Clear gsstoken during connection close

Signed-off-by: Irfan Sharif <[email protected]>

Author: Irfan Sharif

src/main/java/com/ibm/as400/access/AS400.java

@@ -404,6 +404,11 @@ private byte[] getGSSToken() {
         return this.gssToken_;
     }
 
+    public void clearGSSToken() {
+        if (this.gssToken_ != null)
+            CredentialVault.clearArray(gssToken_);
+    }
+
     // Determines if the password contains a Kerberos token
     private boolean isGSSToken(char[] auth){
         char[] prefix = KERBEROS_PREFIX_CHARS;
@@ -4201,6 +4206,7 @@ public void removeVetoableChangeListener(VetoableChangeListener listener)
     public synchronized void resetAllServices()
     {
         if (Trace.traceOn_) Trace.log(Trace.DIAGNOSTIC, "Resetting all services.");
+        clearGSSToken();
         setStayAlive(0);
 
         disconnectAllServices();

src/main/java/com/ibm/as400/access/AS400JDBCConnectionImpl.java

@@ -592,6 +592,11 @@ public void close ()
 
 
             as400_.disconnectServer (server_);
+            // Clear the sensitive auth token via the public AS400 object
+            if (as400PublicClassObj_ != null) {
+                as400PublicClassObj_.clearGSSToken();
+            }
+
             server_ = null;
         }