Kerberos settings are now in kerberos.properties instead of in XML

spring-security-kerberos-sample/src/main/webapp/WEB-INF/kerberos.properties

@@ -0,0 +1,22 @@
+# These settings are always needed
+# ================================
+
+krb.debug=true
+
+
+# These settings are only needed for SPNEGO Authentication
+# ========================================================
+
+krb.service.prinicipal=HTTP/web.springsource.com
+
+# Setting keyTabLocation to a classpath resource will most likely not work in a Java EE application Server
+# See the Javadoc of SunJaasKerberosTicketValidator for more information on that
+krb.keytab.location=file:/etc/web-springsource-com.keytab
+
+
+# These settings are only needed for server side Kerberos Authentication
+# ======================================================================
+
+# No Prefix is supported in krb.conf.location. It must always be an absolute path.
+krb.conf.location=/etc/krb5.conf
+

spring-security-kerberos-sample/src/main/webapp/WEB-INF/server-side-kerberos.xml

@@ -1,8 +1,11 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <beans xmlns="http://www.springframework.org/schema/beans"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:sec="http://www.springframework.org/schema/security"
-	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
-		http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd">
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xmlns:sec="http://www.springframework.org/schema/security"
+	xmlns:context="http://www.springframework.org/schema/context"
+	xsi:schemaLocation="http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.2.xsd
+		http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
+		http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd">
 
 	<!-- This configuration uses SPNEGO by default, but one could also use a form if he directly goes to /login.html -->
 	<sec:http>
@@ -18,7 +21,7 @@
 		class="org.springframework.security.extensions.kerberos.KerberosAuthenticationProvider">
 		<property name="kerberosClient">
 			<bean class="org.springframework.security.extensions.kerberos.SunJaasKerberosClient">
-				<property name="debug" value="true"/>
+				<property name="debug" value="${krb.debug}"/>
 			</bean>
 		</property>
 		<property name="userDetailsService" ref="dummyUserDetailsService"/>
@@ -26,9 +29,9 @@
 	
 	<bean
 		class="org.springframework.security.extensions.kerberos.GlobalSunJaasKerberosConfig">
-		<property name="debug" value="true" />
+		<property name="debug" value="${krb.debug}" />
 		<!-- You can point to a different kerberos config location here, if you don't want the default one -->
-		<!-- <property name="krbConfLocation" value="/etc/krb5.conf"/> -->
+		<property name="krbConfLocation" value="${krb.conf.location}"/>
 	</bean>
 
 	<!--
@@ -37,4 +40,6 @@
 	-->
 	<bean id="dummyUserDetailsService"
 		class="org.springframework.security.extensions.kerberos.sample.DummyUserDetailsService" />
+		
+	<context:property-placeholder location="/WEB-INF/kerberos.properties"/>
 </beans>

spring-security-kerberos-sample/src/main/webapp/WEB-INF/spnego-with-form-login.xml

@@ -1,8 +1,11 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <beans xmlns="http://www.springframework.org/schema/beans"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:sec="http://www.springframework.org/schema/security"
-	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
-		http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd">
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xmlns:sec="http://www.springframework.org/schema/security"
+	xmlns:context="http://www.springframework.org/schema/context"
+	xsi:schemaLocation="http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd
+		http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
+		http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.2.xsd">
 
 	<!-- This configuration uses SPNEGO by default, but one could also use a form if he directly goes to /login.html -->
 	<sec:http entry-point-ref="spnegoEntryPoint">
@@ -32,11 +35,11 @@
 		<property name="ticketValidator">
 			<bean
 				class="org.springframework.security.extensions.kerberos.SunJaasKerberosTicketValidator">
-				<property name="servicePrincipal" value="HTTP/web.springsource.com" />
+				<property name="servicePrincipal" value="${krb.service.prinicipal}" />
 				<!-- Setting keyTabLocation to a classpath resource will most likely not work in a Java EE application Server -->
 				<!-- See the Javadoc for more information on that -->
-				<property name="keyTabLocation" value="/etc/web-springsource-com.keytab" />
-				<property name="debug" value="true" />
+				<property name="keyTabLocation" value="${krb.keytab.location}" />
+				<property name="debug" value="${krb.debug}" />
 			</bean>
 		</property>
 		<property name="userDetailsService" ref="dummyUserDetailsService" />
@@ -45,7 +48,8 @@
 	<!-- This bean definition enables a very detailed Kerberos logging -->
 	<bean
 		class="org.springframework.security.extensions.kerberos.GlobalSunJaasKerberosConfig">
-		<property name="debug" value="true" />
+		<property name="debug" value="${krb.debug}" />
+		<property name="krbConfLocation" value="${krb.conf.location}"/>
 	</bean>
 
 	<!--
@@ -55,4 +59,5 @@
 	<bean id="dummyUserDetailsService"
 		class="org.springframework.security.extensions.kerberos.sample.DummyUserDetailsService" />
 
