I could not find any documentation on what the Java command option java.security.auth.debug provides. In this blog post I enabled it an give examples of the output.
The command
java -Djava.security.auth.debug=help
lists all of the options
all turn on all debugging
access print all checkPermission results
certpath PKIX CertPathBuilder and
CertPathValidator debugging
combiner SubjectDomainCombiner debugging
gssloginconfig
GSS LoginConfigImpl debugging
configfile JAAS ConfigFile loading
configparser JAAS ConfigFile parsing
jar jar verification
logincontext login context results
jca JCA engine class debugging
policy loading and granting
provider security provider debugging
pkcs11 PKCS11 session manager debugging
pkcs11keystore
PKCS11 KeyStore debugging
sunpkcs11 SunPKCS11 provider debugging
scl permissions SecureClassLoader assigns
ts timestamping
The following can be used with access:
stack include stack trace
domain dump all domains in context
failure before throwing exception, dump stack
and domain that didn't have permission
thread include the thread name
The following can be used with stack and domain:
permission=<classname>
only dump output if specified permission
is being checked
codebase=<URL>
only dump output if specified codebase
is being checked
permname=<name>
only dump output if the specified name
matches the permission getName()
permactions=<actions>
only dump output if the specified actions
matches the permission getActions()
The following can be used with provider:
engine=<engines>
only dump output for the specified list
of JCA engines. Supported values:
Cipher, KeyAgreement, KeyGenerator,
KeyPairGenerator, KeyStore, Mac,
MessageDigest, SecureRandom, Signature.
Note: Separate multiple options with a comma
It works with the -Dlog.level option. For example with
-Dlog.level=FINER
It gives information like
04-Sep-2023 08:16:32.820 FINER [main] com.ibm.security.x509.AlgorithmId.algName ENTRY 04-Sep-2023 08:16:32.832 FINER [main] com.ibm.security.x509.AlgorithmId.algName_46 RETURN SHA-256
This is a request to return the algName and it returns the value SHA-256
...com.ibm.crypto.provider.RACFInputStream.RACFInputStream ENTRY START1 MQRING null
...com.ibm.crypto.provider.RACFInputStream.getEntries ENTRY START1 MQRING
...com.ibm.crypto.provider.RACFInputStream.getEntries key = NEWTECCTEST
...com.ibm.crypto.provider.RACFInputStream.getEntry ENTRY {NEWTECCTEST=[B@be879fff [B@358
...com.ibm.security.x509.X509CertImpl.X509CertImpl ENTRY [B@d6d840cb IBMJCE
=certpath -Dlog.level=FINER
certpath: Constraints: MD2
certpath: Constraints: MD5
certpath: Constraints: RSA keySize < 1024
...
certpath: Constraints.permits(): SHA-256, [
Variant: generic
Certs Issued by Anchor:
Cert Issuer: CN=IBM Java Security CA, OU=IBM Java Security, O=IBM Corporation, C=US
Cert Subject: CN=IBM Java Security CA, OU=IBM Java Security, O=IBM Corporation, C=US
Cert Issuer: CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US
Cert Subject: CN=Sectigo RSA Time Stamping CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB
Key: RSA
Key: RSA
Timestamp: Tue Jan 31 18:30:31 GMT+01:00 2023
]
=pkcs11,pkcs11keystore -Dlog.level=FINER
FINER [main] KeyStoreDelegator.engineLoad Loaded a keystore in JKS format
=jca -Dlog.level=FINER
ProviderConfig: Loading provider: com.ibm.jsse2.IBMJSSEProvider2 ProviderConfig: Loaded provider IBMJSSE2 version 1.8 ProviderConfig: Loading provider: com.ibm.crypto.provider.IBMJCE
=provider -Dlog.level=FINER
Provider: IBMJSSE2.putService(): IBMJSSE2: TrustManagerFactory.IbmX509 -> com.ibm.jsse2.bk$b. Provider: Set BootstrapProvider provider property [KeyFactory.RSA/com.ibm.security.bootstrap.RSAKeyFactory] Provider: MessageDigest.SHA-384 algorithm from: BootstrapProvider Provider: KeyStore.JCERACFKS type from: IBMJCE
Then for each session that connected
Provider: MessageDigest.SHA-256 algorithm from: IBMJCE Provider: MessageDigest.SHA-256 algorithm from: IBMJCE Provider: MessageDigest.SHA-256 algorithm from: IBMJCE Provider: MessageDigest.SHA-256 algorithm from: IBMJCE Provider: MessageDigest.SHA-256 algorithm from: IBMJCE Provider: MessageDigest.SHA-256 algorithm from: IBMJCE Provider: KeyPairGenerator.EC algorithm from: IBMJCE Provider: MessageDigest.SHA-256 algorithm from: IBMJCE Provider: MessageDigest.SHA-256 algorithm from: IBMJCE Provider: KeyPairGenerator.EC algorithm from: IBMJCE Provider: Signature.SHA384withECDSA signing algorithm from: IBMJCE Provider: SecureRandom.NativePRNG algorithm from: IBMJCE Provider: Signature.SHA384withECDSA signing algorithm from: IBMJCE Provider: SecureRandom.NativePRNG algorithm from: IBMJCE
=logincontext -Dlog.level=FINER
This produced no trace output. I expect this is because the Java logincontext was not used by Apache Tomcat.
=configparser -Dlog.level=FINER
Nothing.
ColinPaice 