Removed unsafe package and native kerberos ticket check

[davecramer]

Still not sure what to do with the configuration. Currently we think the name is pgjdbc for the service. This should probably be consistent

[jerboaa]

It's not clear to me what the intent of re-using the JAAS_APPLICATION_NAME's config is needed. It didn't use it before.

[jerboaa]

Should this be set to something unique (i.e. not clash with the pgjdbc actual login config name)?

[davecramer]

Well we are going to use it here

pgjdbc/pgjdbc/src/main/java/org/postgresql/gss/MakeGSS.java

Line 38 in f61fbfe

jaasApplicationName = "pgjdbc";

to make the actual connection. So it seems appropriate to have the same name. I agree we could get away with just checking for the cache, but since we are going to the trouble, we might as well make sure it is going to work

[jerboaa]

That's fine, but wanted to note it's a departure of how it used to work before.

[davecramer]

Ya, I am aware. Which is why I wanted someone else to look over it for sanity. I have to admit to being a bit in the dark so looking for advice from an expert.

[jerboaa]

I'm not an expert in this area unfortunately, btw.

[davecramer]

hmmm... trial by fire then..

[jerboaa]

This looks strange. In either case your are setting CustomKrbConfig which only knows about pgjdbc. If somebody sets the jaas.config to, say, foo, then it still handles only pgjdbc. It won't see/use foo. It's unclear what the intent is. If the intent is to only use foo if the config is set (also for the creds-cache-lookup), then this isn't doing it. I think in that case it would fail, since foo is attempted to be looked up, but only pgjdbc will be set.

Since the previous version of this code doesn't do anything with the specified JAAS config, I wonder why do it now?

Shouldn't it be doing something like this (set the login config for the cache check to something other than pgjdbc as it's really doing something else: check the ticket cache, not try to login)?

Configration oldConfig = Configuration.getConfiguration();
Configuration.setConfiguration(new CustomKrbConfig());
lc = new LoginContext("krbTicketCacheCheck", new CallbackHandler() { ....
lc.login();
...
Subject sub = lc.getSubject();
boolean result = sub != null;
Configuration.setConfiguration(oldConfig);
return result;

[davecramer]

@jerboaa FYI, this doesn't actually work since it won't find the default principal. Still working on it.