+	<context:property-placeholder location="/WEB-INF/kerberos.properties"/>
 </beans>

spring-security-kerberos-sample/src/main/webapp/WEB-INF/spnego-with-server-side-kerberos-option.xml

@@ -1,8 +1,11 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <beans xmlns="http://www.springframework.org/schema/beans"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:sec="http://www.springframework.org/schema/security"
-	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
-		http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd">
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xmlns:sec="http://www.springframework.org/schema/security"
+	xmlns:context="http://www.springframework.org/schema/context"
+	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
+		http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd
+		http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.2.xsd">
 
 	<!-- This configuration uses SPNEGO by default, but one could also use a form if he directly goes to /login.html -->
 	<sec:http entry-point-ref="spnegoEntryPoint">
@@ -28,7 +31,7 @@
 		class="org.springframework.security.extensions.kerberos.KerberosAuthenticationProvider">
 		<property name="kerberosClient">
 			<bean class="org.springframework.security.extensions.kerberos.SunJaasKerberosClient">
-				<property name="debug" value="true"/>
+				<property name="debug" value="${krb.debug}"/>
 			</bean>
 		</property>
 		<property name="userDetailsService" ref="dummyUserDetailsService"/>
@@ -39,11 +42,11 @@
 		<property name="ticketValidator">
 			<bean
 				class="org.springframework.security.extensions.kerberos.SunJaasKerberosTicketValidator">
-				<property name="servicePrincipal" value="HTTP/web.springsource.com" />
+				<property name="servicePrincipal" value="${krb.service.prinicipal}" />
 				<!-- Setting keyTabLocation to a classpath resource will most likely not work in a Java EE application Server -->
 				<!-- See the Javadoc for more information on that -->
-				<property name="keyTabLocation" value="/etc/web-springsource-com.keytab" />
-				<property name="debug" value="true" />
+				<property name="keyTabLocation" value="${krb.keytab.location}" />
+				<property name="debug" value="${krb.debug}" />
 			</bean>
 		</property>
 		<property name="userDetailsService" ref="dummyUserDetailsService" />
@@ -51,9 +54,8 @@
 	
 	<bean
 		class="org.springframework.security.extensions.kerberos.GlobalSunJaasKerberosConfig">
-		<property name="debug" value="true" />
-		<!-- You can point to a different kerberos config location here, if you don't want the default one -->
-		<!-- <property name="krbConfLocation" value="/etc/krb5.conf"/> -->
+		<property name="debug" value="${krb.debug}" />
+		<property name="krbConfLocation" value="${krb.conf.location}"/>
 	</bean>
 
 	<!--
@@ -62,5 +64,7 @@
 	-->
 	<bean id="dummyUserDetailsService"
 		class="org.springframework.security.extensions.kerberos.sample.DummyUserDetailsService" />
+		
+	<context:property-placeholder location="/WEB-INF/kerberos.properties"/>
 
 </beans>

spring-security-kerberos-sample/src/main/webapp/WEB-INF/spnego.xml

@@ -1,8 +1,11 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <beans xmlns="http://www.springframework.org/schema/beans"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:sec="http://www.springframework.org/schema/security"
-	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
-		http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd">
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xmlns:sec="http://www.springframework.org/schema/security"
+	xmlns:context="http://www.springframework.org/schema/context"
+	xsi:schemaLocation="http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.2.xsd
+		http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd
+		http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd">
 
 	<sec:http entry-point-ref="spnegoEntryPoint">
 		<sec:intercept-url pattern="/secure/**" access="IS_AUTHENTICATED_FULLY" />
@@ -29,11 +32,11 @@
 		<property name="ticketValidator">
 			<bean
 				class="org.springframework.security.extensions.kerberos.SunJaasKerberosTicketValidator">
-				<property name="servicePrincipal" value="HTTP/web.springsource.com" />
+				<property name="servicePrincipal" value="${krb.service.prinicipal}" />
 				<!-- Setting keyTabLocation to a classpath resource will most likely not work in a Java EE application Server -->
 				<!-- See the Javadoc for more information on that -->
-				<property name="keyTabLocation" value="/etc/web-springsource-com.keytab" />
-				<property name="debug" value="true" />
+				<property name="keyTabLocation" value="${krb.keytab.location}" />
+				<property name="debug" value="${krb.debug}" />
 			</bean>
 		</property>
 		<property name="userDetailsService" ref="dummyUserDetailsService" />
@@ -42,7 +45,8 @@
 	<!-- This bean definition enables a very detailed Kerberos logging -->
 	<bean
 		class="org.springframework.security.extensions.kerberos.GlobalSunJaasKerberosConfig">
-		<property name="debug" value="true" />
+		<property name="debug" value="${krb.debug}" />
+		<property name="krbConfLocation" value="${krb.conf.location}"/>
 	</bean>
 
 	<!--
@@ -51,5 +55,7 @@
 	-->
 	<bean id="dummyUserDetailsService"
 		class="org.springframework.security.extensions.kerberos.sample.DummyUserDetailsService" />
+		
+	<context:property-placeholder location="/WEB-INF/kerberos.properties"/>
 
 </beans>