Spring/spring-security-kerberos
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Improve Modularity

Browse Source 
* Create spring-security-kerberos-web to limit dependencies for non-web based projects
* Add org.springframework.security.kerberos.authentication to better align with Spring Security packaging
* Add org.springframework.security.kerberos.authentication.sun to isolate Sun implementations of APIs
* Remove unnecessary dependencies

Fixes gh-20
This commit is contained in:
Rob Winch
2015-03-30 15:44:49 -05:00
parent f354bc29f2
commit 9a6165d7dc
36 changed files with 586 additions and 485 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
build.gradle
View File

@@ -101,16 +101,22 @@ project('spring-security-kerberos-core') {
description = 'Spring Security Kerberos Core'
dependencies {
compile "org.springframework:spring-core:$springVersion"
compile "org.springframework:spring-beans:$springVersion"
compile "org.springframework:spring-aop:$springVersion"
compile "org.springframework:spring-expression:$springVersion"
compile "org.springframework:spring-context:$springVersion"
compile "org.springframework:spring-tx:$springVersion"
compile "org.springframework:spring-jdbc:$springVersion"
compile "org.springframework.security:spring-security-core:$springSecurityVersion"
}
}
project('spring-security-kerberos-web') {
description = 'Spring Security Kerberos Web'
dependencies {
compile project(":spring-security-kerberos-core")
compile "org.springframework:spring-core:$springVersion"
compile "org.springframework:spring-web:$springVersion"
compile "org.springframework.security:spring-security-config:$springSecurityVersion"
compile "org.springframework.security:spring-security-web:$springSecurityVersion"
compile("javax.servlet:javax.servlet-api:$servletApi3Version", optional)
testCompile "org.springframework.security:spring-security-config:$springSecurityVersion"
testCompile "org.springframework:spring-test:$springVersion"
}
}
@@ -125,8 +131,12 @@ project('spring-security-kerberos-client') {
compile project(":spring-security-kerberos-core")
compile "org.springframework:spring-web:$springVersion"
compile "org.apache.httpcomponents:httpclient:$httpclientVersion"
optional("org.springframework.security:spring-security-ldap:$springSecurityVersion")
testCompile project(":spring-security-kerberos-test")
testCompile project(":spring-security-kerberos-web")
testCompile "org.springframework.security:spring-security-config:$springSecurityVersion"
testCompile "org.springframework.boot:spring-boot-autoconfigure:$springBootVersion"
testRuntime "org.apache.tomcat.embed:tomcat-embed-core:$tomcatEmbedVersion"
testRuntime "org.apache.tomcat.embed:tomcat-embed-logging-juli:$tomcatEmbedVersion"
@@ -174,8 +184,16 @@ configure(sampleServerProjects()) {
dependencies {
compile project(":spring-security-kerberos-samples-common")
compile project(":spring-security-kerberos-client")
compile project(":spring-security-kerberos-web")
compile "org.springframework.boot:spring-boot-starter-thymeleaf:$springBootVersion"
compile "org.springframework.security:spring-security-config:$springSecurityVersion"
compile "org.springframework.security:spring-security-ldap:$springSecurityVersion"
compile "org.springframework:spring-beans:$springVersion"
compile "org.springframework:spring-aop:$springVersion"
compile "org.springframework:spring-expression:$springVersion"
compile "org.springframework:spring-context:$springVersion"
compile "org.springframework:spring-tx:$springVersion"
compile "org.springframework:spring-jdbc:$springVersion"
testCompile "org.springframework:spring-test:$springVersion"
testCompile "org.hamcrest:hamcrest-core:$hamcrestVersion"
testCompile "org.hamcrest:hamcrest-library:$hamcrestVersion"
@@ -190,7 +208,15 @@ configure(sampleClientProjects()) {
dependencies {
compile project(":spring-security-kerberos-samples-common")
compile project(":spring-security-kerberos-client")
compile "org.springframework:spring-tx:$springVersion"
compile "org.springframework:spring-jdbc:$springVersion"
compile "org.springframework.boot:spring-boot-starter:$springBootVersion"
compile "org.springframework:spring-beans:$springVersion"
compile "org.springframework:spring-aop:$springVersion"
compile "org.springframework:spring-expression:$springVersion"
compile "org.springframework:spring-context:$springVersion"
compile "org.springframework:spring-tx:$springVersion"
compile "org.springframework:spring-jdbc:$springVersion"
testCompile "org.springframework:spring-test:$springVersion"
testCompile "org.hamcrest:hamcrest-core:$hamcrestVersion"
testCompile "org.hamcrest:hamcrest-library:$hamcrestVersion"
@@ -239,7 +265,8 @@ configure(rootProject) {
}
task copyDocsSamples(type: Copy) {
from 'spring-security-kerberos-core/src/test/java/org/springframework/security/kerberos/docs/'
from 'spring-security-kerberos-web/src/test/java/org/springframework/security/kerberos/docs/'
from 'spring-security-kerberos-web/src/test/resources/org/springframework/security/kerberos/docs/'
from 'spring-security-kerberos-client/src/test/java/org/springframework/security/kerberos/client/docs/'
include '**/*.java'
include '**/*.xml'

1
settings.gradle
View File

@@ -3,6 +3,7 @@ rootProject.name = 'spring-security-kerberos'
include 'spring-security-kerberos-core'
include 'spring-security-kerberos-client'
include 'spring-security-kerberos-test'
include 'spring-security-kerberos-web'
include 'spring-security-kerberos-samples'
include 'spring-security-kerberos-samples:sec-server-client-auth'
include 'spring-security-kerberos-samples:sec-server-spnego-form-auth'

8
spring-security-kerberos-client/src/test/java/org/springframework/security/kerberos/client/WebSecurityConfig.java
View File

@@ -29,10 +29,10 @@ import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.kerberos.KerberosServiceAuthenticationProvider;
import org.springframework.security.kerberos.SunJaasKerberosTicketValidator;
import org.springframework.security.kerberos.web.SpnegoAuthenticationProcessingFilter;
import org.springframework.security.kerberos.web.SpnegoEntryPoint;
import org.springframework.security.kerberos.authentication.KerberosServiceAuthenticationProvider;
import org.springframework.security.kerberos.authentication.sun.SunJaasKerberosTicketValidator;
import org.springframework.security.kerberos.web.authentication.SpnegoAuthenticationProcessingFilter;
import org.springframework.security.kerberos.web.authentication.SpnegoEntryPoint;
import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
@Configuration

8
spring-security-kerberos-client/src/test/java/org/springframework/security/kerberos/client/WebSecurityConfigSpnegoForward.java
View File

