KEYCLOAK-1928 Kerberos working with IBM JDK

util/embedded-ldap/src/main/java/org/keycloak/util/ldap/KerberosEmbeddedServer.java

@@ -19,8 +19,11 @@ package org.keycloak.util.ldap;
 
 import java.io.IOException;
 import java.lang.reflect.Field;
+import java.net.InetAddress;
+import java.net.UnknownHostException;
 import java.util.ArrayList;
 import java.util.HashSet;
+import java.util.Locale;
 import java.util.Properties;
 import java.util.Set;
 
@@ -43,13 +46,7 @@ import org.apache.directory.server.protocol.shared.transport.UdpTransport;
 import org.apache.directory.shared.kerberos.KerberosTime;
 import org.apache.directory.shared.kerberos.KerberosUtils;
 import org.apache.directory.shared.kerberos.codec.types.EncryptionType;
-import org.ietf.jgss.GSSException;
-import org.ietf.jgss.GSSManager;
-import org.ietf.jgss.GSSName;
 import org.jboss.logging.Logger;
-import org.keycloak.common.util.KerberosSerializationUtils;
-import sun.security.jgss.GSSNameImpl;
-import sun.security.jgss.krb5.Krb5NameElement;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
@@ -113,15 +110,8 @@ public class KerberosEmbeddedServer extends LDAPEmbeddedServer {
         this.kdcEncryptionTypes = readProperty(PROPERTY_KDC_ENCTYPES, DEFAULT_KDC_ENCRYPTION_TYPES);
 
         if (ldapSaslPrincipal == null || ldapSaslPrincipal.isEmpty()) {
-            try {
-                // Same algorithm like sun.security.krb5.PrincipalName constructor
-                GSSName gssName = GSSManager.getInstance().createName("ldap@" + bindHost, GSSName.NT_HOSTBASED_SERVICE);
-                GSSNameImpl gssName1 = (GSSNameImpl) gssName;
-                Krb5NameElement krb5NameElement = (Krb5NameElement) gssName1.getElement(KerberosSerializationUtils.KRB5_OID);
-                this.ldapSaslPrincipal = krb5NameElement.getKrb5PrincipalName().toString();
-            } catch (GSSException uhe) {
-                throw new RuntimeException(uhe);
-            }
+            String hostname = getHostnameForSASLPrincipal(bindHost);
+            this.ldapSaslPrincipal = "ldap/" + hostname + "@" + this.kerberosRealm;
         }
     }
 
@@ -219,6 +209,31 @@ public class KerberosEmbeddedServer extends LDAPEmbeddedServer {
     }
 
 
+    // Forked from sun.security.krb5.PrincipalName constructor
+    private String getHostnameForSASLPrincipal(String hostName) {
+        try {
+            // RFC4120 does not recommend canonicalizing a hostname.
+            // However, for compatibility reason, we will try
+            // canonicalize it and see if the output looks better.
+
+            String canonicalized = (InetAddress.getByName(hostName)).
+                    getCanonicalHostName();
+
+            // Looks if canonicalized is a longer format of hostName,
+            // we accept cases like
+            //     bunny -> bunny.rabbit.hole
+            if (canonicalized.toLowerCase(Locale.ENGLISH).startsWith(
+                    hostName.toLowerCase(Locale.ENGLISH)+".")) {
+                hostName = canonicalized;
+            }
+        } catch (UnknownHostException | SecurityException e) {
+            // not canonicalized or no permission to do so, use old
+        }
+        return hostName.toLowerCase(Locale.ENGLISH);
+    }
+
+
+
     /**
      * Replacement of apacheDS KdcServer class with disabled ticket replay cache.
      *