diff --git a/docs/src/reference/asciidoc/appendix.adoc b/docs/src/reference/asciidoc/appendix.adoc index c63f1f3..7dd6455 100644 --- a/docs/src/reference/asciidoc/appendix.adoc +++ b/docs/src/reference/asciidoc/appendix.adoc @@ -197,6 +197,15 @@ Entry for principal HTTP/neo.example.org@EXAMPLE.ORG with kvno 2, encryption typ This was tested using `Windows Server 2012 R2` +[TIP] +==== +Internet is full of good articles and videos how to setup Windows AD +but these two are quite usefull +http://www.rackspace.com/knowledge_center/article/installing-active-directory-on-windows-server-2012[Rackspace] and +http://social.technet.microsoft.com/wiki/contents/articles/12370.windows-server-2012-set-up-your-first-domain-controller-step-by-step.aspx[Microsoft +Technet]. +==== + - Normal domain controller and active directory setup was done. - Used dns domain `example.org` and windows domain `EXAMPLE`. - I created various domain users like `user1`, `user2`, `user3`, diff --git a/docs/src/reference/asciidoc/samples.adoc b/docs/src/reference/asciidoc/samples.adoc index df2c727..57cecdd 100644 --- a/docs/src/reference/asciidoc/samples.adoc +++ b/docs/src/reference/asciidoc/samples.adoc @@ -2,19 +2,14 @@ = Spring Security Kerberos Samples This part of the reference documentation is introducing samples -projects. Generally samples can be either compiled manually by -building main distribution from -https://github.com/spring-projects/spring-security-kerberos or using -nightly snapshots or actual release builds. - -- http://repo.spring.io/libs-snapshot/org/springframework/security/kerberos/ -- http://repo.spring.io/libs-release/org/springframework/security/kerberos/ +projects. Samples can be compiled manually by building main +distribution from +https://github.com/spring-projects/spring-security-kerberos. [IMPORTANT] ==== -If you download and run sample from a maven repo it will not work -until a correct configuration is applied. See notes below for specific -samples. +If you run sample as is it will not work until a correct configuration +is applied. See notes below for specific samples. ==== <> sample for Windows environment @@ -49,6 +44,8 @@ server: ad-server: ldap://WIN-EKBO0EQ7TS7.example.org/ service-principal: HTTP/neo.example.org@EXAMPLE.ORG keytab-location: /tmp/tomcat.keytab + ldap-search-base: dc=example,dc=org + ldap-search-filter: "(| (userPrincipalName={0}) (sAMAccountName={0}))" ---- In above you can see the default configuration for this sample. You can override these settings using a normal Spring Boot tricks like diff --git a/docs/src/reference/asciidoc/ssk.adoc b/docs/src/reference/asciidoc/ssk.adoc index 1600250..cb06a3b 100644 --- a/docs/src/reference/asciidoc/ssk.adoc +++ b/docs/src/reference/asciidoc/ssk.adoc @@ -73,3 +73,26 @@ With keytab file. include::samples/KerberosRestTemplateConfig.java[tags=snippetB] ---- +[[ssk-kerberosldap]] +== Authentication with LDAP Services + +With most of your samples we're using `DummyUserDetailsService` +because there is not necessarily need to query a real user details +once kerberos authentication is successful and we can use kerberos +principal info to create that dummy user. However there is a way to +access kerberized LDAP services in a say way and query user details +from there. + +`KerberosLdapContextSource` can be used to bind into LDAP via kerberos +which is at least proven to work well with Windows AD services. + +[source,java,indent=0] +---- +include::samples/KerberosLdapContextSourceConfig.java[tags=snippetA] +---- + +[TIP] +==== +Sample <> is currently configured to +query user details from AD if authentication happen via kerberos. +==== diff --git a/spring-security-kerberos-client/src/test/java/org/springframework/security/kerberos/client/docs/KerberosLdapContextSourceConfig.java b/spring-security-kerberos-client/src/test/java/org/springframework/security/kerberos/client/docs/KerberosLdapContextSourceConfig.java new file mode 100644 index 0000000..dc5906e --- /dev/null +++ b/spring-security-kerberos-client/src/test/java/org/springframework/security/kerberos/client/docs/KerberosLdapContextSourceConfig.java @@ -0,0 +1,67 @@ +/* + * Copyright 2015 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.springframework.security.kerberos.client.docs; + +import org.springframework.beans.factory.annotation.Value; +import org.springframework.context.annotation.Bean; +import org.springframework.core.io.FileSystemResource; +import org.springframework.security.kerberos.client.KerberosLdapContextSource; +import org.springframework.security.kerberos.client.config.SunJaasKrb5LoginConfig; +import org.springframework.security.ldap.search.FilterBasedLdapUserSearch; +import org.springframework.security.ldap.userdetails.LdapUserDetailsMapper; +import org.springframework.security.ldap.userdetails.LdapUserDetailsService; + +public class KerberosLdapContextSourceConfig { + +//tag::snippetA[] + @Value("${app.ad-server}") + private String adServer; + + @Value("${app.service-principal}") + private String servicePrincipal; + + @Value("${app.keytab-location}") + private String keytabLocation; + + @Value("${app.ldap-search-base}") + private String ldapSearchBase; + + @Value("${app.ldap-search-filter}") + private String ldapSearchFilter; + + @Bean + public KerberosLdapContextSource kerberosLdapContextSource() { + KerberosLdapContextSource contextSource = new KerberosLdapContextSource(adServer); + SunJaasKrb5LoginConfig loginConfig = new SunJaasKrb5LoginConfig(); + loginConfig.setKeyTabLocation(new FileSystemResource(keytabLocation)); + loginConfig.setServicePrincipal(servicePrincipal); + loginConfig.setDebug(true); + loginConfig.setIsInitiator(true); + contextSource.setLoginConfig(loginConfig); + return contextSource; + } + + @Bean + public LdapUserDetailsService ldapUserDetailsService() { + FilterBasedLdapUserSearch userSearch = + new FilterBasedLdapUserSearch(ldapSearchBase, ldapSearchFilter, kerberosLdapContextSource()); + LdapUserDetailsService service = new LdapUserDetailsService(userSearch); + service.setUserDetailsMapper(new LdapUserDetailsMapper()); + return service; + } +//end::snippetA[] + +}