@@ -29,10 +29,10 @@ import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.kerberos.KerberosServiceAuthenticationProvider;
import org.springframework.security.kerberos.SunJaasKerberosTicketValidator;
import org.springframework.security.kerberos.web.SpnegoAuthenticationProcessingFilter;
import org.springframework.security.kerberos.web.SpnegoEntryPoint;
import org.springframework.security.kerberos.authentication.KerberosServiceAuthenticationProvider;
import org.springframework.security.kerberos.authentication.sun.SunJaasKerberosTicketValidator;
import org.springframework.security.kerberos.web.authentication.SpnegoAuthenticationProcessingFilter;
import org.springframework.security.kerberos.web.authentication.SpnegoEntryPoint;
import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
@Configuration

10
spring-security-kerberos-client/src/test/java/org/springframework/security/kerberos/client/WebSecurityConfigSuccessHandler.java
View File

@@ -29,11 +29,11 @@ import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.kerberos.KerberosServiceAuthenticationProvider;
import org.springframework.security.kerberos.SunJaasKerberosTicketValidator;
import org.springframework.security.kerberos.web.ResponseHeaderSettingKerberosAuthenticationSuccessHandler;
import org.springframework.security.kerberos.web.SpnegoAuthenticationProcessingFilter;
import org.springframework.security.kerberos.web.SpnegoEntryPoint;
import org.springframework.security.kerberos.authentication.KerberosServiceAuthenticationProvider;
import org.springframework.security.kerberos.authentication.sun.SunJaasKerberosTicketValidator;
import org.springframework.security.kerberos.web.authentication.ResponseHeaderSettingKerberosAuthenticationSuccessHandler;
import org.springframework.security.kerberos.web.authentication.SpnegoAuthenticationProcessingFilter;
import org.springframework.security.kerberos.web.authentication.SpnegoEntryPoint;
import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
@Configuration

123
spring-security-kerberos-core/src/main/java/org/springframework/security/kerberos/KerberosServiceAuthenticationProvider.java
View File

@@ -1,123 +0,0 @@
/*
* Copyright 2009-2015 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.kerberos;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.security.authentication.AccountStatusUserDetailsChecker;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsChecker;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.kerberos.KerberosTicketValidator.KerberosTicketValidation;
import org.springframework.security.kerberos.web.SpnegoAuthenticationProcessingFilter;
import org.springframework.util.Assert;
/**
* <p>Authentication Provider which validates Kerberos Service Tickets
* or SPNEGO Tokens (which includes Kerberos Service Tickets).</p>
*
* <p>It needs a <code>KerberosTicketValidator</code>, which contains the
* code to validate the ticket, as this code is different between
* SUN and IBM JRE.<br>
* It also needs an <code>UserDetailsService</code> to load the user properties
* and the <code>GrantedAuthorities</code>, as we only get back the username
* from Kerbeos</p>
*
* You can see an example configuration in <code>SpnegoAuthenticationProcessingFilter</code>.
*
* @author Mike Wiesner
* @author Jeremy Stone
* @since 1.0
* @see KerberosTicketValidator
* @see UserDetailsService
* @see SpnegoAuthenticationProcessingFilter
*/
public class KerberosServiceAuthenticationProvider implements
AuthenticationProvider, InitializingBean {
private static final Log LOG = LogFactory.getLog(KerberosServiceAuthenticationProvider.class);
private KerberosTicketValidator ticketValidator;
private UserDetailsService userDetailsService;
private UserDetailsChecker userDetailsChecker = new AccountStatusUserDetailsChecker();
@Override
public Authentication authenticate(Authentication authentication)
throws AuthenticationException {
KerberosServiceRequestToken auth = (KerberosServiceRequestToken) authentication;
byte[] token = auth.getToken();
LOG.debug("Try to validate Kerberos Token");
KerberosTicketValidation ticketValidation = this.ticketValidator.validateTicket(token);
LOG.debug("Succesfully validated " + ticketValidation.username());
UserDetails userDetails = this.userDetailsService.loadUserByUsername(ticketValidation.username());
userDetailsChecker.check(userDetails);
additionalAuthenticationChecks(userDetails, auth);
KerberosServiceRequestToken responseAuth = new KerberosServiceRequestToken(
userDetails, ticketValidation,
userDetails.getAuthorities(), token);
responseAuth.setDetails(authentication.getDetails());
return responseAuth;
}
@Override
public boolean supports(Class<? extends Object> auth) {
return KerberosServiceRequestToken.class.isAssignableFrom(auth);
}
@Override
public void afterPropertiesSet() throws Exception {
Assert.notNull(this.ticketValidator, "ticketValidator must be specified");
Assert.notNull(this.userDetailsService, "userDetailsService must be specified");
}
/**
* The <code>UserDetailsService</code> to use, for loading the user properties
* and the <code>GrantedAuthorities</code>.
*
* @param userDetailsService the new user details service
*/
public void setUserDetailsService(UserDetailsService userDetailsService) {
this.userDetailsService = userDetailsService;
}
/**
* The <code>KerberosTicketValidator</code> to use, for validating
* the Kerberos/SPNEGO tickets.
*
* @param ticketValidator the new ticket validator
*/
public void setTicketValidator(KerberosTicketValidator ticketValidator) {
this.ticketValidator = ticketValidator;
}
/**
* Allows subclasses to perform any additional checks of a returned <code>UserDetails</code>
* for a given authentication request.
*
* @param userDetails as retrieved from the {@link UserDetailsService}
* @param authentication validated {@link KerberosServiceRequestToken}
* @throws AuthenticationException AuthenticationException if the credentials could not be validated (generally a
* <code>BadCredentialsException</code>, an <code>AuthenticationServiceException</code>)
*/
protected void additionalAuthenticationChecks(UserDetails userDetails, KerberosServiceRequestToken authentication)
throws AuthenticationException {
}
}

231
spring-security-kerberos-core/src/main/java/org/springframework/security/kerberos/KerberosServiceRequestToken.java
View File

