.$B%j%=!<%9$X$N%"%/%;%9$r>5G'$9$k>l9g!":G=i$K!"%"%W%j%1!<%7%g%s$,MW5a85$rG'>Z$9$kI,MW$,$"$j$^$9!#.(J JAAS .$B%U%l!<%`%o!<%/$G$O!"MW5a85$r!V%5%V%8%'%/%H!W$H$$$&8l$GI=$7$^$9!#.(J .$B%5%V%8%'%/%H$O!"%f!<%6$d%5!<%S%9$J$I$NG$0U$N%(%s%F%#%F%#$G$9!#.(J .$B0lEY!"%5%V%8%'%/%H$,G'>Z$5$l$k$H.(J javax.security.auth.Subject .$B$,4XO"$9$k<1JL>pJs!"$^$?$O.(J Principal .$B$G@j$a$i$l$^$9!#.(J .$BC10l$N%5%V%8%'%/%H$,J#?t$N%W%j%s%7%Q%k$r;}$D>l9g$b$"$j$^$9!#$?$H$($P!"$"$k?MJ*$O!"L>A0$N%W%j%s%7%Q%k.(J (.$B!V.(JJohn Doe.$B!W.(J) .$B$*$h$S.(J SSN .$B%W%j%s%7%Q%k.(J (.$B!V.(J123-45-6789.$B!W.(J) .$B$r;}$A$^$9!#$3$l$i$N%W%j%s%7%Q%k$K$h$j!"$3$N?MJ*$OB>$N%5%V%8%'%/%H$H6hJL$5$l$^$9!#.(J
.$B%5%V%8%'%/%H$O!"!V%/%l%G%s%7%c%k!W$H8F$P$l$k%;%-%e%j%F%#4XO"$NB0@-$bJ];}$G$-$^$9!#.(J .$BHs8x3+0E9f2=80$J$I!"FCJL$JJ]8n$,I,MW$J%/%l%G%s%7%c%k$O!"Hs8x3+%/%l%G%s%7%c%k.(J Set .$BFb$K3JG<$5$l$^$9!#.(J .$B8x3+80>ZL@=q$J$I$N6&M-$5$l$k%/%l%G%s%7%c%k$O!"8x3+%/%l%G%s%7%c%k.(J Set .$BFb$K3JG<$5$l$^$9!#.(J .$B%/%l%G%s%7%c%k.(J Set .$B$,0[$J$k$H!"$=$l$K%"%/%;%9$*$h$SJQ99$9$k$?$a$N%"%/%;%98"$b0[$J$j$^$9!#.(J
.$B%5%V%8%'%/%H$O!"
public Subject();
public Subject(boolean readOnly, Set principals,
Set pubCredentials, Set privCredentials);
.$B:G=i$N%3%s%9%H%i%/%?$O!"%W%j%s%7%Q%k$*$h$S%/%l%G%s%7%c%k$N6u.(J (null .$B$G$O$J$$.(J) .$B$N.(J Set .$B$G%5%V%8%'%/%H$r:n@.$7$^$9!#.(J 2 .$BHVL\$N%3%s%9%H%i%/%?$O!";XDj$5$l$?%W%j%s%7%Q%k$*$h$S%/%l%G%s%7%c%k$N.(J Set .$B$G%5%V%8%'%/%H$r:n@.$7$^$9!#.(J .$B%5%V%8%'%/%H$rFI$_Set .$B$OITJQ$G$9!#.(J
.$B%"%W%j%1!<%7%g%s:n@.LoginContext .$B$r%$%s%9%?%s%92=$7!"%5%V%8%'%/%H$r.(J LoginContext .$B%3%s%9%H%i%/%?$KEO$5$J$$>l9g!".(JLoginContext .$B$O?7$7$$6u$N%5%V%8%'%/%H$r%$%s%9%?%s%92=$7$^$9!#.(J LoginContext .$B$N%;%/%7%g%s$r;2>H$7$F$/$@$5$$!#.(J
.$B%5%V%8%'%/%H$,FI$_uBV$G%$%s%9%?%s%92=$5$l$J$+$C$?>l9g!"
