From 0cf070a457e23265e4ba2fda0a79d40b4877ffee Mon Sep 17 00:00:00 2001 From: Mike Wiesner Date: Wed, 26 Aug 2009 15:30:04 +0000 Subject: [PATCH] minor changes --- ...KerberosServiceAuthenticationProvider.java | 16 +++++++ .../SunJaasKerberosTicketValidator.java | 48 +++++++++++++++---- .../SpnegoAuthenticationProcessingFilter.java | 4 +- 3 files changed, 56 insertions(+), 12 deletions(-) diff --git a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/KerberosServiceAuthenticationProvider.java b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/KerberosServiceAuthenticationProvider.java index a22e5e1..3e37004 100644 --- a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/KerberosServiceAuthenticationProvider.java +++ b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/KerberosServiceAuthenticationProvider.java @@ -1,3 +1,19 @@ +/* + * Copyright 2002-2008 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + package org.springframework.security.extensions.kerberos; import org.springframework.security.authentication.AuthenticationProvider; diff --git a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/SunJaasKerberosTicketValidator.java b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/SunJaasKerberosTicketValidator.java index c8e36de..e3085ba 100644 --- a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/SunJaasKerberosTicketValidator.java +++ b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/SunJaasKerberosTicketValidator.java @@ -1,3 +1,19 @@ +/* + * Copyright 2002-2008 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + package org.springframework.security.extensions.kerberos; import java.security.Principal; @@ -21,14 +37,25 @@ import org.springframework.core.io.Resource; import org.springframework.security.authentication.BadCredentialsException; import org.springframework.util.Assert; +/** + * + * @author Mike Wiesner + * @since 1.0 + * @version $Id$ + */ public class SunJaasKerberosTicketValidator implements KerberosTicketValidator, InitializingBean { private String servicePrincipal; private Resource keyTabLocation; private Subject serviceSubject; + private boolean debug = false; + + public void setDebug(boolean debug) { + this.debug = debug; + } public String validateTicket(byte[] token) { - String username = null; + String username = null; try { username = Subject.doAs(this.serviceSubject, new KerberosValidateAction(token)); } catch (PrivilegedActionException e) { @@ -37,7 +64,6 @@ public class SunJaasKerberosTicketValidator implements KerberosTicketValidator, return username; } - public void setServicePrincipal(String servicePrincipal) { this.servicePrincipal = servicePrincipal; } @@ -48,9 +74,10 @@ public class SunJaasKerberosTicketValidator implements KerberosTicketValidator, @Override public void afterPropertiesSet() throws Exception { - Assert.notNull(this.servicePrincipal, "ServicePrincipal muss gesetzt werden"); - Assert.notNull(this.keyTabLocation, "KeyTab muss gesetzt werden"); - LoginConfig loginConfig = new LoginConfig(this.keyTabLocation.getURL().toExternalForm(), servicePrincipal); + Assert.notNull(this.servicePrincipal, "servicePrincipal must be specified"); + Assert.notNull(this.keyTabLocation, "keyTab must be specified"); + LoginConfig loginConfig = new LoginConfig(this.keyTabLocation.getURL().toExternalForm(), this.servicePrincipal, + this.debug); Set princ = new HashSet(1); princ.add(new KerberosPrincipal(this.servicePrincipal)); Subject sub = new Subject(false, princ, new HashSet(), new HashSet()); @@ -80,8 +107,9 @@ public class SunJaasKerberosTicketValidator implements KerberosTicketValidator, private static class LoginConfig extends Configuration { private String keyTabLocation; private String servicePrincipalName; + private boolean debug; - public LoginConfig(String keyTabLocation, String servicePrincipalName) { + public LoginConfig(String keyTabLocation, String servicePrincipalName, boolean debug) { this.keyTabLocation = keyTabLocation; this.servicePrincipalName = servicePrincipalName; } @@ -94,15 +122,15 @@ public class SunJaasKerberosTicketValidator implements KerberosTicketValidator, options.put("principal", this.servicePrincipalName); options.put("storeKey", "true"); options.put("doNotPrompt", "true"); - options.put("debug", "true"); - options.put("isInitiator", "false"); + if (this.debug) { + options.put("debug", "true"); + } + options.put("isInitiator", "true"); return new AppConfigurationEntry[] { new AppConfigurationEntry("com.sun.security.auth.module.Krb5LoginModule", AppConfigurationEntry.LoginModuleControlFlag.REQUIRED, options), }; } } - - } diff --git a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoAuthenticationProcessingFilter.java b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoAuthenticationProcessingFilter.java index 5a11e42..ba56a2c 100644 --- a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoAuthenticationProcessingFilter.java +++ b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoAuthenticationProcessingFilter.java @@ -66,9 +66,9 @@ public class SpnegoAuthenticationProcessingFilter extends GenericFilterBean { authentication = authenticationManager .authenticate(authenticationRequest); } catch (AuthenticationException e) { + // That shouldn't happen, as it is most likely a wrong configuration on server side SecurityContextHolder.clearContext(); - response - .setStatus(HttpServletResponse.SC_INTERNAL_SERVER_ERROR); + response.setStatus(HttpServletResponse.SC_INTERNAL_SERVER_ERROR); response.flushBuffer(); return; }