@@ -1,231 +0,0 @@
/*
* Copyright 2009-2015 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.kerberos;
import java.io.UnsupportedEncodingException;
import java.security.PrivilegedActionException;
import java.security.PrivilegedExceptionAction;
import java.util.Arrays;
import java.util.Collection;
import javax.security.auth.Subject;
import org.ietf.jgss.GSSContext;
import org.ietf.jgss.MessageProp;
import org.springframework.security.authentication.AbstractAuthenticationToken;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.crypto.codec.Base64;
import org.springframework.security.kerberos.KerberosTicketValidator.KerberosTicketValidation;
import org.springframework.security.kerberos.web.SpnegoAuthenticationProcessingFilter;
/**
* <p>Holds the Kerberos/SPNEGO token for requesting a kerberized service and is
* also the output of <code>KerberosServiceAuthenticationProvider</code>.</p>
* <p>Will mostly be created in <code>SpnegoAuthenticationProcessingFilter</code>
* and authenticated in <code>KerberosServiceAuthenticationProvider</code>.</p>
*
* This token cannot be re-authenticated, as you will get a Kerberos Reply
* error.
*
* @author Mike Wiesner
* @author Jeremy Stone
* @since 1.0
* @see KerberosServiceAuthenticationProvider
* @see SpnegoAuthenticationProcessingFilter
*/
public class KerberosServiceRequestToken extends AbstractAuthenticationToken {
private static final long serialVersionUID = 395488921064775014L;
private final byte[] token;
private final Object principal;
private final transient KerberosTicketValidation ticketValidation;
/**
* Creates an authenticated token, normally used as an output of an
* authentication provider.
*
* @param principal the user principal (mostly of instance <code>UserDetails</code>)
* @param ticketValidation result of ticket validation
* @param authorities the authorities which are granted to the user
* @param token the Kerberos/SPNEGO token
* @see UserDetails
*/
public KerberosServiceRequestToken(Object principal, KerberosTicketValidation ticketValidation,
Collection<? extends GrantedAuthority> authorities, byte[] token) {
super(authorities);
this.token = token;
this.principal = principal;
this.ticketValidation = ticketValidation;
super.setAuthenticated(true);
}
/**
* Creates an unauthenticated instance which should then be authenticated by
* <code>KerberosServiceAuthenticationProvider</code>.
*
* @param token Kerberos/SPNEGO token
* @see KerberosServiceAuthenticationProvider
*/
public KerberosServiceRequestToken(byte[] token) {
super(null);
this.token = token;
this.ticketValidation = null;
this.principal = null;
}
/**
* Calculates hashcode based on the Kerberos token
*/
@Override
public int hashCode() {
final int prime = 31;
int result = super.hashCode();
result = prime * result + Arrays.hashCode(token);
return result;
}
/**
* equals() is based only on the Kerberos token
*/
@Override
public boolean equals(Object obj) {
if (this == obj)
return true;
if (!super.equals(obj))
return false;
if (getClass() != obj.getClass())
return false;
KerberosServiceRequestToken other = (KerberosServiceRequestToken) obj;
if (!Arrays.equals(token, other.token))
return false;
return true;
}
@Override
public Object getCredentials() {
return null;
}
@Override
public Object getPrincipal() {
return this.principal;
}
/**
* Returns the Kerberos token
* @return the token data
*/
public byte[] getToken() {
return this.token;
}
/**
* Gets the ticket validation
*
* @return the ticket validation (which will be null if the token is unauthenticated)
*/
public KerberosTicketValidation getTicketValidation() {
return ticketValidation;
}
/**
* Determines whether an authenticated token has a response token
*
* @return whether a response token is available
*/
public boolean hasResponseToken() {
return ticketValidation != null && ticketValidation.responseToken() != null;
}
/**
* Gets the (Base64) encoded response token assuming one is available.
*
* @return encoded response token
*/
public String getEncodedResponseToken() {
if (!hasResponseToken())
throw new IllegalStateException("Unauthenticated or no response token");
try {
return new String(Base64.encode(ticketValidation.responseToken()), "UTF-8");
} catch (UnsupportedEncodingException e) {
throw new IllegalStateException("Unable to encode response token", e);
}
}
/**
* Unwraps an encrypted message using the gss context
*
* @param data the data
* @param offset data offset
* @param length data length
* @return the decrypted message
* @throws PrivilegedActionException if jaas throws and error
*/
public byte[] decrypt(final byte[] data, final int offset, final int length) throws PrivilegedActionException {
return Subject.doAs(getTicketValidation().subject(), new PrivilegedExceptionAction<byte[]>() {
public byte[] run() throws Exception {
final GSSContext context = getTicketValidation().getGssContext();
return context.unwrap(data, offset, length, new MessageProp(true));
}
});
}
/**
* Unwraps an encrypted message using the gss context
*
* @param data the data
* @return the decrypted message
* @throws PrivilegedActionException if jaas throws and error
*/
public byte[] decrypt(final byte[] data) throws PrivilegedActionException {
return decrypt(data, 0, data.length);
}
/**
* Wraps an message using the gss context
*
* @param data the data
* @param offset data offset
* @param length data length
* @return the encrypted message
* @throws PrivilegedActionException if jaas throws and error
*/
public byte[] encrypt(final byte[] data, final int offset, final int length) throws PrivilegedActionException {
return Subject.doAs(getTicketValidation().subject(), new PrivilegedExceptionAction<byte[]>() {
public byte[] run() throws Exception {
final GSSContext context = getTicketValidation().getGssContext();
return context.wrap(data, offset, length, new MessageProp(true));
}
});
}
/**
* Wraps an message using the gss context
*
* @param data the data
* @return the encrypted message
* @throws PrivilegedActionException if jaas throws and error
*/
public byte[] encrypt(final byte[] data) throws PrivilegedActionException {
return encrypt(data, 0, data.length);
}
}

2
spring-security-kerberos-core/src/main/java/org/springframework/security/kerberos/KerberosAuthenticationProvider.java → spring-security-kerberos-core/src/main/java/org/springframework/security/kerberos/authentication/KerberosAuthenticationProvider.java
View File

@@ -13,7 +13,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.kerberos;
package org.springframework.security.kerberos.authentication;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;

2
spring-security-kerberos-core/src/main/java/org/springframework/security/kerberos/KerberosClient.java → spring-security-kerberos-core/src/main/java/org/springframework/security/kerberos/authentication/KerberosClient.java
View File

@@ -14,7 +14,7 @@
* limitations under the License.
*/
package org.springframework.security.kerberos;
package org.springframework.security.kerberos.authentication;
/**
*

120
spring-security-kerberos-core/src/main/java/org/springframework/security/kerberos/authentication/KerberosServiceAuthenticationProvider.java Normal file
View File

