Improve JAAS configuration handling in Kerberos authentication

[Divang Sharma (divang)]

Description

This PR hardens Kerberos authentication by adding defense-in-depth validation of the java.security.auth.login.config system property. It blocks remote JAAS config sources (JNDI injection vector, MSRC-117029) while preserving local file path behavior.

Changes

Modified Files

• src/main/java/com/microsoft/sqlserver/jdbc/KerbAuthentication.java

  • Updated initAuthInit() to use JaasConfiguration(null) for the useDefaultJaasConfig=true path
  • Added assertSafeJaasLoginConfigProperty() to block remote schemes (http, https, ldap, rmi, ftp, etc.)
  • Added failUnsafeJaasLoginConfig() helper that logs at SEVERE and throws SQLServerException
  • Uses java.net.URI parsing to detect non-file schemes, with java.nio.file.Paths.get() fallback for values that aren't valid URIs
  • Handles JAAS = prefix syntax (forces single config source) by stripping before validation

• src/main/java/com/microsoft/sqlserver/jdbc/SQLServerResource.java

  • Added R_unsafeJaasLoginConfigProperty error message

Test Files

• src/test/java/com/microsoft/sqlserver/jdbc/KerberosTest.java
  • testAssertSafeJaasLoginConfigProperty_allowsNullProperty() — null/empty property passes
  • testAssertSafeJaasLoginConfigProperty_rejectsRemoteUrls() — blocks http/https/ldap/ftp
  • testAssertSafeJaasLoginConfigProperty_allowsLocalPaths() — permits file paths and file: URIs
  • testMSRC117029_pocPayloadsBlocked() — proves exact PoC payloads from the vulnerability report are blocked (including =-prefixed variants)
  • testAssertSafeJaasLoginConfigProperty_rejectsMalformedRemoteUrls() — catches malformed remote URLs that bypass URI parsing but would still be fetched by java.net.URL

Key Behavior

• Allowed: local file paths (/etc/jaas.conf, C:\config\jaas.conf), file: URIs, =-prefixed local paths
• Blocked: any non-file remote scheme (http://, https://, ldap://, rmi://, ftp://, etc.)
• Fail-closed: if SecurityManager denies reading the property, throws rather than proceeding blind
• Fail-fast: throws SQLServerException immediately — no retries, no network activity

Benefits

1. JNDI Injection Prevention: Remote JAAS configs can declare arbitrary LoginModules (e.g. JndiLoginModule) triggering JNDI/LDAP lookups during login, leading to RCE
2. Defense in Depth: Path-based fallback catches malformed URLs that bypass URI parsing but may still be opened by JAAS ConfigFile (which uses java.net.URL internally)
3. No Deprecated APIs: Uses java.net.URI + java.nio.file.Paths instead of deprecated java.net.URL(String)
4. JAAS Syntax Aware: Handles the = prefix that forces Java to use only the specified config source

Testing

• Unit tests validate accept/reject behavior via reflection on the package-private method
• Tests cover exact MSRC-117029 PoC payloads to prove the vulnerability is mitigated
• All existing Kerberos integration tests pass without modification

Backward Compatibility

• Standard local JAAS config files remain fully supported (absolute/relative paths, UNC paths, file: URIs)
• useDefaultJaasConfig=true continues to work with built-in JaasConfiguration
• No changes to connection string properties or public API

Backward Compatibility

Fully backward compatible

• Existing connection strings work without changes
• Standard Krb5LoginModule authentication remains fully supported
• No changes to public API or connection properties

[codecov]

Codecov Report

❌ Patch coverage is 0% with 40 lines in your changes missing coverage. Please review.
✅ Project coverage is 59.19%. Comparing base (a93baff) to head (3b43743).
⚠️ Report is 14 commits behind head on main.

Files with missing lines	Patch %	Lines
...m/microsoft/sqlserver/jdbc/KerbAuthentication.java	0.00%	40 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##               main    #2961      +/-   ##
============================================
- Coverage     60.84%   59.19%   -1.65%     
- Complexity     4981     5034      +53     
============================================
  Files           151      153       +2     
  Lines         35223    36332    +1109     
  Branches       5900     6644     +744     
============================================
+ Hits          21430    21507      +77     
- Misses        10935    11086     +151     
- Partials       2858     3739     +881     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR hardens Kerberos (JAAS-based) integrated authentication by reducing reliance on the JVM-wide JAAS configuration and adding a guard that rejects potentially remote java.security.auth.login.config values, preventing unsafe JAAS config loading during LoginContext.login().

Changes:

• Updated Kerberos login initialization to use JaasConfiguration(null) for the useDefaultJaasConfig=true path and added assertSafeJaasLoginConfigProperty() for defense-in-depth against remote JAAS config sources.
• Added a new localized error string (R_unsafeJaasLoginConfigProperty) to provide actionable guidance when unsafe config is detected.
• Added tests in KerberosTest to validate accept/deny behavior for java.security.auth.login.config values.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
src/main/java/com/microsoft/sqlserver/jdbc/KerbAuthentication.java	Adds property validation to block remote JAAS config sources and adjusts default JAAS configuration usage.
src/main/java/com/microsoft/sqlserver/jdbc/SQLServerResource.java	Adds a new driver error message for unsafe JAAS login config property values.
src/test/java/com/microsoft/sqlserver/jdbc/KerberosTest.java	Adds tests for the new JAAS config property validation behavior.