public void setReadOnly();
.$B%?!<%2%C%HL>!V.(JsetReadOnly.$B!W$r;}$D.(J javax.security.auth.AuthPermission .$B$O!"$3$N%a%=%C%I$N8F$S=P$9$?$a$KMW5a$5$l$^$9!#.(J .$BFI$_IllegalStateException .$B$,%9%m!<$5$l$^$9!#.(J
.$BuBV$r%F%9%H$G$-$^$9!#.(J
public boolean isReadOnly();
.$B%5%V%8%'%/%H$K4XO"$7$?%W%j%s%7%Q%k$rl9g!"
public Set getPrincipals();
public Set getPrincipals(Class c);
.$B:G=i$N%a%=%C%I$O!"%5%V%8%'%/%H$K4^$^$l$k$9$Y$F$N%W%j%s%7%Q%k$rJV$7$^$9!#0lJ}!".(J2 .$BHVL\$N%a%=%C%I$O!";XDj$5$l$?%/%i%9.(J c .$B$^$?$O$=$N%5%V%/%i%9$N%$%s%9%?%s%9$K$J$C$F$$$k%W%j%s%7%Q%k$7$+JV$7$^$;$s!#.(J .$B%5%V%8%'%/%H$K4XO"IU$1$i$l$F$$$k%W%j%s%7%Q%k$,$J$$>l9g$O!"6u$N%;%C%H$,JV$5$l$^$9!#.(J
.$B%5%V%8%'%/%H$K4XO"$7$?8x3+%/%l%G%s%7%c%k$rl9g$O!"
public Set getPublicCredentials();
public Set getPublicCredentials(Class c);
.$B$3$l$i$N%a%=%C%I$NF0:n$O.(J getPrincipals .$B%a%=%C%I$NF0:n$H;w$F$$$^$9!#$?$@$7!".(JgetPrincipals .$B%a%=%C%I$G$O!"8x3+%/%l%G%s%7%c%k$r.$B%5%V%8%'%/%H.(J.$B$K4XO"$7$?Hs8x3+%/%l%G%s%7%c%k$K%"%/%;%9$9$k>l9g$O!"
public Set getPrivateCredentials();
public Set getPrivateCredentials(Class c);
.$B$3$l$i$N%a%=%C%I$NF0:n$O!".(JgetPrincipals .$B%a%=%C%I$d.(J getPublicCredentials .$B%a%=%C%I$H$h$/;w$F$$$^$9!#.(J
.$B%5%V%8%'%/%H$N%W%j%s%7%Q%k.(J Set.$B!"8x3+%/%l%G%s%7%c%k.(J Set.$B!"$^$?$OHs8x3+%/%l%G%s%7%c%k.(J Set .$B$rJQ99$^$?$OA`:n$9$k>l9g!"8F$S=P$7B&$O.(J java.util.Set .$B%/%i%9$GDj5A$5$l$?%a%=%C%I$r;HMQ$7$^$9!#.(J .$B$=$NJ}K!$r<($9%5%s%W%k%3!<%I$r0J2<$K<($7$^$9!#.(J
Subject subject;
Principal principal;
Object credential;
. . .
// add a Principal and credential to the Subject
subject.getPrincipals().add(principal);
subject.getPublicCredentials().add(credential);
.$BCm.(J: .$B!V.(JmodifyPrincipals.$B!W!"!V.(JmodifyPublicCredentials.$B!W!"$^$?$O!V.(JmodifyPrivateCredentials.$B!W$N$$$:$l$+$N%?!<%2%C%HL>$r;}$D.(J AuthPermission .$B$O!"$=$l$>$l$N.(J Set .$B$rJQ99$9$k$?$a$KMW5a$5$l$^$9!#%5%V%8%'%/%H$NFbIt%;%C%H$,JV$9$N$O!"0z?t$J$7$N.(J getPrincipals().$B!".(JgetPublicCredentials().$B!".(JgetPrivateCredentials() .$B%a%=%C%I$+$iJV$5$l$k%;%C%H$@$1$G$9!#.(J .$B$3$N$?$a!"JV$5$l$?%;%C%H$rJQ99$9$k$H!"FbIt%;%C%H$b1F6A$rgetPrincipals(Class c).$B!".(JgetPublicCredentials(Class c).$B!".(JgetPrivateCredentials(Class c) .$B%a%=%C%I$+$iJV$5$l$k%;%C%H$OJV$7$^$;$s!#.(J .$B%a%=%C%I8F$S=P$7$4$H$K!"?75,%;%C%H$,:n@.$5$l!"JV$5$l$^$9!#.(J .$B$3$l$i$N%;%C%H$rJQ99$7$F$b!"%5%V%8%'%/%H$NFbIt%;%C%H$K1F6A$O$"$j$^$;$s!#.(J