@@ -0,0 +1,120 @@
/*
* Copyright 2009-2015 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.kerberos.authentication;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.security.authentication.AccountStatusUserDetailsChecker;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsChecker;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.util.Assert;
/**
* <p>Authentication Provider which validates Kerberos Service Tickets
* or SPNEGO Tokens (which includes Kerberos Service Tickets).</p>
*
* <p>It needs a <code>KerberosTicketValidator</code>, which contains the
* code to validate the ticket, as this code is different between
* SUN and IBM JRE.<br>
* It also needs an <code>UserDetailsService</code> to load the user properties
* and the <code>GrantedAuthorities</code>, as we only get back the username
* from Kerbeos</p>
*
* You can see an example configuration in <code>SpnegoAuthenticationProcessingFilter</code>.
*
* @author Mike Wiesner
* @author Jeremy Stone
* @since 1.0
* @see KerberosTicketValidator
* @see UserDetailsService
*/
public class KerberosServiceAuthenticationProvider implements
AuthenticationProvider, InitializingBean {
private static final Log LOG = LogFactory.getLog(KerberosServiceAuthenticationProvider.class);
private KerberosTicketValidator ticketValidator;
private UserDetailsService userDetailsService;
private UserDetailsChecker userDetailsChecker = new AccountStatusUserDetailsChecker();
@Override
public Authentication authenticate(Authentication authentication)
throws AuthenticationException {
KerberosServiceRequestToken auth = (KerberosServiceRequestToken) authentication;
byte[] token = auth.getToken();
LOG.debug("Try to validate Kerberos Token");
KerberosTicketValidation ticketValidation = this.ticketValidator.validateTicket(token);
LOG.debug("Succesfully validated " + ticketValidation.username());
UserDetails userDetails = this.userDetailsService.loadUserByUsername(ticketValidation.username());
userDetailsChecker.check(userDetails);
additionalAuthenticationChecks(userDetails, auth);
KerberosServiceRequestToken responseAuth = new KerberosServiceRequestToken(
userDetails, ticketValidation,
userDetails.getAuthorities(), token);
responseAuth.setDetails(authentication.getDetails());
return responseAuth;
}
@Override
public boolean supports(Class<? extends Object> auth) {
return KerberosServiceRequestToken.class.isAssignableFrom(auth);
}
@Override
public void afterPropertiesSet() throws Exception {
Assert.notNull(this.ticketValidator, "ticketValidator must be specified");
Assert.notNull(this.userDetailsService, "userDetailsService must be specified");
}
/**
* The <code>UserDetailsService</code> to use, for loading the user properties
* and the <code>GrantedAuthorities</code>.
*
* @param userDetailsService the new user details service
*/
public void setUserDetailsService(UserDetailsService userDetailsService) {
this.userDetailsService = userDetailsService;
}
/**
* The <code>KerberosTicketValidator</code> to use, for validating
* the Kerberos/SPNEGO tickets.
*
* @param ticketValidator the new ticket validator
*/
public void setTicketValidator(KerberosTicketValidator ticketValidator) {
this.ticketValidator = ticketValidator;
}
/**
* Allows subclasses to perform any additional checks of a returned <code>UserDetails</code>
* for a given authentication request.
*
* @param userDetails as retrieved from the {@link UserDetailsService}
* @param authentication validated {@link KerberosServiceRequestToken}
* @throws AuthenticationException AuthenticationException if the credentials could not be validated (generally a
* <code>BadCredentialsException</code>, an <code>AuthenticationServiceException</code>)
*/
protected void additionalAuthenticationChecks(UserDetails userDetails, KerberosServiceRequestToken authentication)
throws AuthenticationException {
}
}

228
spring-security-kerberos-core/src/main/java/org/springframework/security/kerberos/authentication/KerberosServiceRequestToken.java Normal file
View File

@@ -0,0 +1,228 @@
/*
* Copyright 2009-2015 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.kerberos.authentication;
import java.io.UnsupportedEncodingException;
import java.security.PrivilegedActionException;
import java.security.PrivilegedExceptionAction;
import java.util.Arrays;
import java.util.Collection;
import javax.security.auth.Subject;
import org.ietf.jgss.GSSContext;
import org.ietf.jgss.MessageProp;
import org.springframework.security.authentication.AbstractAuthenticationToken;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.crypto.codec.Base64;
/**
* <p>Holds the Kerberos/SPNEGO token for requesting a kerberized service and is
* also the output of <code>KerberosServiceAuthenticationProvider</code>.</p>
* <p>Will mostly be created in <code>SpnegoAuthenticationProcessingFilter</code>
* and authenticated in <code>KerberosServiceAuthenticationProvider</code>.</p>
*
* This token cannot be re-authenticated, as you will get a Kerberos Reply
* error.
*
* @author Mike Wiesner
* @author Jeremy Stone
* @since 1.0
* @see KerberosServiceAuthenticationProvider
*/
public class KerberosServiceRequestToken extends AbstractAuthenticationToken {
private static final long serialVersionUID = 395488921064775014L;
private final byte[] token;
private final Object principal;
private final transient KerberosTicketValidation ticketValidation;
/**
* Creates an authenticated token, normally used as an output of an
* authentication provider.
*
* @param principal the user principal (mostly of instance <code>UserDetails</code>)
* @param ticketValidation result of ticket validation
* @param authorities the authorities which are granted to the user
* @param token the Kerberos/SPNEGO token
* @see UserDetails
*/
public KerberosServiceRequestToken(Object principal, KerberosTicketValidation ticketValidation,
Collection<? extends GrantedAuthority> authorities, byte[] token) {
super(authorities);
this.token = token;
this.principal = principal;
this.ticketValidation = ticketValidation;
super.setAuthenticated(true);
}
/**
* Creates an unauthenticated instance which should then be authenticated by
* <code>KerberosServiceAuthenticationProvider</code>.
*
* @param token Kerberos/SPNEGO token
* @see KerberosServiceAuthenticationProvider
*/
public KerberosServiceRequestToken(byte[] token) {
super(null);
this.token = token;
this.ticketValidation = null;
this.principal = null;
}
/**
* Calculates hashcode based on the Kerberos token
*/
@Override
public int hashCode() {
final int prime = 31;
int result = super.hashCode();
result = prime * result + Arrays.hashCode(token);
return result;
}
/**
* equals() is based only on the Kerberos token
*/
@Override
public boolean equals(Object obj) {
if (this == obj)
return true;
if (!super.equals(obj))
return false;
if (getClass() != obj.getClass())
return false;
KerberosServiceRequestToken other = (KerberosServiceRequestToken) obj;
if (!Arrays.equals(token, other.token))
return false;
return true;
}
@Override
public Object getCredentials() {
return null;
}
@Override
public Object getPrincipal() {
return this.principal;
}
/**
* Returns the Kerberos token
* @return the token data
*/
public byte[] getToken() {
return this.token;
}
/**
* Gets the ticket validation
*
* @return the ticket validation (which will be null if the token is unauthenticated)
*/
public KerberosTicketValidation getTicketValidation() {
return ticketValidation;
}
/**
* Determines whether an authenticated token has a response token
*
* @return whether a response token is available
*/
public boolean hasResponseToken() {
return ticketValidation != null && ticketValidation.responseToken() != null;
}
/**
* Gets the (Base64) encoded response token assuming one is available.
*
* @return encoded response token
*/
public String getEncodedResponseToken() {
if (!hasResponseToken())
throw new IllegalStateException("Unauthenticated or no response token");
try {
return new String(Base64.encode(ticketValidation.responseToken()), "UTF-8");
} catch (UnsupportedEncodingException e) {
throw new IllegalStateException("Unable to encode response token", e);
}
}
/**
* Unwraps an encrypted message using the gss context
*
* @param data the data
* @param offset data offset
* @param length data length
* @return the decrypted message
* @throws PrivilegedActionException if jaas throws and error
*/
public byte[] decrypt(final byte[] data, final int offset, final int length) throws PrivilegedActionException {
return Subject.doAs(getTicketValidation().subject(), new PrivilegedExceptionAction<byte[]>() {
public byte[] run() throws Exception {
final GSSContext context = getTicketValidation().getGssContext();
return context.unwrap(data, offset, length, new MessageProp(true));
}
});
}
/**
* Unwraps an encrypted message using the gss context
*
* @param data the data
* @return the decrypted message
* @throws PrivilegedActionException if jaas throws and error
*/
public byte[] decrypt(final byte[] data) throws PrivilegedActionException {
return decrypt(data, 0, data.length);
}
/**
* Wraps an message using the gss context
*
* @param data the data
* @param offset data offset
* @param length data length
* @return the encrypted message
* @throws PrivilegedActionException if jaas throws and error
*/
public byte[] encrypt(final byte[] data, final int offset, final int length) throws PrivilegedActionException {
return Subject.doAs(getTicketValidation().subject(), new PrivilegedExceptionAction<byte[]>() {
public byte[] run() throws Exception {
final GSSContext context = getTicketValidation().getGssContext();
return context.wrap(data, offset, length, new MessageProp(true));
}
});
}
/**
* Wraps an message using the gss context
*
* @param data the data
* @return the encrypted message
* @throws PrivilegedActionException if jaas throws and error
*/
public byte[] encrypt(final byte[] data) throws PrivilegedActionException {
return encrypt(data, 0, data.length);
}
}

