From 53dea0b169b9ce3dd42795e923d7dedf9728715f Mon Sep 17 00:00:00 2001 From: Mike Wiesner Date: Thu, 3 Sep 2009 12:31:47 +0000 Subject: [PATCH] SES-12: Add debug logging for easier troubleshooting Added some configuration checks --- spring-security-kerberos-core/pom.xml | 6 ++++++ ...KerberosServiceAuthenticationProvider.java | 19 ++++++++++++++++++- .../SpnegoAuthenticationProcessingFilter.java | 15 +++++++++++++++ .../kerberos/web/SpnegoEntryPoint.java | 10 +++++++++- 4 files changed, 48 insertions(+), 2 deletions(-) diff --git a/spring-security-kerberos-core/pom.xml b/spring-security-kerberos-core/pom.xml index be5fe49..4b211b8 100644 --- a/spring-security-kerberos-core/pom.xml +++ b/spring-security-kerberos-core/pom.xml @@ -109,6 +109,12 @@ 2.4 provided + + commons-logging + commons-logging + 1.1.1 + true + diff --git a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/KerberosServiceAuthenticationProvider.java b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/KerberosServiceAuthenticationProvider.java index 4302af9..ebbf172 100644 --- a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/KerberosServiceAuthenticationProvider.java +++ b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/KerberosServiceAuthenticationProvider.java @@ -16,6 +16,9 @@ package org.springframework.security.extensions.kerberos; +import org.apache.commons.logging.Log; +import org.apache.commons.logging.LogFactory; +import org.springframework.beans.factory.InitializingBean; import org.springframework.security.authentication.AccountStatusUserDetailsChecker; import org.springframework.security.authentication.AuthenticationProvider; import org.springframework.security.core.Authentication; @@ -24,6 +27,7 @@ import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.core.userdetails.UserDetailsChecker; import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.extensions.kerberos.web.SpnegoAuthenticationProcessingFilter; +import org.springframework.util.Assert; /** @@ -47,7 +51,9 @@ import org.springframework.security.extensions.kerberos.web.SpnegoAuthentication * @see SpnegoAuthenticationProcessingFilter */ public class KerberosServiceAuthenticationProvider implements - AuthenticationProvider { + AuthenticationProvider, InitializingBean { + + private static final Log LOG = LogFactory.getLog(KerberosServiceAuthenticationProvider.class); private KerberosTicketValidator ticketValidator; private UserDetailsService userDetailsService; @@ -76,7 +82,9 @@ public class KerberosServiceAuthenticationProvider implements throws AuthenticationException { KerberosServiceRequestToken auth = (KerberosServiceRequestToken) authentication; byte[] token = auth.getToken(); + LOG.debug("Try to validate Kerberos Token"); String username = this.ticketValidator.validateTicket(token); + LOG.debug("Succesfully validated " + username); UserDetails userDetails = this.userDetailsService.loadUserByUsername(username); userDetailsChecker.check(userDetails); additionalAuthenticationChecks(userDetails, auth); @@ -106,4 +114,13 @@ public class KerberosServiceAuthenticationProvider implements return KerberosServiceRequestToken.class.isAssignableFrom(auth); } + /* (non-Javadoc) + * @see org.springframework.beans.factory.InitializingBean#afterPropertiesSet() + */ + @Override + public void afterPropertiesSet() throws Exception { + Assert.notNull(this.ticketValidator, "ticketValidator must be specified"); + Assert.notNull(this.userDetailsService, "userDetailsService must be specified"); + } + } diff --git a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoAuthenticationProcessingFilter.java b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoAuthenticationProcessingFilter.java index 440e1ce..2f126b7 100644 --- a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoAuthenticationProcessingFilter.java +++ b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoAuthenticationProcessingFilter.java @@ -32,6 +32,7 @@ import org.springframework.security.core.AuthenticationException; import org.springframework.security.core.context.SecurityContextHolder; import org.springframework.security.extensions.kerberos.KerberosServiceAuthenticationProvider; import org.springframework.security.extensions.kerberos.KerberosServiceRequestToken; +import org.springframework.util.Assert; import org.springframework.web.filter.GenericFilterBean; /** @@ -102,7 +103,11 @@ public class SpnegoAuthenticationProcessingFilter extends GenericFilterBean { String header = request.getHeader("Authorization"); + if ((header != null) && header.startsWith("Negotiate ")) { + if (logger.isDebugEnabled()) { + logger.debug("Received Negotiate Header for request "+ request.getRequestURL()+ ": " + header); + } String base64Token = header.substring(10); byte[] kerberosTicket = Base64.decodeBase64(base64Token.trim() .getBytes()); @@ -114,6 +119,7 @@ public class SpnegoAuthenticationProcessingFilter extends GenericFilterBean { .authenticate(authenticationRequest); } catch (AuthenticationException e) { // That shouldn't happen, as it is most likely a wrong configuration on the server side + logger.warn("Negotiate Header was invalid: "+header, e); SecurityContextHolder.clearContext(); response.setStatus(HttpServletResponse.SC_INTERNAL_SERVER_ERROR); response.flushBuffer(); @@ -135,5 +141,14 @@ public class SpnegoAuthenticationProcessingFilter extends GenericFilterBean { public void setAuthenticationManager(AuthenticationManager authenticationManager) { this.authenticationManager = authenticationManager; } + + /* (non-Javadoc) + * @see org.springframework.web.filter.GenericFilterBean#afterPropertiesSet() + */ + @Override + public void afterPropertiesSet() throws ServletException { + super.afterPropertiesSet(); + Assert.notNull(this.authenticationManager, "authenticationManager must be specified"); + } } diff --git a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoEntryPoint.java b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoEntryPoint.java index ae5f88f..782a18b 100644 --- a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoEntryPoint.java +++ b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoEntryPoint.java @@ -21,7 +21,10 @@ import java.io.IOException; import javax.servlet.ServletException; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; +import javax.servlet.http.HttpUtils; +import org.apache.commons.logging.Log; +import org.apache.commons.logging.LogFactory; import org.springframework.security.core.AuthenticationException; import org.springframework.security.web.AuthenticationEntryPoint; @@ -34,6 +37,8 @@ import org.springframework.security.web.AuthenticationEntryPoint; * @see SpnegoAuthenticationProcessingFilter */ public class SpnegoEntryPoint implements AuthenticationEntryPoint { + + private static final Log LOG = LogFactory.getLog(SpnegoEntryPoint.class); /* (non-Javadoc) * @see org.springframework.security.web.AuthenticationEntryPoint#commence(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, org.springframework.security.core.AuthenticationException) @@ -41,7 +46,10 @@ public class SpnegoEntryPoint implements AuthenticationEntryPoint { @Override public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException ex) throws IOException, ServletException { - response.addHeader("WWW-Authenticate", "Negotiate"); + if (LOG.isDebugEnabled()) { + LOG.debug("Sending back Negotiate Header for request: "+request.getRequestURL()); + } + response.addHeader("WWW-Authenticate", "Negotiate"); response.setStatus(HttpServletResponse.SC_UNAUTHORIZED); response.flushBuffer();