SES-1: Added SPNEGO filters

pom.xml

@@ -87,11 +87,22 @@
 			<version>4.6</version>
 			<scope>test</scope>
 		</dependency>
-		       <dependency>
-            <groupId>org.springframework.security</groupId>
-            <artifactId>spring-security-core</artifactId>
-            <version>3.0.0.M2</version>
-        </dependency>
+		<dependency>
+			<groupId>org.springframework.security</groupId>
+			<artifactId>spring-security-core</artifactId>
+			<version>${spring.security.version}</version>
+		</dependency>
+		<dependency>
+			<groupId>org.springframework.security</groupId>
+			<artifactId>spring-security-web</artifactId>
+			<version>${spring.security.version}</version>
+		</dependency>
+		<dependency>
+			<groupId>javax.servlet</groupId>
+			<artifactId>servlet-api</artifactId>
+			<version>2.4</version>
+			<scope>provided</scope>
+		</dependency>
 	</dependencies>
 
 	<build>
@@ -184,6 +195,7 @@
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 		<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
 		<spring.version>3.0.0.M4</spring.version>
+		<spring.security.version>3.0.0.M2</spring.security.version>
 	</properties>
 
 </project>

src/main/java/org/springframework/security/extensions/kerberos/KerberosServiceRequestToken.java

@@ -0,0 +1,63 @@
+/*
+ * Copyright 2002-2008 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.extensions.kerberos;
+
+import org.springframework.security.authentication.AbstractAuthenticationToken;
+
+/**
+ * Holds the Kerberos/SPNEGO token for requesting a kerberized service Will
+ * mostly be created in ...Filter and authenticated in
+ * KerberosServiceAuthenticationProvider
+ * 
+ * @author Mike Wiesner
+ * @since 1.0
+ * @version $Id: $
+ */
+
+public class KerberosServiceRequestToken extends AbstractAuthenticationToken {
+
+	private static final long serialVersionUID = 395488921064775014L;
+	private final byte[] token;
+	private final Object principal = null;
+
+	/**
+	 * Creates an unauthenticated instance which should then be authenticated by
+	 * KerberosServiceAuthenticationProvider
+	 * 
+	 * @param token
+	 *            Kerberos/SPNEGO token
+	 */
+	public KerberosServiceRequestToken(byte[] token) {
+		super(null);
+		this.token = token;
+	}
+
+	@Override
+	public Object getCredentials() {
+		return this.token;
+	}
+
+	@Override
+	public Object getPrincipal() {
+		return this.principal;
+	}
+
+	public byte[] getToken() {
+		return this.token;
+	}
+
+}

src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoAuthenticationProcessingFilter.java

@@ -0,0 +1,79 @@
+/*
+ * Copyright 2002-2008 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.extensions.kerberos.web;
+
+import java.io.IOException;
+
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.commons.codec.binary.Base64;
+import org.springframework.security.authentication.AuthenticationManager;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.extensions.kerberos.KerberosServiceRequestToken;
+import org.springframework.web.filter.GenericFilterBean;
+
+/**
+ * 
+ * @author Mike Wiesner
+ * @since 1.0
+ * @version $Id: $
+ */
+public class SpnegoAuthenticationProcessingFilter extends GenericFilterBean {
+
+	private AuthenticationManager authenticationManager;
+
+	@Override
+	public void doFilter(ServletRequest req, ServletResponse res,
+			FilterChain chain) throws IOException, ServletException {
+		HttpServletRequest request = (HttpServletRequest) req;
+		HttpServletResponse response = (HttpServletResponse) res;
+
+		String header = request.getHeader("Authorization");
+
+		if ((header != null) && header.startsWith("Negotiate ")) {
+			String base64Token = header.substring(10);
+			byte[] kerberosTicket = Base64.decodeBase64(base64Token.trim()
+					.getBytes());
+			KerberosServiceRequestToken authenticationRequest = new KerberosServiceRequestToken(
+					kerberosTicket);
+			Authentication authentication;
+			try {
+				authentication = authenticationManager
+						.authenticate(authenticationRequest);
+			} catch (AuthenticationException e) {
+				SecurityContextHolder.clearContext();
+				response
+						.setStatus(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
+				response.flushBuffer();
+				return;
+			}
+			SecurityContextHolder.getContext()
+					.setAuthentication(authentication);
+		}
+
+		chain.doFilter(request, response);
+
+	}
+
+}

src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoEntryPoint.java

@@ -0,0 +1,45 @@
+/*
+ * Copyright 2002-2008 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.extensions.kerberos.web;
+
+import java.io.IOException;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.web.AuthenticationEntryPoint;
+
+/**
+ * 
+ * @author Mike Wiesner
+ * @since 1.0
+ * @version $Id: $
+ */
+public class SpnegoEntryPoint implements AuthenticationEntryPoint {
+
+	@Override
+	public void commence(HttpServletRequest request, HttpServletResponse response,
+			AuthenticationException ex) throws IOException, ServletException {
+        response.addHeader("WWW-Authenticate", "Negotiate");
+        response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
+        response.flushBuffer();
+
+	}
+
+}