45
spring-security-kerberos-core/src/main/java/org/springframework/security/kerberos/authentication/KerberosTicketValidation.java Normal file
View File

@@ -0,0 +1,45 @@
package org.springframework.security.kerberos.authentication;
import java.util.HashSet;
import javax.security.auth.Subject;
import javax.security.auth.kerberos.KerberosPrincipal;
import org.ietf.jgss.GSSContext;
/**
* Result of ticket validation
*/
public class KerberosTicketValidation {
private final String username;
private final byte[] responseToken;
private final GSSContext gssContext;
private final String servicePrincipal;
public KerberosTicketValidation(String username, String servicePrincipal, byte[] responseToken, GSSContext gssContext) {
this.username = username;
this.servicePrincipal = servicePrincipal;
this.responseToken = responseToken;
this.gssContext = gssContext;
}
public String username() {
return username;
}
public byte[] responseToken() {
return responseToken;
}
public GSSContext getGssContext() {
return gssContext;
}
public Subject subject() {
final HashSet<KerberosPrincipal> princs = new HashSet<KerberosPrincipal>();
princs.add(new KerberosPrincipal(servicePrincipal));
return new Subject(false, princs, new HashSet<Object>(), new HashSet<Object>());
}
}

45
spring-security-kerberos-core/src/main/java/org/springframework/security/kerberos/KerberosTicketValidator.java → spring-security-kerberos-core/src/main/java/org/springframework/security/kerberos/authentication/KerberosTicketValidator.java
View File

@@ -13,14 +13,8 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.kerberos;
package org.springframework.security.kerberos.authentication;
import java.util.HashSet;
import javax.security.auth.Subject;
import javax.security.auth.kerberos.KerberosPrincipal;
import org.ietf.jgss.GSSContext;
import org.springframework.security.authentication.BadCredentialsException;
/**
@@ -44,41 +38,4 @@ public interface KerberosTicketValidator {
*/
public KerberosTicketValidation validateTicket(byte[] token)
throws BadCredentialsException;
/**
* Result of ticket validation
*/
public static class KerberosTicketValidation {
private final String username;
private final byte[] responseToken;
private final GSSContext gssContext;
private final String servicePrincipal;
KerberosTicketValidation(String username, String servicePrincipal, byte[] responseToken, GSSContext gssContext) {
this.username = username;
this.servicePrincipal = servicePrincipal;
this.responseToken = responseToken;
this.gssContext = gssContext;
}
public String username() {
return username;
}
public byte[] responseToken() {
return responseToken;
}
public GSSContext getGssContext() {
return gssContext;
}
public Subject subject() {
final HashSet<KerberosPrincipal> princs = new HashSet<KerberosPrincipal>();
princs.add(new KerberosPrincipal(servicePrincipal));
return new Subject(false, princs, new HashSet<Object>(), new HashSet<Object>());
}
}
}

2
spring-security-kerberos-core/src/main/java/org/springframework/security/kerberos/GlobalSunJaasKerberosConfig.java → spring-security-kerberos-core/src/main/java/org/springframework/security/kerberos/authentication/sun/GlobalSunJaasKerberosConfig.java
View File

@@ -13,7 +13,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.kerberos;
package org.springframework.security.kerberos.authentication.sun;
import org.springframework.beans.BeansException;
import org.springframework.beans.factory.InitializingBean;

3
spring-security-kerberos-core/src/main/java/org/springframework/security/kerberos/SunJaasKerberosClient.java → spring-security-kerberos-core/src/main/java/org/springframework/security/kerberos/authentication/sun/SunJaasKerberosClient.java
View File

@@ -13,7 +13,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.kerberos;
package org.springframework.security.kerberos.authentication.sun;
import java.io.IOException;
import java.util.HashMap;
@@ -31,6 +31,7 @@ import javax.security.auth.login.LoginException;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.security.kerberos.authentication.KerberosClient;
/**
* Implementation of {@link KerberosClient} which uses the SUN JAAS

4
spring-security-kerberos-core/src/main/java/org/springframework/security/kerberos/SunJaasKerberosTicketValidator.java → spring-security-kerberos-core/src/main/java/org/springframework/security/kerberos/authentication/sun/SunJaasKerberosTicketValidator.java
View File

@@ -13,7 +13,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.kerberos;
package org.springframework.security.kerberos.authentication.sun;
import java.security.Principal;
import java.security.PrivilegedActionException;
@@ -37,6 +37,8 @@ import org.springframework.beans.factory.InitializingBean;
import org.springframework.core.io.ClassPathResource;
import org.springframework.core.io.Resource;
import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.security.kerberos.authentication.KerberosTicketValidation;
import org.springframework.security.kerberos.authentication.KerberosTicketValidator;
import org.springframework.util.Assert;
/**

6
spring-security-kerberos-core/src/test/java/org/springframework/security/kerberos/KerberosAuthenticationProviderTest.java → spring-security-kerberos-core/src/test/java/org/springframework/security/kerberos/authentication/KerberosAuthenticationProviderTest.java
View File

@@ -13,7 +13,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.kerberos;
package org.springframework.security.kerberos.authentication;
import static org.junit.Assert.*;
import static org.mockito.Mockito.*;
@@ -29,8 +29,8 @@ import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.kerberos.KerberosAuthenticationProvider;
import org.springframework.security.kerberos.KerberosClient;
import org.springframework.security.kerberos.authentication.KerberosAuthenticationProvider;
import org.springframework.security.kerberos.authentication.KerberosClient;
/**
* Test class for {@link KerberosAuthenticationProvider}

10
spring-security-kerberos-core/src/test/java/org/springframework/security/kerberos/KerberosServiceAuthenticationProviderTest.java → spring-security-kerberos-core/src/test/java/org/springframework/security/kerberos/authentication/KerberosServiceAuthenticationProviderTest.java
View File

