From 75ea798249e412d9bcfa41adaf9f6b36db653082 Mon Sep 17 00:00:00 2001
From: Mike Wiesner <mwiesner@gopivotal.com>
Date: Fri, 3 May 2013 12:03:27 +0200
Subject: [PATCH] Kerberos settings are now in kerberos.properties instead of
 in XML

---
 .../main/webapp/WEB-INF/kerberos.properties   | 22 +++++++++++++++++
 .../webapp/WEB-INF/server-side-kerberos.xml   | 17 ++++++++-----
 .../webapp/WEB-INF/spnego-with-form-login.xml | 19 +++++++++------
 ...pnego-with-server-side-kerberos-option.xml | 24 +++++++++++--------
 .../src/main/webapp/WEB-INF/spnego.xml        | 20 ++++++++++------
 5 files changed, 72 insertions(+), 30 deletions(-)
 create mode 100644 spring-security-kerberos-sample/src/main/webapp/WEB-INF/kerberos.properties

diff --git a/spring-security-kerberos-sample/src/main/webapp/WEB-INF/kerberos.properties b/spring-security-kerberos-sample/src/main/webapp/WEB-INF/kerberos.properties
new file mode 100644
index 0000000..5e24b68
--- /dev/null
+++ b/spring-security-kerberos-sample/src/main/webapp/WEB-INF/kerberos.properties
@@ -0,0 +1,22 @@
+# These settings are always needed
+# ================================
+
+krb.debug=true
+
+
+# These settings are only needed for SPNEGO Authentication
+# ========================================================
+
+krb.service.prinicipal=HTTP/web.springsource.com
+
+# Setting keyTabLocation to a classpath resource will most likely not work in a Java EE application Server
+# See the Javadoc of SunJaasKerberosTicketValidator for more information on that
+krb.keytab.location=file:/etc/web-springsource-com.keytab
+
+
+# These settings are only needed for server side Kerberos Authentication
+# ======================================================================
+
+# No Prefix is supported in krb.conf.location. It must always be an absolute path.
+krb.conf.location=/etc/krb5.conf
+
diff --git a/spring-security-kerberos-sample/src/main/webapp/WEB-INF/server-side-kerberos.xml b/spring-security-kerberos-sample/src/main/webapp/WEB-INF/server-side-kerberos.xml
index d3d279e..09dfd55 100644
--- a/spring-security-kerberos-sample/src/main/webapp/WEB-INF/server-side-kerberos.xml
+++ b/spring-security-kerberos-sample/src/main/webapp/WEB-INF/server-side-kerberos.xml
@@ -1,8 +1,11 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <beans xmlns="http://www.springframework.org/schema/beans"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:sec="http://www.springframework.org/schema/security"
-	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
-		http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd">
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xmlns:sec="http://www.springframework.org/schema/security"
+	xmlns:context="http://www.springframework.org/schema/context"
+	xsi:schemaLocation="http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.2.xsd
+		http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
+		http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd">
 
 	<!-- This configuration uses SPNEGO by default, but one could also use a form if he directly goes to /login.html -->
 	<sec:http>
@@ -18,7 +21,7 @@
 		class="org.springframework.security.extensions.kerberos.KerberosAuthenticationProvider">
 		<property name="kerberosClient">
 			<bean class="org.springframework.security.extensions.kerberos.SunJaasKerberosClient">
-				<property name="debug" value="true"/>
+				<property name="debug" value="${krb.debug}"/>
 			</bean>
 		</property>
 		<property name="userDetailsService" ref="dummyUserDetailsService"/>
@@ -26,9 +29,9 @@
 	
 	<bean
 		class="org.springframework.security.extensions.kerberos.GlobalSunJaasKerberosConfig">
-		<property name="debug" value="true" />
+		<property name="debug" value="${krb.debug}" />
 		<!-- You can point to a different kerberos config location here, if you don't want the default one -->
-		<!-- <property name="krbConfLocation" value="/etc/krb5.conf"/> -->
+		<property name="krbConfLocation" value="${krb.conf.location}"/>
 	</bean>
 