.$BHs8x3+%/%l%G%s%7%c%k$N.(J Set .$B$G7+$jJV$7=hM}$rjavax.security.auth.PrivateCredentialPermission .$B$,I,MW$G$9!#.(J .$B>\:Y$K$D$$$F$O!".(J PrivateCredentialPermission API .$B%I%-%e%a%s%H$r;2>H$7$F$/$@$5$$!#.(J
.$B%5%V%8%'%/%H$O.(J AccessControlContext .$B$H4XO"IU$1$i$l$^$9.(J (.$B0J2<$N.(J doAs .$B$*$h$S.(J doAsPrivileged .$B%a%=%C%I$N2r@b$r;2>H.(J).$B!#.(J .$BAccessControlContext .$B$H4XO"$7$?%5%V%8%'%/%H$rJV$7$^$9!#;XDj$5$l$?.(J AccessControlContext .$B$H4XO"IU$1$i$l$?%5%V%8%'%/%H$,B8:_$7$J$$>l9g$K$O!".(Jnull .$B$rJV$7$^$9!#.(J
public static Subject getSubject(final AccessControlContext acc);
.$B%?!<%2%C%HL>!V.(JgetSubject.$B!W$r;}$D.(J AuthPermission .$B$O!".(JSubject.getSubject .$B$r8F$S=P$9$?$a$KMW5a$5$l$^$9!#.(J
Subject .$B%/%i%9$K$O!".(Jjava.lang.Object .$B$+$i7Q>5$7$?
public boolean equals(Object o);
public String toString();
public int hashCode();
.$BFCDj$N%5%V%8%'%/%H$H$7$F%"%/%7%g%s$r
.$B
public static Object
doAs(final Subject subject,
final java.security.PrivilegedAction action);
public static Object
doAs(final Subject subject,
final java.security.PrivilegedExceptionAction action)
throws java.security.PrivilegedActionException;
.$B$I$A$i$N%a%=%C%I$b!";XDj$5$l$?%5%V%8%'%/%H$r8=9T%9%l%C%I$N.(J AccessControlContext .$B$K4XO"IU$1$F$+$i!".(Jaction .$B$raction .$B$ro$Naction .$B0z?t$r;XDj$7$F.(J run .$B%a%=%C%I$rPrivilegedExceptionAction run .$B%a%=%C%I$+$i$N%A%'%C%/$5$l$?Nc30$r%9%m!<$9$k>l9g$,$"$k$3$H$r=|$-!"F0:n$OF1$8$G$9!#.(J .$B%?!<%2%C%HL>.(J "doAs" .$B$r;}$D.(J AuthPermission .$B$O!".(JdoAs .$B%a%=%C%I$r8F$S=P$9$?$a$KMW5a$5$l$^$9!#.(J
Subject.doAs .$B$NNc.(J
.$BdoAs .$B%a%=%C%I$r:G=i$KMxMQ$9$k>l9g$NNc$r<($7$^$9!#.(J .$B%f!<%6.(J "Bob" .$B$,.(J LoginContext .$B$K$h$C$FG'>Z$5$l$?$?$a!".(Jcom.ibm.security.Principal .$B%/%i%9$N%W%j%s%7%Q%k$K%5%V%8%'%/%H$,@8@.$5$l!"%W%j%s%7%Q%k$NL>A0$,.(J "BOB" .$B$K$J$C$?$HA[Dj$7$F$/$@$5$$!#.(J .$B$^$?!".(JSecurityManager .$B$,%$%s%9%H!<%k:Q$_$G!"%"%/%;%9@)8f%]%j%7!\:Y$K$D$$$F$O.(J Policy .$B$r;2>H.(J).$B!#.(J
// grant "BOB" permission to read the file "foo.txt"
grant Principal com.ibm.security.Principal "BOB" {
permission java.io.FilePermission "foo.txt", "read";
};
.$B0J2<$K!"%5%s%W%k%"%W%j%1!<%7%g%s%3!<%I$r<($7$^$9!#.(J
class ExampleAction implements java.security.PrivilegedAction {
public Object run() {
java.io.File f = new java.io.File("foo.txt");
// the following call invokes a security check
if (f.exists()) {
System.out.println("File foo.txt exists");
}
return null;
}
}
public class Example1 {
public static void main(String[] args) {
// Authenticate the subject, "BOB".
