diff --git a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/GlobalSunJaasKerberosConfig.java b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/GlobalSunJaasKerberosConfig.java new file mode 100644 index 0000000..1612e2f --- /dev/null +++ b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/GlobalSunJaasKerberosConfig.java @@ -0,0 +1,75 @@ +/* + * Copyright 2010 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.springframework.security.extensions.kerberos; + +import org.springframework.beans.BeansException; +import org.springframework.beans.factory.InitializingBean; +import org.springframework.beans.factory.config.BeanPostProcessor; + +/** + * @author Mike Wiesner + * @since 1.0 + * @version $Id:$ + */ +public class GlobalSunJaasKerberosConfig implements BeanPostProcessor, InitializingBean { + + private boolean debug = false; + private String krbConfLocation; + + public void afterPropertiesSet() throws Exception { + if (debug) { + System.setProperty("sun.security.krb5.debug", "true"); + } + if (krbConfLocation != null) { + System.setProperty("java.security.krb5.conf", krbConfLocation); + } + + } + + + /** + * Enable debug logs from the Sun Kerberos Implementation. Default is false. + */ + public void setDebug(boolean debug) { + this.debug = debug; + } + + + /** + * Kerberos config file location can be specified here. + * + * @param krbConfLocation + */ + public void setKrbConfLocation(String krbConfLocation) { + this.krbConfLocation = krbConfLocation; + } + + + /* + * The following methods are not used here. This Bean implements only BeanPostProcessor to ensure that it + * is created before any other bean is created, because the system properties needed to be set very early + * in the startup-phase, but after the BeanFactoryPostProcessing. + */ + + public Object postProcessAfterInitialization(Object bean, String beanName) throws BeansException { + return bean; + } + + public Object postProcessBeforeInitialization(Object bean, String beanName) throws BeansException { + return bean; + } + +} diff --git a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/KerberosAuthenticationProvider.java b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/KerberosAuthenticationProvider.java index feb6634..2c0b746 100644 --- a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/KerberosAuthenticationProvider.java +++ b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/KerberosAuthenticationProvider.java @@ -43,14 +43,7 @@ public class KerberosAuthenticationProvider implements AuthenticationProvider { public Authentication authenticate(Authentication authentication) throws AuthenticationException { UsernamePasswordAuthenticationToken auth = (UsernamePasswordAuthenticationToken) authentication; String validatedUsername = kerberosClient.login(auth.getName(), auth.getCredentials().toString()); - if (validatedUsername.equalsIgnoreCase(auth.getName()) == false) { - if (LOG.isDebugEnabled()) { - LOG.info("Username returned from KDC ("+validatedUsername+") doesn't match with supplied username ("+auth.getName()+")"); - } - throw new BadCredentialsException("Username returned from KDC doesn't match with supplied username"); - } - - UserDetails userDetails = this.userDetailsService.loadUserByUsername(auth.getName()); + UserDetails userDetails = this.userDetailsService.loadUserByUsername(validatedUsername); UsernamePasswordAuthenticationToken output = new UsernamePasswordAuthenticationToken(userDetails, auth.getCredentials(), userDetails.getAuthorities()); return output; diff --git a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/SunJaasKerberosClient.java b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/SunJaasKerberosClient.java index 49a27a2..c402319 100644 --- a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/SunJaasKerberosClient.java +++ b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/SunJaasKerberosClient.java @@ -31,7 +31,6 @@ import javax.security.auth.login.LoginException; import org.apache.commons.logging.Log; import org.apache.commons.logging.LogFactory; -import org.springframework.beans.factory.InitializingBean; import org.springframework.security.authentication.BadCredentialsException; /** @@ -44,10 +43,9 @@ import org.springframework.security.authentication.BadCredentialsException; * @since 1.0 * @version $Id$ */ -public class SunJaasKerberosClient implements KerberosClient, InitializingBean { +public class SunJaasKerberosClient implements KerberosClient { private boolean debug = false; - private String krbConfLocation; private static final Log LOG = LogFactory.getLog(SunJaasKerberosClient.class); @@ -77,22 +75,6 @@ public class SunJaasKerberosClient implements KerberosClient, InitializingBean { this.debug = debug; } - - public void setKrbConfLocation(String krbConfLocation) { - this.krbConfLocation = krbConfLocation; - } - - public void afterPropertiesSet() throws Exception { - if (krbConfLocation != null) { - System.setProperty("java.security.krb5.conf", krbConfLocation); - } - if (debug) { - System.setProperty("sun.security.krb5.debug", "true"); - } - - - } - private static class LoginConfig extends Configuration { private boolean debug;