diff --git a/spring-security-kerberos-core/pom.xml b/spring-security-kerberos-core/pom.xml
index be5fe49..4b211b8 100644
--- a/spring-security-kerberos-core/pom.xml
+++ b/spring-security-kerberos-core/pom.xml
@@ -109,6 +109,12 @@
2.4
provided
+
+ commons-logging
+ commons-logging
+ 1.1.1
+ true
+
diff --git a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/KerberosServiceAuthenticationProvider.java b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/KerberosServiceAuthenticationProvider.java
index 4302af9..ebbf172 100644
--- a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/KerberosServiceAuthenticationProvider.java
+++ b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/KerberosServiceAuthenticationProvider.java
@@ -16,6 +16,9 @@
package org.springframework.security.extensions.kerberos;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+import org.springframework.beans.factory.InitializingBean;
import org.springframework.security.authentication.AccountStatusUserDetailsChecker;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.core.Authentication;
@@ -24,6 +27,7 @@ import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsChecker;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.extensions.kerberos.web.SpnegoAuthenticationProcessingFilter;
+import org.springframework.util.Assert;
/**
@@ -47,7 +51,9 @@ import org.springframework.security.extensions.kerberos.web.SpnegoAuthentication
* @see SpnegoAuthenticationProcessingFilter
*/
public class KerberosServiceAuthenticationProvider implements
- AuthenticationProvider {
+ AuthenticationProvider, InitializingBean {
+
+ private static final Log LOG = LogFactory.getLog(KerberosServiceAuthenticationProvider.class);
private KerberosTicketValidator ticketValidator;
private UserDetailsService userDetailsService;
@@ -76,7 +82,9 @@ public class KerberosServiceAuthenticationProvider implements
throws AuthenticationException {
KerberosServiceRequestToken auth = (KerberosServiceRequestToken) authentication;
byte[] token = auth.getToken();
+ LOG.debug("Try to validate Kerberos Token");
String username = this.ticketValidator.validateTicket(token);
+ LOG.debug("Succesfully validated " + username);
UserDetails userDetails = this.userDetailsService.loadUserByUsername(username);
userDetailsChecker.check(userDetails);
additionalAuthenticationChecks(userDetails, auth);
@@ -106,4 +114,13 @@ public class KerberosServiceAuthenticationProvider implements
return KerberosServiceRequestToken.class.isAssignableFrom(auth);
}
+ /* (non-Javadoc)
+ * @see org.springframework.beans.factory.InitializingBean#afterPropertiesSet()
+ */
+ @Override
+ public void afterPropertiesSet() throws Exception {
+ Assert.notNull(this.ticketValidator, "ticketValidator must be specified");
+ Assert.notNull(this.userDetailsService, "userDetailsService must be specified");
+ }
+
}
diff --git a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoAuthenticationProcessingFilter.java b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoAuthenticationProcessingFilter.java
index 440e1ce..2f126b7 100644
--- a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoAuthenticationProcessingFilter.java
+++ b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoAuthenticationProcessingFilter.java
@@ -32,6 +32,7 @@ import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.extensions.kerberos.KerberosServiceAuthenticationProvider;
import org.springframework.security.extensions.kerberos.KerberosServiceRequestToken;
+import org.springframework.util.Assert;
import org.springframework.web.filter.GenericFilterBean;
/**
@@ -102,7 +103,11 @@ public class SpnegoAuthenticationProcessingFilter extends GenericFilterBean {
String header = request.getHeader("Authorization");
+
if ((header != null) && header.startsWith("Negotiate ")) {
+ if (logger.isDebugEnabled()) {
+ logger.debug("Received Negotiate Header for request "+ request.getRequestURL()+ ": " + header);
+ }
String base64Token = header.substring(10);
byte[] kerberosTicket = Base64.decodeBase64(base64Token.trim()
.getBytes());
@@ -114,6 +119,7 @@ public class SpnegoAuthenticationProcessingFilter extends GenericFilterBean {
.authenticate(authenticationRequest);
} catch (AuthenticationException e) {
// That shouldn't happen, as it is most likely a wrong configuration on the server side
+ logger.warn("Negotiate Header was invalid: "+header, e);
SecurityContextHolder.clearContext();
response.setStatus(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
response.flushBuffer();
@@ -135,5 +141,14 @@ public class SpnegoAuthenticationProcessingFilter extends GenericFilterBean {
public void setAuthenticationManager(AuthenticationManager authenticationManager) {
this.authenticationManager = authenticationManager;
}
+
+ /* (non-Javadoc)
+ * @see org.springframework.web.filter.GenericFilterBean#afterPropertiesSet()
+ */
+ @Override
+ public void afterPropertiesSet() throws ServletException {
+ super.afterPropertiesSet();
+ Assert.notNull(this.authenticationManager, "authenticationManager must be specified");
+ }
}
diff --git a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoEntryPoint.java b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoEntryPoint.java
index ae5f88f..782a18b 100644
--- a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoEntryPoint.java
+++ b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoEntryPoint.java
@@ -21,7 +21,10 @@ import java.io.IOException;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpUtils;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.AuthenticationEntryPoint;
@@ -34,6 +37,8 @@ import org.springframework.security.web.AuthenticationEntryPoint;
* @see SpnegoAuthenticationProcessingFilter
*/
public class SpnegoEntryPoint implements AuthenticationEntryPoint {
+
+ private static final Log LOG = LogFactory.getLog(SpnegoEntryPoint.class);
/* (non-Javadoc)
* @see org.springframework.security.web.AuthenticationEntryPoint#commence(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, org.springframework.security.core.AuthenticationException)
@@ -41,7 +46,10 @@ public class SpnegoEntryPoint implements AuthenticationEntryPoint {
@Override
public void commence(HttpServletRequest request, HttpServletResponse response,
AuthenticationException ex) throws IOException, ServletException {
- response.addHeader("WWW-Authenticate", "Negotiate");
+ if (LOG.isDebugEnabled()) {
+ LOG.debug("Sending back Negotiate Header for request: "+request.getRequestURL());
+ }
+ response.addHeader("WWW-Authenticate", "Negotiate");
response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
response.flushBuffer();