diff --git a/pom.xml b/pom.xml index 0d2f889..a6168fc 100644 --- a/pom.xml +++ b/pom.xml @@ -87,11 +87,22 @@ 4.6 test - - org.springframework.security - spring-security-core - 3.0.0.M2 - + + org.springframework.security + spring-security-core + ${spring.security.version} + + + org.springframework.security + spring-security-web + ${spring.security.version} + + + javax.servlet + servlet-api + 2.4 + provided + @@ -184,6 +195,7 @@ UTF-8 UTF-8 3.0.0.M4 + 3.0.0.M2 diff --git a/src/main/java/org/springframework/security/extensions/kerberos/KerberosServiceRequestToken.java b/src/main/java/org/springframework/security/extensions/kerberos/KerberosServiceRequestToken.java new file mode 100644 index 0000000..49a6f1e --- /dev/null +++ b/src/main/java/org/springframework/security/extensions/kerberos/KerberosServiceRequestToken.java @@ -0,0 +1,63 @@ +/* + * Copyright 2002-2008 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.springframework.security.extensions.kerberos; + +import org.springframework.security.authentication.AbstractAuthenticationToken; + +/** + * Holds the Kerberos/SPNEGO token for requesting a kerberized service Will + * mostly be created in ...Filter and authenticated in + * KerberosServiceAuthenticationProvider + * + * @author Mike Wiesner + * @since 1.0 + * @version $Id: $ + */ + +public class KerberosServiceRequestToken extends AbstractAuthenticationToken { + + private static final long serialVersionUID = 395488921064775014L; + private final byte[] token; + private final Object principal = null; + + /** + * Creates an unauthenticated instance which should then be authenticated by + * KerberosServiceAuthenticationProvider + * + * @param token + * Kerberos/SPNEGO token + */ + public KerberosServiceRequestToken(byte[] token) { + super(null); + this.token = token; + } + + @Override + public Object getCredentials() { + return this.token; + } + + @Override + public Object getPrincipal() { + return this.principal; + } + + public byte[] getToken() { + return this.token; + } + +} diff --git a/src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoAuthenticationProcessingFilter.java b/src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoAuthenticationProcessingFilter.java new file mode 100644 index 0000000..b9c7f8f --- /dev/null +++ b/src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoAuthenticationProcessingFilter.java @@ -0,0 +1,79 @@ +/* + * Copyright 2002-2008 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.springframework.security.extensions.kerberos.web; + +import java.io.IOException; + +import javax.servlet.FilterChain; +import javax.servlet.ServletException; +import javax.servlet.ServletRequest; +import javax.servlet.ServletResponse; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.apache.commons.codec.binary.Base64; +import org.springframework.security.authentication.AuthenticationManager; +import org.springframework.security.core.Authentication; +import org.springframework.security.core.AuthenticationException; +import org.springframework.security.core.context.SecurityContextHolder; +import org.springframework.security.extensions.kerberos.KerberosServiceRequestToken; +import org.springframework.web.filter.GenericFilterBean; + +/** + * + * @author Mike Wiesner + * @since 1.0 + * @version $Id: $ + */ +public class SpnegoAuthenticationProcessingFilter extends GenericFilterBean { + + private AuthenticationManager authenticationManager; + + @Override + public void doFilter(ServletRequest req, ServletResponse res, + FilterChain chain) throws IOException, ServletException { + HttpServletRequest request = (HttpServletRequest) req; + HttpServletResponse response = (HttpServletResponse) res; + + String header = request.getHeader("Authorization"); + + if ((header != null) && header.startsWith("Negotiate ")) { + String base64Token = header.substring(10); + byte[] kerberosTicket = Base64.decodeBase64(base64Token.trim() + .getBytes()); + KerberosServiceRequestToken authenticationRequest = new KerberosServiceRequestToken( + kerberosTicket); + Authentication authentication; + try { + authentication = authenticationManager + .authenticate(authenticationRequest); + } catch (AuthenticationException e) { + SecurityContextHolder.clearContext(); + response + .setStatus(HttpServletResponse.SC_INTERNAL_SERVER_ERROR); + response.flushBuffer(); + return; + } + SecurityContextHolder.getContext() + .setAuthentication(authentication); + } + + chain.doFilter(request, response); + + } + +} diff --git a/src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoEntryPoint.java b/src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoEntryPoint.java new file mode 100644 index 0000000..ad320af --- /dev/null +++ b/src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoEntryPoint.java @@ -0,0 +1,45 @@ +/* + * Copyright 2002-2008 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.springframework.security.extensions.kerberos.web; + +import java.io.IOException; + +import javax.servlet.ServletException; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.springframework.security.core.AuthenticationException; +import org.springframework.security.web.AuthenticationEntryPoint; + +/** + * + * @author Mike Wiesner + * @since 1.0 + * @version $Id: $ + */ +public class SpnegoEntryPoint implements AuthenticationEntryPoint { + + @Override + public void commence(HttpServletRequest request, HttpServletResponse response, + AuthenticationException ex) throws IOException, ServletException { + response.addHeader("WWW-Authenticate", "Negotiate"); + response.setStatus(HttpServletResponse.SC_UNAUTHORIZED); + response.flushBuffer(); + + } + +}