@@ -13,7 +13,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.kerberos;
package org.springframework.security.kerberos.authentication;
import static org.junit.Assert.*;
import static org.mockito.Mockito.*;
@@ -34,10 +34,10 @@ import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.kerberos.KerberosServiceAuthenticationProvider;
import org.springframework.security.kerberos.KerberosServiceRequestToken;
import org.springframework.security.kerberos.KerberosTicketValidator;
import org.springframework.security.kerberos.KerberosTicketValidator.KerberosTicketValidation;
import org.springframework.security.kerberos.authentication.KerberosServiceAuthenticationProvider;
import org.springframework.security.kerberos.authentication.KerberosServiceRequestToken;
import org.springframework.security.kerberos.authentication.KerberosTicketValidation;
import org.springframework.security.kerberos.authentication.KerberosTicketValidator;
/**
* Test class for {@link KerberosServiceAuthenticationProvider}

4
spring-security-kerberos-samples/sec-server-client-auth/src/main/java/demo/app/WebSecurityConfig.java
View File

@@ -6,8 +6,8 @@ import org.springframework.security.config.annotation.authentication.builders.Au
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity;
import org.springframework.security.kerberos.KerberosAuthenticationProvider;
import org.springframework.security.kerberos.SunJaasKerberosClient;
import org.springframework.security.kerberos.authentication.KerberosAuthenticationProvider;
import org.springframework.security.kerberos.authentication.sun.SunJaasKerberosClient;
import demo.DummyUserDetailsService;

12
spring-security-kerberos-samples/sec-server-spnego-form-auth-xml/src/main/resources/websecurityconfig.xml
View File

@@ -23,30 +23,30 @@
</sec:authentication-manager>
<bean id="kerberosAuthenticationProvider"
class="org.springframework.security.kerberos.KerberosAuthenticationProvider">
class="org.springframework.security.kerberos.authentication.KerberosAuthenticationProvider">
<property name="userDetailsService" ref="dummyUserDetailsService"/>
<property name="kerberosClient">
<bean class="org.springframework.security.kerberos.SunJaasKerberosClient">
<bean class="org.springframework.security.kerberos.authentication.sun.SunJaasKerberosClient">
<property name="debug" value="true"/>
</bean>
</property>
</bean>
<bean id="spnegoEntryPoint"
class="org.springframework.security.kerberos.web.SpnegoEntryPoint" >
class="org.springframework.security.kerberos.web.authentication.SpnegoEntryPoint" >
<constructor-arg value="/login" />
</bean>
<bean id="spnegoAuthenticationProcessingFilter"
class="org.springframework.security.kerberos.web.SpnegoAuthenticationProcessingFilter">
class="org.springframework.security.kerberos.web.authentication.SpnegoAuthenticationProcessingFilter">
<property name="authenticationManager" ref="authenticationManager" />
</bean>
<bean id="kerberosServiceAuthenticationProvider"
class="org.springframework.security.kerberos.KerberosServiceAuthenticationProvider">
class="org.springframework.security.kerberos.authentication.KerberosServiceAuthenticationProvider">
<property name="ticketValidator">
<bean
class="org.springframework.security.kerberos.SunJaasKerberosTicketValidator">
class="org.springframework.security.kerberos.authentication.sun.SunJaasKerberosTicketValidator">
<property name="servicePrincipal" value="${app.service-principal}" />
<property name="keyTabLocation" value="${app.keytab-location}" />
<property name="debug" value="true" />

15
spring-security-kerberos-samples/sec-server-spnego-form-auth-xml/src/test/java/demo/app/ApplicationTest.java Normal file
View File

@@ -0,0 +1,15 @@
package demo.app;
import org.junit.Test;
import org.junit.runner.RunWith;
import org.springframework.boot.test.SpringApplicationConfiguration;
import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
@RunWith(SpringJUnit4ClassRunner.class)
@SpringApplicationConfiguration(classes = Application.class)
public class ApplicationTest {
@Test
public void configurationLoads() {
}
}

12
spring-security-kerberos-samples/sec-server-spnego-form-auth/src/main/java/demo/app/WebSecurityConfig.java
View File

@@ -9,12 +9,12 @@ import org.springframework.security.config.annotation.authentication.builders.Au
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity;
import org.springframework.security.kerberos.KerberosAuthenticationProvider;
import org.springframework.security.kerberos.KerberosServiceAuthenticationProvider;
import org.springframework.security.kerberos.SunJaasKerberosClient;
import org.springframework.security.kerberos.SunJaasKerberosTicketValidator;
import org.springframework.security.kerberos.web.SpnegoAuthenticationProcessingFilter;
import org.springframework.security.kerberos.web.SpnegoEntryPoint;
import org.springframework.security.kerberos.authentication.KerberosAuthenticationProvider;
import org.springframework.security.kerberos.authentication.KerberosServiceAuthenticationProvider;
import org.springframework.security.kerberos.authentication.sun.SunJaasKerberosClient;
import org.springframework.security.kerberos.authentication.sun.SunJaasKerberosTicketValidator;
import org.springframework.security.kerberos.web.authentication.SpnegoAuthenticationProcessingFilter;
import org.springframework.security.kerberos.web.authentication.SpnegoEntryPoint;
import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
import demo.DummyUserDetailsService;

8
spring-security-kerberos-samples/sec-server-win-auth/src/main/java/demo/app/WebSecurityConfig.java
View File

@@ -9,12 +9,12 @@ import org.springframework.security.config.annotation.authentication.builders.Au
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity;
import org.springframework.security.kerberos.KerberosServiceAuthenticationProvider;
import org.springframework.security.kerberos.SunJaasKerberosTicketValidator;
import org.springframework.security.kerberos.authentication.KerberosServiceAuthenticationProvider;
import org.springframework.security.kerberos.authentication.sun.SunJaasKerberosTicketValidator;
import org.springframework.security.kerberos.client.KerberosLdapContextSource;
import org.springframework.security.kerberos.client.config.SunJaasKrb5LoginConfig;
import org.springframework.security.kerberos.web.SpnegoAuthenticationProcessingFilter;
import org.springframework.security.kerberos.web.SpnegoEntryPoint;
import org.springframework.security.kerberos.web.authentication.SpnegoAuthenticationProcessingFilter;
import org.springframework.security.kerberos.web.authentication.SpnegoEntryPoint;
import org.springframework.security.ldap.authentication.ad.ActiveDirectoryLdapAuthenticationProvider;
import org.springframework.security.ldap.search.FilterBasedLdapUserSearch;
import org.springframework.security.ldap.userdetails.LdapUserDetailsMapper;

