Provides a set of service provider interfaces (SPIs) to be implemented by Java GSSAPI mechanism developers and integrators. The SPI forms the "glue" between the mechanism-independent Java GSSAPI framework and the mechanism itself.

The interfaces contained in this package are

As their names suggest, GSSContextSpi is for context operations, GSSCredentialSpi is for credential operations and GSSNameSpi is for name operations. Most of the method signatures in these interfaces are replicas of the corresponding method signatures in the org.ietf.jgss package.

The MechanismFactory interface contains operations for creating concrete instances of GSSContextSpi, GSSCredentialSpi and GSSNameSpi interfaces.

Tying It All Together: The Provider Class

In order to plug a mechanism under a Java GSSAPI framework, the mechanism developer/integrator has to supply a Provider class whose master file contains a mapping from the property "GssApiMechanism." to the class name of the mechanism factory.

As an example, consider an IBM provider that supports the Kerberos V5 mechanism (identified by the OID 1.2.840.113554.1.2.2). Further suppose that the factory class for the mechanism is called Krb5MechFactory and is contained in the package com.ibm.security.jgss.mech.krb5. Such a provider can be coded as

package com.ibm.security.jgss;

import java.security.Provider;
import java.security.AccessController;
import java.security.PrivilegedAction;

public final class IBMJGSSProvider extends Provider
{
    public IBMJGSSProvider()
    {
        super("IBMJGSSProvider", 1.0,
                   "IBMJGSSProvider supports Kerberos V5 Mechanism");

	// Kerberos V5 mechanism OID is 1.2.840.113554.1.2.2
	// Factory class name for the Kerberos V5 mechanism is
	//	com.ibm.security.jgss.mech.krb5.Krb5MechFactory

        AccessController.doPrivileged(new PrivilegedAction() {
            public Object run() {

                put("GssApiMechanism.1.2.840.113554.1.2.2",
                    "com.ibm.security.jgss.mech.krb5.Krb5MechFactory");

		// If this provider supported multiple mechanisms,
		// we'd have additional "put" statements similar
		// to the one above.

                return null;
            }
        });
    }
}
There are two ways to install a provider for the GSSAPI framework to use: When locating a mechanism to use, the GSSAPI framework searches the list of installed providers for the first provider that supports the mechanism. The factory class designated in the selected provider is then instantiated and used to create the various mechanism SPI elements as needed.

Package Specification

(none)

Related Documentation