SES-12: Add debug logging for easier troubleshooting

Added some configuration checks

spring-security-kerberos-core/pom.xml

@@ -109,6 +109,12 @@
 			<version>2.4</version>
 			<scope>provided</scope>
 		</dependency>
+		   <dependency>
+                <groupId>commons-logging</groupId>
+                <artifactId>commons-logging</artifactId>
+                <version>1.1.1</version>
+                <optional>true</optional>
+            </dependency>
 	</dependencies>
 
 	<build>

spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/KerberosServiceAuthenticationProvider.java

@@ -16,6 +16,9 @@
 
 package org.springframework.security.extensions.kerberos;
 
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+import org.springframework.beans.factory.InitializingBean;
 import org.springframework.security.authentication.AccountStatusUserDetailsChecker;
 import org.springframework.security.authentication.AuthenticationProvider;
 import org.springframework.security.core.Authentication;
@@ -24,6 +27,7 @@ import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.security.core.userdetails.UserDetailsChecker;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.extensions.kerberos.web.SpnegoAuthenticationProcessingFilter;
+import org.springframework.util.Assert;
 
 
 /**
@@ -47,7 +51,9 @@ import org.springframework.security.extensions.kerberos.web.SpnegoAuthentication
  * @see SpnegoAuthenticationProcessingFilter
  */
 public class KerberosServiceAuthenticationProvider implements
-		AuthenticationProvider {
+		AuthenticationProvider, InitializingBean {
+	
+	private static final Log LOG = LogFactory.getLog(KerberosServiceAuthenticationProvider.class);
 	
 	private KerberosTicketValidator ticketValidator;
 	private UserDetailsService userDetailsService;
@@ -76,7 +82,9 @@ public class KerberosServiceAuthenticationProvider implements
 			throws AuthenticationException {
 		KerberosServiceRequestToken auth = (KerberosServiceRequestToken) authentication;
 		byte[] token = auth.getToken();
+		LOG.debug("Try to validate Kerberos Token");
 		String username = this.ticketValidator.validateTicket(token);
+		LOG.debug("Succesfully validated " + username);
 		UserDetails userDetails = this.userDetailsService.loadUserByUsername(username);
 		userDetailsChecker.check(userDetails);
 		additionalAuthenticationChecks(userDetails, auth);
@@ -106,4 +114,13 @@ public class KerberosServiceAuthenticationProvider implements
 		return KerberosServiceRequestToken.class.isAssignableFrom(auth);
 	}
 
+	/* (non-Javadoc)
+	 * @see org.springframework.beans.factory.InitializingBean#afterPropertiesSet()
+	 */
+	@Override
+	public void afterPropertiesSet() throws Exception {
+		Assert.notNull(this.ticketValidator, "ticketValidator must be specified");
+		Assert.notNull(this.userDetailsService, "userDetailsService must be specified");
+	}
+
 }

spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoAuthenticationProcessingFilter.java

@@ -32,6 +32,7 @@ import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.extensions.kerberos.KerberosServiceAuthenticationProvider;
 import org.springframework.security.extensions.kerberos.KerberosServiceRequestToken;
+import org.springframework.util.Assert;
 import org.springframework.web.filter.GenericFilterBean;
 
 /**
@@ -102,7 +103,11 @@ public class SpnegoAuthenticationProcessingFilter extends GenericFilterBean {
 
 		String header = request.getHeader("Authorization");
 
+
 		if ((header != null) && header.startsWith("Negotiate ")) {
+			if (logger.isDebugEnabled()) { 
+				logger.debug("Received Negotiate Header for request "+ request.getRequestURL()+ ": " + header);
+			}
 			String base64Token = header.substring(10);
 			byte[] kerberosTicket = Base64.decodeBase64(base64Token.trim()
 					.getBytes());
@@ -114,6 +119,7 @@ public class SpnegoAuthenticationProcessingFilter extends GenericFilterBean {
 						.authenticate(authenticationRequest);
 			} catch (AuthenticationException e) {
 				// That shouldn't happen, as it is most likely a wrong configuration on the server side
+				logger.warn("Negotiate Header was invalid: "+header, e);
 				SecurityContextHolder.clearContext();
 				response.setStatus(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
 				response.flushBuffer();
@@ -135,5 +141,14 @@ public class SpnegoAuthenticationProcessingFilter extends GenericFilterBean {
 	public void setAuthenticationManager(AuthenticationManager authenticationManager) {
 		this.authenticationManager = authenticationManager;
 	}
+	
+	/* (non-Javadoc)
+	 * @see org.springframework.web.filter.GenericFilterBean#afterPropertiesSet()
+	 */
+	@Override
+	public void afterPropertiesSet() throws ServletException {
+		super.afterPropertiesSet();
+		Assert.notNull(this.authenticationManager, "authenticationManager must be specified");
+	}
 
 }

spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoEntryPoint.java

@@ -21,7 +21,10 @@ import java.io.IOException;
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpUtils;
 
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.web.AuthenticationEntryPoint;
 
@@ -34,6 +37,8 @@ import org.springframework.security.web.AuthenticationEntryPoint;
  * @see SpnegoAuthenticationProcessingFilter
  */
 public class SpnegoEntryPoint implements AuthenticationEntryPoint {
+	
+	private static final Log LOG = LogFactory.getLog(SpnegoEntryPoint.class);
 
 	/* (non-Javadoc)
 	 * @see org.springframework.security.web.AuthenticationEntryPoint#commence(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, org.springframework.security.core.AuthenticationException)
@@ -41,7 +46,10 @@ public class SpnegoEntryPoint implements AuthenticationEntryPoint {
 	@Override
 	public void commence(HttpServletRequest request, HttpServletResponse response,
 			AuthenticationException ex) throws IOException, ServletException {
-        response.addHeader("WWW-Authenticate", "Negotiate");
+        if (LOG.isDebugEnabled()) {
+        	LOG.debug("Sending back Negotiate Header for request: "+request.getRequestURL());
+        }
+		response.addHeader("WWW-Authenticate", "Negotiate");
         response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
         response.flushBuffer();