15
spring-security-kerberos-web/.springBeans Normal file
View File

@@ -0,0 +1,15 @@
<?xml version="1.0" encoding="UTF-8"?>
<beansProjectDescription>
<version>1</version>
<pluginVersion><![CDATA[3.6.4.201503051146-RELEASE]]></pluginVersion>
<configSuffixes>
<configSuffix><![CDATA[xml]]></configSuffix>
</configSuffixes>
<enableImports><![CDATA[false]]></enableImports>
<configs>
</configs>
<autoconfigs>
</autoconfigs>
<configSets>
</configSets>
</beansProjectDescription>

4
spring-security-kerberos-core/src/main/java/org/springframework/security/kerberos/web/ResponseHeaderSettingKerberosAuthenticationSuccessHandler.java → spring-security-kerberos-web/src/main/java/org/springframework/security/kerberos/web/authentication/ResponseHeaderSettingKerberosAuthenticationSuccessHandler.java
View File

@@ -13,7 +13,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.kerberos.web;
package org.springframework.security.kerberos.web.authentication;
import java.io.IOException;
@@ -22,7 +22,7 @@ import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.springframework.security.core.Authentication;
import org.springframework.security.kerberos.KerberosServiceRequestToken;
import org.springframework.security.kerberos.authentication.KerberosServiceRequestToken;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
/**

14
spring-security-kerberos-core/src/main/java/org/springframework/security/kerberos/web/SpnegoAuthenticationProcessingFilter.java → spring-security-kerberos-web/src/main/java/org/springframework/security/kerberos/web/authentication/SpnegoAuthenticationProcessingFilter.java
View File

@@ -13,7 +13,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.kerberos.web;
package org.springframework.security.kerberos.web.authentication;
import java.io.IOException;
@@ -31,8 +31,8 @@ import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.crypto.codec.Base64;
import org.springframework.security.kerberos.KerberosServiceAuthenticationProvider;
import org.springframework.security.kerberos.KerberosServiceRequestToken;
import org.springframework.security.kerberos.authentication.KerberosServiceAuthenticationProvider;
import org.springframework.security.kerberos.authentication.KerberosServiceRequestToken;
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
@@ -59,10 +59,10 @@ import org.springframework.web.filter.GenericFilterBean;
* &lt;sec:custom-filter ref=&quot;spnegoAuthenticationProcessingFilter&quot; position=&quot;BASIC_AUTH_FILTER&quot; /&gt;
* &lt;/sec:http&gt;
*
* &lt;bean id=&quot;spnegoEntryPoint&quot; class=&quot;org.springframework.security.kerberos.web.SpnegoEntryPoint&quot; /&gt;
* &lt;bean id=&quot;spnegoEntryPoint&quot; class=&quot;org.springframework.security.kerberos.web.authentication.SpnegoEntryPoint&quot; /&gt;
*
* &lt;bean id=&quot;spnegoAuthenticationProcessingFilter&quot;
* class=&quot;org.springframework.security.kerberos.web.SpnegoAuthenticationProcessingFilter&quot;&gt;
* class=&quot;org.springframework.security.kerberos.web.authentication.SpnegoAuthenticationProcessingFilter&quot;&gt;
* &lt;property name=&quot;authenticationManager&quot; ref=&quot;authenticationManager&quot; /&gt;
* &lt;/bean&gt;
*
@@ -71,9 +71,9 @@ import org.springframework.web.filter.GenericFilterBean;
* &lt;/sec:authentication-manager&gt;
*
* &lt;bean id=&quot;kerberosServiceAuthenticationProvider&quot;
* class=&quot;org.springframework.security.kerberos.KerberosServiceAuthenticationProvider&quot;&gt;
* class=&quot;org.springframework.security.kerberos.authenitcation.KerberosServiceAuthenticationProvider&quot;&gt;
* &lt;property name=&quot;ticketValidator&quot;&gt;
* &lt;bean class=&quot;org.springframework.security.kerberos.SunJaasKerberosTicketValidator&quot;&gt;
* &lt;bean class=&quot;org.springframework.security.kerberos.authentication.sun.SunJaasKerberosTicketValidator&quot;&gt;
* &lt;property name=&quot;servicePrincipal&quot; value=&quot;HTTP/web.springsource.com&quot; /&gt;
* &lt;property name=&quot;keyTabLocation&quot; value=&quot;classpath:http-java.keytab&quot; /&gt;
* &lt;/bean&gt;

2
spring-security-kerberos-core/src/main/java/org/springframework/security/kerberos/web/SpnegoEntryPoint.java → spring-security-kerberos-web/src/main/java/org/springframework/security/kerberos/web/authentication/SpnegoEntryPoint.java
View File

@@ -13,7 +13,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.kerberos.web;
package org.springframework.security.kerberos.web.authentication;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;

4
spring-security-kerberos-core/src/test/java/org/springframework/security/kerberos/docs/AuthProviderConfig.java → spring-security-kerberos-web/src/test/java/org/springframework/security/kerberos/docs/AuthProviderConfig.java
View File

@@ -21,8 +21,8 @@ import org.springframework.security.config.annotation.authentication.builders.Au
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity;
import org.springframework.security.kerberos.KerberosAuthenticationProvider;
import org.springframework.security.kerberos.SunJaasKerberosClient;
import org.springframework.security.kerberos.authentication.KerberosAuthenticationProvider;
import org.springframework.security.kerberos.authentication.sun.SunJaasKerberosClient;
//tag::snippetA[]
@Configuration

27
spring-security-kerberos-web/src/test/java/org/springframework/security/kerberos/docs/AuthProviderConfigTest.java Normal file
View File

@@ -0,0 +1,27 @@
/*
* Copyright 2002-2015 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this
* file except in compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under
* the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the specific language governing
* permissions and limitations under the License.
*/
package org.springframework.security.kerberos.docs;
import org.junit.Test;
import org.junit.runner.RunWith;
import org.springframework.test.context.ContextConfiguration;
import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
@RunWith(SpringJUnit4ClassRunner.class)
@ContextConfiguration(locations= {"AuthProviderConfig.xml"})
public class AuthProviderConfigTest {
@Test
public void configLoads() {}
}

0
spring-security-kerberos-core/src/test/java/org/springframework/security/kerberos/docs/DummyUserDetailsService.java → spring-security-kerberos-web/src/test/java/org/springframework/security/kerberos/docs/DummyUserDetailsService.java
View File

12
spring-security-kerberos-core/src/test/java/org/springframework/security/kerberos/docs/SpnegoConfig.java → spring-security-kerberos-web/src/test/java/org/springframework/security/kerberos/docs/SpnegoConfig.java
View File