 	<!--
@@ -37,4 +40,6 @@
 	-->
 	<bean id="dummyUserDetailsService"
 		class="org.springframework.security.extensions.kerberos.sample.DummyUserDetailsService" />
+		
+	<context:property-placeholder location="/WEB-INF/kerberos.properties"/>
 </beans>
diff --git a/spring-security-kerberos-sample/src/main/webapp/WEB-INF/spnego-with-form-login.xml b/spring-security-kerberos-sample/src/main/webapp/WEB-INF/spnego-with-form-login.xml
index 2d62a9b..e64f371 100644
--- a/spring-security-kerberos-sample/src/main/webapp/WEB-INF/spnego-with-form-login.xml
+++ b/spring-security-kerberos-sample/src/main/webapp/WEB-INF/spnego-with-form-login.xml
@@ -1,8 +1,11 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <beans xmlns="http://www.springframework.org/schema/beans"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:sec="http://www.springframework.org/schema/security"
-	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
-		http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd">
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xmlns:sec="http://www.springframework.org/schema/security"
+	xmlns:context="http://www.springframework.org/schema/context"
+	xsi:schemaLocation="http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd
+		http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
+		http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.2.xsd">
 
 	<!-- This configuration uses SPNEGO by default, but one could also use a form if he directly goes to /login.html -->
 	<sec:http entry-point-ref="spnegoEntryPoint">
@@ -32,11 +35,11 @@
 		<property name="ticketValidator">
 			<bean
 				class="org.springframework.security.extensions.kerberos.SunJaasKerberosTicketValidator">
-				<property name="servicePrincipal" value="HTTP/web.springsource.com" />
+				<property name="servicePrincipal" value="${krb.service.prinicipal}" />
 				<!-- Setting keyTabLocation to a classpath resource will most likely not work in a Java EE application Server -->
 				<!-- See the Javadoc for more information on that -->
-				<property name="keyTabLocation" value="/etc/web-springsource-com.keytab" />
-				<property name="debug" value="true" />
+				<property name="keyTabLocation" value="${krb.keytab.location}" />
+				<property name="debug" value="${krb.debug}" />
 			</bean>
 		</property>
 		<property name="userDetailsService" ref="dummyUserDetailsService" />
@@ -45,7 +48,8 @@
 	<!-- This bean definition enables a very detailed Kerberos logging -->
 	<bean
 		class="org.springframework.security.extensions.kerberos.GlobalSunJaasKerberosConfig">
-		<property name="debug" value="true" />
+		<property name="debug" value="${krb.debug}" />
+		<property name="krbConfLocation" value="${krb.conf.location}"/>
 	</bean>
 
 	<!--
@@ -55,4 +59,5 @@
 	<bean id="dummyUserDetailsService"
 		class="org.springframework.security.extensions.kerberos.sample.DummyUserDetailsService" />
 
+	<context:property-placeholder location="/WEB-INF/kerberos.properties"/>
 </beans>
diff --git a/spring-security-kerberos-sample/src/main/webapp/WEB-INF/spnego-with-server-side-kerberos-option.xml b/spring-security-kerberos-sample/src/main/webapp/WEB-INF/spnego-with-server-side-kerberos-option.xml
index 059c2c8..d648b78 100644
--- a/spring-security-kerberos-sample/src/main/webapp/WEB-INF/spnego-with-server-side-kerberos-option.xml
+++ b/spring-security-kerberos-sample/src/main/webapp/WEB-INF/spnego-with-server-side-kerberos-option.xml
@@ -1,8 +1,11 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <beans xmlns="http://www.springframework.org/schema/beans"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:sec="http://www.springframework.org/schema/security"
-	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
-		http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd">
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xmlns:sec="http://www.springframework.org/schema/security"
+	xmlns:context="http://www.springframework.org/schema/context"
+	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
+		http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd
+		http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.2.xsd">
 
