             case org.omg.Security.AccessId.value:
                     // User name
                     String user = new String(privs[i].value);
                     System.out.println("User = " + user);
                     continue;
             case org.omg.Security.PrimaryGroupId.value:
                     // Client name
                     String client = new String(privs[i].value);
                     System.out.println("Client = " + client);
                     continue;
             }
      }
}
catch (SystemException e){
       System.out.println("Exception while checking attributes");
       System.exit(1);
}

Checking the Validity of the Credentials Expiration Time

try {

       // Get Credentials from current
        org.omg.SecurityLevel2.Credentials cred = secCur.get_credentials(
              org.omg.Security.CredentialType.SecInvocationCredentials);
       // Verify credentials
        org.omg.TimeBase.UtcTHolder expiry_time =
              new org.omg.TimeBase.UtcTHolder();
        if (!cred.is_valid(expiry_time)){
              System.out.println(
                   "Credentials are not valid any more");
              System.exit(1);
        }
       // expiry_time contains credentials expiration in
       // 100 nanoseconds since 15 October 1582 00:00 
}
catch (SystemException e){
       System.out.println("Exception while checking credentials");
       System.exit(1);
}

Authentication Using SecurityLevel2.PrincipalAuthenticator