@@ -23,12 +23,12 @@ import org.springframework.security.config.annotation.authentication.builders.Au
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity;
import org.springframework.security.kerberos.KerberosAuthenticationProvider;
import org.springframework.security.kerberos.KerberosServiceAuthenticationProvider;
import org.springframework.security.kerberos.SunJaasKerberosClient;
import org.springframework.security.kerberos.SunJaasKerberosTicketValidator;
import org.springframework.security.kerberos.web.SpnegoAuthenticationProcessingFilter;
import org.springframework.security.kerberos.web.SpnegoEntryPoint;
import org.springframework.security.kerberos.authentication.KerberosAuthenticationProvider;
import org.springframework.security.kerberos.authentication.KerberosServiceAuthenticationProvider;
import org.springframework.security.kerberos.authentication.sun.SunJaasKerberosClient;
import org.springframework.security.kerberos.authentication.sun.SunJaasKerberosTicketValidator;
import org.springframework.security.kerberos.web.authentication.SpnegoAuthenticationProcessingFilter;
import org.springframework.security.kerberos.web.authentication.SpnegoEntryPoint;
import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
//tag::snippetA[]

6
spring-security-kerberos-core/src/test/java/org/springframework/security/kerberos/web/SpnegoAuthenticationProcessingFilterTest.java → spring-security-kerberos-web/src/test/java/org/springframework/security/kerberos/web/SpnegoAuthenticationProcessingFilterTest.java
View File

@@ -43,9 +43,9 @@ import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.kerberos.KerberosServiceRequestToken;
import org.springframework.security.kerberos.KerberosTicketValidator.KerberosTicketValidation;
import org.springframework.security.kerberos.web.SpnegoAuthenticationProcessingFilter;
import org.springframework.security.kerberos.authentication.KerberosServiceRequestToken;
import org.springframework.security.kerberos.authentication.KerberosTicketValidation;
import org.springframework.security.kerberos.web.authentication.SpnegoAuthenticationProcessingFilter;
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;

2
spring-security-kerberos-core/src/test/java/org/springframework/security/kerberos/web/SpnegoEntryPointTest.java → spring-security-kerberos-web/src/test/java/org/springframework/security/kerberos/web/SpnegoEntryPointTest.java
View File

@@ -16,7 +16,7 @@
package org.springframework.security.kerberos.web;
import org.junit.Test;
import org.springframework.security.kerberos.web.SpnegoEntryPoint;
import org.springframework.security.kerberos.web.authentication.SpnegoEntryPoint;
import javax.servlet.RequestDispatcher;
import javax.servlet.http.HttpServletRequest;

17
spring-security-kerberos-core/src/test/java/org/springframework/security/kerberos/docs/AuthProviderConfig.xml → spring-security-kerberos-web/src/test/resources/org/springframework/security/kerberos/docs/AuthProviderConfig.xml
View File

@@ -7,9 +7,9 @@
xsi:schemaLocation="
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.2.xsd
http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd">
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">
<sec:http use-expressions="true" >
<sec:http entry-point-ref="spnegoEntryPoint" use-expressions="true">
<sec:intercept-url pattern="/" access="permitAll" />
<sec:intercept-url pattern="/home" access="permitAll" />
<sec:intercept-url pattern="/**" access="authenticated"/>
@@ -20,9 +20,9 @@
</sec:authentication-manager>
<bean id="kerberosAuthenticationProvider"
class="org.springframework.security.kerberos.KerberosAuthenticationProvider">
class="org.springframework.security.kerberos.authentication.KerberosAuthenticationProvider">
<property name="kerberosClient">
<bean class="org.springframework.security.kerberos.SunJaasKerberosClient">
<bean class="org.springframework.security.kerberos.authentication.sun.SunJaasKerberosClient">
<property name="debug" value="true"/>
</bean>
</property>
@@ -30,13 +30,18 @@
</bean>
<bean
class="org.springframework.security.kerberos.GlobalSunJaasKerberosConfig">
class="org.springframework.security.kerberos.authentication.sun.GlobalSunJaasKerberosConfig">
<property name="debug" value="true" />
<property name="krbConfLocation" value="/path/to/krb5.ini"/>
</bean>
<bean id="dummyUserDetailsService"
class="org.springframework.security.kerberos.sample.DummyUserDetailsService" />
class="org.springframework.security.kerberos.docs.DummyUserDetailsService" />
<bean id="spnegoEntryPoint"
class="org.springframework.security.kerberos.web.authentication.SpnegoEntryPoint" >
<constructor-arg value="/login" />
</bean>
</beans>
<!-- end::snippetA[] -->

14
spring-security-kerberos-core/src/test/java/org/springframework/security/kerberos/docs/SpnegoConfig.xml → spring-security-kerberos-web/src/test/resources/org/springframework/security/kerberos/docs/SpnegoConfig.xml
View File

@@ -4,7 +4,7 @@
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:sec="http://www.springframework.org/schema/security"
xmlns:context="http://www.springframework.org/schema/context"
xsi:schemaLocation="http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.2.xsd
xsi:schemaLocation="http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd
http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.1.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.1.xsd">
@@ -24,30 +24,30 @@
</sec:authentication-manager>
<bean id="kerberosAuthenticationProvider"
class="org.springframework.security.kerberos.KerberosAuthenticationProvider">
class="org.springframework.security.kerberos.authentication.KerberosAuthenticationProvider">
<property name="userDetailsService" ref="dummyUserDetailsService"/>
<property name="kerberosClient">
<bean class="org.springframework.security.kerberos.SunJaasKerberosClient">
<bean class="org.springframework.security.kerberos.authentication.sun.SunJaasKerberosClient">
<property name="debug" value="true"/>
</bean>
</property>
</bean>
<bean id="spnegoEntryPoint"
class="org.springframework.security.kerberos.web.SpnegoEntryPoint" >
class="org.springframework.security.kerberos.web.authentication.SpnegoEntryPoint" >
<constructor-arg value="/login" />
</bean>
<bean id="spnegoAuthenticationProcessingFilter"
class="org.springframework.security.kerberos.web.SpnegoAuthenticationProcessingFilter">
class="org.springframework.security.kerberos.web.authentication.SpnegoAuthenticationProcessingFilter">
<property name="authenticationManager" ref="authenticationManager" />
</bean>
<bean id="kerberosServiceAuthenticationProvider"
class="org.springframework.security.kerberos.KerberosServiceAuthenticationProvider">
class="org.springframework.security.kerberos.authentication.KerberosServiceAuthenticationProvider">
<property name="ticketValidator">
<bean
class="org.springframework.security.kerberos.SunJaasKerberosTicketValidator">
class="org.springframework.security.kerberos.authentication.sun.SunJaasKerberosTicketValidator">
<property name="servicePrincipal" value="${app.service-principal}" />
<property name="keyTabLocation" value="${app.keytab-location}" />
<property name="debug" value="true" />

12
spring-security-kerberos-web/src/test/resources/org/springframework/security/kerberos/docs/appproperties.xml Normal file
View File

@@ -0,0 +1,12 @@
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:util="http://www.springframework.org/schema/util"
xmlns:context="http://www.springframework.org/schema/context"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.1.xsd
http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-4.1.xsd">
<context:property-placeholder location="app.properties"/>
</beans>