 	<!-- This configuration uses SPNEGO by default, but one could also use a form if he directly goes to /login.html -->
 	<sec:http entry-point-ref="spnegoEntryPoint">
@@ -28,7 +31,7 @@
 		class="org.springframework.security.extensions.kerberos.KerberosAuthenticationProvider">
 		<property name="kerberosClient">
 			<bean class="org.springframework.security.extensions.kerberos.SunJaasKerberosClient">
-				<property name="debug" value="true"/>
+				<property name="debug" value="${krb.debug}"/>
 			</bean>
 		</property>
 		<property name="userDetailsService" ref="dummyUserDetailsService"/>
@@ -39,11 +42,11 @@
 		<property name="ticketValidator">
 			<bean
 				class="org.springframework.security.extensions.kerberos.SunJaasKerberosTicketValidator">
-				<property name="servicePrincipal" value="HTTP/web.springsource.com" />
+				<property name="servicePrincipal" value="${krb.service.prinicipal}" />
 				<!-- Setting keyTabLocation to a classpath resource will most likely not work in a Java EE application Server -->
 				<!-- See the Javadoc for more information on that -->
-				<property name="keyTabLocation" value="/etc/web-springsource-com.keytab" />
-				<property name="debug" value="true" />
+				<property name="keyTabLocation" value="${krb.keytab.location}" />
+				<property name="debug" value="${krb.debug}" />
 			</bean>
 		</property>
 		<property name="userDetailsService" ref="dummyUserDetailsService" />
@@ -51,9 +54,8 @@
 	
 	<bean
 		class="org.springframework.security.extensions.kerberos.GlobalSunJaasKerberosConfig">
-		<property name="debug" value="true" />
-		<!-- You can point to a different kerberos config location here, if you don't want the default one -->
-		<!-- <property name="krbConfLocation" value="/etc/krb5.conf"/> -->
+		<property name="debug" value="${krb.debug}" />
+		<property name="krbConfLocation" value="${krb.conf.location}"/>
 	</bean>
 
 	<!--
@@ -62,5 +64,7 @@
 	-->
 	<bean id="dummyUserDetailsService"
 		class="org.springframework.security.extensions.kerberos.sample.DummyUserDetailsService" />
+		
+	<context:property-placeholder location="/WEB-INF/kerberos.properties"/>
 
 </beans>
diff --git a/spring-security-kerberos-sample/src/main/webapp/WEB-INF/spnego.xml b/spring-security-kerberos-sample/src/main/webapp/WEB-INF/spnego.xml
index d041cde..8fd3d0f 100644
--- a/spring-security-kerberos-sample/src/main/webapp/WEB-INF/spnego.xml
+++ b/spring-security-kerberos-sample/src/main/webapp/WEB-INF/spnego.xml
@@ -1,8 +1,11 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <beans xmlns="http://www.springframework.org/schema/beans"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:sec="http://www.springframework.org/schema/security"
-	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
-		http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd">
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xmlns:sec="http://www.springframework.org/schema/security"
+	xmlns:context="http://www.springframework.org/schema/context"
+	xsi:schemaLocation="http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.2.xsd
+		http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd
+		http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd">
 
 	<sec:http entry-point-ref="spnegoEntryPoint">
 		<sec:intercept-url pattern="/secure/**" access="IS_AUTHENTICATED_FULLY" />
@@ -29,11 +32,11 @@
 		<property name="ticketValidator">
 			<bean
 				class="org.springframework.security.extensions.kerberos.SunJaasKerberosTicketValidator">
-				<property name="servicePrincipal" value="HTTP/web.springsource.com" />
+				<property name="servicePrincipal" value="${krb.service.prinicipal}" />
 				<!-- Setting keyTabLocation to a classpath resource will most likely not work in a Java EE application Server -->
 				<!-- See the Javadoc for more information on that -->
-				<property name="keyTabLocation" value="/etc/web-springsource-com.keytab" />
-				<property name="debug" value="true" />
+				<property name="keyTabLocation" value="${krb.keytab.location}" />
+				<property name="debug" value="${krb.debug}" />
 			</bean>
 		</property>
 		<property name="userDetailsService" ref="dummyUserDetailsService" />
@@ -42,7 +45,8 @@
 	<!-- This bean definition enables a very detailed Kerberos logging -->
 	<bean
 		class="org.springframework.security.extensions.kerberos.GlobalSunJaasKerberosConfig">
-		<property name="debug" value="true" />
+		<property name="debug" value="${krb.debug}" />
+		<property name="krbConfLocation" value="${krb.conf.location}"/>
 	</bean>
 
 	<!--
@@ -51,5 +55,7 @@
 	-->
 	<bean id="dummyUserDetailsService"
 		class="org.springframework.security.extensions.kerberos.sample.DummyUserDetailsService" />
+		
+	<context:property-placeholder location="/WEB-INF/kerberos.properties"/>
 
 </beans>