// This process is desribed in the
// LoginContext section.
Subject bob;
// Set bob to the Subject created during the
// authentication process
// perform "ExampleAction" as "BOB"
Subject.doAs(bob, new ExampleAction());
}
}
.$BExampleAction .$B$,.(J f.exists() .$B$r8F$S=P$9$H!"%;%-%e%j%F%#%A%'%C%/$,ExampleAction .$B$,.(J .$B!V.(JBOB.$B!W.(J .$B$H$7$Fe5-.(J) .$B$K$h$jI,MW$J.(J FilePermission .$B$,.(J .$B!V.(JBOB.$B!W.(J .$B$KIUM?$5$l$F$$$k$?$a!".(JExampleAction .$B$O%;%-%e%j%F%#%A%'%C%/$rDL2a$7$^$9!#.(J .$B%]%j%7!grant .$BJ8$rJQ99$9$k.(J (.$B$?$H$($P!"IT@5$J.(J CodeBase .$B$rDI2C$9$k$+%W%j%s%7%Q%k$r.(J "MOE" .$B$KJQ99$9$k.(J) .$B$H!".(JSecurityException .$B$,%9%m!<$5$l$^$9!#.(J
doAsPrivileged .$B%a%=%C%I.(J
.$B
public static Object doAsPrivileged(
final Subject subject,
final java.security.PrivilegedAction action,
final java.security.AccessControlContext acc);
public static Object doAsPrivileged(
final Subject subject,
final java.security.PrivilegedExceptionAction action,
final java.security.AccessControlContext acc)
throws java.security.PrivilegedActionException;
.$B%?!<%2%C%HL>!V.(JdoAsPrivileged.$B!W$r;}$D.(J AuthPermission .$B$O!".(JdoAsPrivileged .$B%a%=%C%I$r8F$S=P$9$?$a$KMW5a$5$l$^$9!#.(J
doAs .$B$H.(J doAsPrivileged
doAsPrivileged .$B%a%=%C%I$NF0:n$O!".(JdoAs .$B$H$^$C$?$/F1$8$G$9!#$?$@$7!";XDj$5$l$?%5%V%8%'%/%H$r8=9T$N%9%l%C%I$N.(J AccessControlContext .$B$K4XO"IU$1$kBe$o$j$K!";XDj$5$l$?.(J AccessControlContext .$B$r;HMQ$7$^$9!#.(J .$B$3$N$h$&$K!"8=9T$N$b$N$H$O0[$J$C$?.(J AccessControlContext .$B$K$h$C$F%"%/%7%g%s$,@)8B$5$l$k$3$H$,$"$j$^$9!#.(J
AccessControlContext .$B$K$O!".(JAccessControlContext .$B$N%$%s%9%?%s%92=0J9_$KpJs.(J (.$B%3!<%I0LCV$d!"%]%j%7!<$K$h$C$F%3!<%I$KIUM?$5$l$?%"%/%;%98"$J$I.(J) .$B$,4^$^$l$^$9!#.(J .$B%"%/%;%9@)8f%A%'%C%/$r@.8y$5$;$k$?$a!"%]%j%7!<$O!".(JAccessControlContext .$B$K$h$C$F;2>H$5$l$k3F%3!<%I9`L\$K!"I,MW$J%"%/%;%98"$rIUM?$9$kI,MW$,$"$j$^$9!#.(J
doAsPrivileged .$B$KDs6!$5$l$?.(J AccessControlContext .$B$,.(J null .$B$G$"$k>l9g!"%"%/%7%g%s$,JL$N.(J AccessControlContext .$B$K$h$C$F@)8B$5$l$k$3$H$O$"$j$^$;$s!#.(J .$B$3$N$3$H$O!"%5!<%P4D6-$GLrN)$D>l9g$,$"$j$^$9!#.(J .$B%5!<%P$O!"J#?t$NCe?.MW5a$rG'>Z$7!"3FMW5a$KBP$7$FJL!9$N.(J doAs .$B$rdoAs .$B%"%/%7%g%s$r?7$?$K3+;O$7!"8=9T$N%5!<%P$N@)8B.(J AccessControlContext .$B$r$J$/$9$?$a!"%5!<%P$O.(J doAsPrivileged .$B$r8F$S=P$7!".(Jnull AccessControlContext .$B$rDs6!$9$k$3$H$,$G$-$^$9!#.(J
