Supported, non-spoof-able way to determine current user in Java?

user_12166780 0
Viewed 41

For various reasons, I have a Java application that needs to be able to detect which user is running it. I've seen a few suggestions that address the issue, but none are fully satisfactory.

Some suggest using the system property user.name, but this is not reliable as it can be spoofed in at least 2 ways (changing the value of the environment variable that the system looks to, or starting the program with an override value via a -Duser.name option).

Another option is to use the classes in the com.sun.security.auth.module package, but the Java Ruling Class is very clear on why this is not a good idea (see for example this web page).

This seems like it's a sufficiently valuable capability that there should be a way to do this in Java that is supported, but I haven't been able to find it. Any suggestions?

authentication java
1 Answers

For various reasons, I have a Java application that needs to be able to detect which user is running it.

Bad luck, on modern, but especially on unix/posix systems, it's up to the user to define which libraries get loaded when your java gets loaded. This can include a library that intercepts call to the C runtime (libc) that checks user names.

Not to mention that user namespaces are a common feature on multiple OSes, which allow any unprivileged user to set arbitrary user names. This is by design.

In short: the system is the user's. You can't use whatever that system says to authenticate against any other system. This is a truth as old as authentication systems: you need an anchor of trust, and on a system that you don't control, such an anchor is not yours to get – unless you have things like TPM or FIDO/cryptographic smartcard readers.

You will have to find a fundamentally different security mechanism. You can never trust a user's system if you've got anything to hide from them. Think about this: your user might very well boot a virtual machine in which they control everything; they very much copy the original machine's hard drive byte for byte, but they change their user name in that VM to that of someone else. Game over for your system.

I feel like I need to repeat that: You cannot trust a user's system. If your security depends on your software doing actually what is expected of it (e.g. validating a password, or checking anything else, and if successful, sending a packet somewhere), then a simple debugger can just jump over any security measure and execute the code you didn't mean to be executed in a case of non-authentication. You, as a developer, know how to use a debugger. Any user could use a debugger, too.

user_44333860
Related