.$B%m%0%$%s9=@.$O!".(Jjava.security .$B%U%!%$%kFb$N.(J login.config.url.n .$B%;%-%e%j%F%#%W%m%Q%F%#$r;HMQ$7$FG[CV$5$l$^$9!#.(J .$B$3$N%W%m%Q%F%#$N>\:Y$*$h$S.(J java.security .$B%U%!%$%k$N0LCV$K$D$$$F$O!".(J.$B!VIUO?.(J A.$B!W.(J.$B$r;2>H$7$F$/$@$5$$!#.(J
.$B%G%U%)%k%H$N.(J Configuration .$BConfigFile .$B$O!"$=$N9=@.>pJs$r%m%0%$%s9=@.%U%!%$%k$+$i\:Y$K$D$$$F$O!".(J com.sun.security.auth.login.ConfigFile .$B%/%i%9$N.(J javadoc .$B$r;2>H$7$F$/$@$5$$!#.(J
.$B0J2<$O%5%s%W%k$N%m%0%$%s9=@.%U%!%$%k$G$9!#.(J
Login1 {
sample.SampleLoginModule required debug=true;
};
Login2 {
sample.SampleLoginModule required;
com.sun.security.auth.module.NTLoginModule sufficient;
com.foo.SmartCard requisite debug=true;
com.foo.Kerberos optional debug=true;
};
.$B%"%W%j%1!<%7%g%s.(J Login1 .$B$O!"9=@.:Q$_$N%m%0%$%s%b%8%e!<%k$N.(J SampleLoginModule .$B$N$_$rJ];}$7$^$9!#.(J .$B$3$N$?$a!".(JLogin1 .$B$,%5%V%8%'%/%H.(J (.$B%f!<%6$^$?$O%5!<%S%9.(J) .$B$rG'>Z$7$h$&$H$9$k;n$_$O!".(JSampleLoginModule .$B$,@.8y$7$?>l9g$K$N$_@.8y$7$^$9!#.(J
.$B%"%W%j%1!<%7%g%s.(J Login2 .$B$NG'>Z%m%8%C%/$O!"0J2<$NI=$G4JC1$K@bL@$G$-$^$9!#.(J .$BCm.(J: required.$B!".(Jsufficient.$B!".(Jrequisite.$B!"$*$h$S.(Joptional .$B$N3F%U%i%0$K$D$$$F$O!".(JConfiguration .$B$N.(J javadoc .$B%I%-%e%a%s%H$r;2>H$7$F$/$@$5$$!#.(J
| Login2 .$B$NG'>Z>uBV.(J
|
| SampleLoginModule | required | .$B@.8y.(J | .$B@.8y.(J | .$B@.8y.(J | .$B@.8y.(J | .$B<:GT.(J | .$B<:GT.(J | .$B<:GT.(J | .$B<:GT.(J |
| NTLoginModule | sufficient | .$B@.8y.(J | .$B<:GT.(J | .$B<:GT.(J | .$B<:GT.(J | .$B@.8y.(J | .$B<:GT.(J | .$B<:GT.(J | .$B<:GT.(J |
| SmartCard | requisite | * | .$B@.8y.(J | .$B@.8y.(J | .$B<:GT.(J | * | .$B@.8y.(J | .$B@.8y.(J | .$B<:GT.(J |
| Kerberos | optional | * | .$B@.8y.(J | .$B<:GT.(J | * | * | .$B@.8y.(J | .$B<:GT.(J | * |
| .$BA4BN$NG'>Z.(J | .$B@.8y.(J | .$B@.8y.(J | .$B@.8y.(J | .$B<:GT.(J | .$B<:GT.(J | .$B<:GT.(J | .$B<:GT.(J | .$B<:GT.(J |
* = .$BA0$N.(J requisite .$B%b%8%e!<%k$,<:GT$9$k$+!"$^$?$OA0$N.(J sufficient .$B%b%8%e!<%k$,@.8y$7$?$?$a!"%"%W%j%1!<%7%g%s$K@)8f$,JV$5$l$k$N$G!"$3$NCM$OHyL/$KJQ2=$7$^$9!#.(J