(1);
princ.add(new KerberosPrincipal(this.servicePrincipal));
@@ -108,6 +127,23 @@ public class SunJaasKerberosTicketValidator implements KerberosTicketValidator,
this.servicePrincipal = servicePrincipal;
}
+ /**
+ * The realm name of the application.
+ * For web apps this is DOMAIN
+ * @param realmName
+ */
+ public void setRealmName(String realmName) {
+ this.realmName = realmName;
+ }
+
+ /**
+ *
+ * @param multiTier
+ */
+ public void setMultiTier(boolean multiTier) {
+ this.multiTier = multiTier;
+ }
+
/**
* The location of the keytab. You can use the normale Spring Resource
* prefixes like file: or classpath:, but as the
@@ -146,6 +182,69 @@ public class SunJaasKerberosTicketValidator implements KerberosTicketValidator,
this.holdOnToGSSContext = holdOnToGSSContext;
}
+
+
+ /**
+ * This class is needed, because the validation must run with previously generated JAAS subject
+ * which belongs to the service principal and was loaded out of the keytab during startup.
+ */
+ private class KerberosMultitierValidateAction implements PrivilegedExceptionAction {
+ byte[] kerberosTicket;
+
+ public KerberosMultitierValidateAction(byte[] kerberosTicket) {
+ this.kerberosTicket = kerberosTicket;
+ }
+
+ @Override
+ public KerberosTicketValidation run() throws Exception {
+ byte[] responseToken = new byte[0];
+ GSSManager manager = GSSManager.getInstance();
+
+ GSSName serverName =
+ manager.createName(servicePrincipal,
+ GSSName.NT_USER_NAME);
+
+ GSSCredential serverCreds =
+ manager.createCredential(serverName,
+ GSSCredential.INDEFINITE_LIFETIME,
+ KerberosMultiTier.KERBEROS_OID,
+ GSSCredential.INITIATE_AND_ACCEPT);
+
+ GSSContext context = manager.createContext(serverCreds);
+
+ boolean first = true;
+ while (!context.isEstablished()) {
+ if (first) {
+ kerberosTicket = tweakJdkRegression(kerberosTicket);
+ }
+ responseToken = context.acceptSecContext(kerberosTicket, 0, kerberosTicket.length);
+ serverName = context.getSrcName();
+ if (serverName == null) {
+ throw new BadCredentialsException("GSSContext name of the context initiator is null");
+ }
+ first = false;
+ }
+
+ Subject subject = GSSUtil.createSubject(
+ context.getSrcName(),
+ context.getDelegCred());
+
+ KerberosTicketValidation result = new KerberosTicketValidation(
+ context.getSrcName().toString(),
+ subject,
+ responseToken,
+ context);
+
+ if (!holdOnToGSSContext) {
+ context.dispose();
+ }
+
+ return result;
+ }
+ }
+
+
+
/**
* This class is needed, because the validation must run with previously generated JAAS subject
* which belongs to the service principal and was loaded out of the keytab during startup.
@@ -159,28 +258,33 @@ public class SunJaasKerberosTicketValidator implements KerberosTicketValidator,
@Override
public KerberosTicketValidation run() throws Exception {
- byte[] responseToken = new byte[0];
- GSSName gssName = null;
- GSSContext context = GSSManager.getInstance().createContext((GSSCredential) null);
- boolean first = true;
- while (!context.isEstablished()) {
- if (first) {
- kerberosTicket = tweakJdkRegression(kerberosTicket);
- }
- responseToken = context.acceptSecContext(kerberosTicket, 0, kerberosTicket.length);
- gssName = context.getSrcName();
- if (gssName == null) {
- throw new BadCredentialsException("GSSContext name of the context initiator is null");
- }
- first = false;
- }
- if (!holdOnToGSSContext) {
- context.dispose();
- }
- return new KerberosTicketValidation(gssName.toString(), servicePrincipal, responseToken, context);
+ byte[] responseToken = new byte[0];
+ GSSName gssName = null;
+ GSSContext context = GSSManager.getInstance().createContext((GSSCredential) null);
+ boolean first = true;
+ while (!context.isEstablished()) {
+ if (first) {
+ kerberosTicket = tweakJdkRegression(kerberosTicket);
+ }
+ responseToken = context.acceptSecContext(kerberosTicket, 0, kerberosTicket.length);
+ gssName = context.getSrcName();
+ if (gssName == null) {
+ throw new BadCredentialsException("GSSContext name of the context initiator is null");
+ }
+ first = false;
+ }
+ if (!holdOnToGSSContext) {
+ context.dispose();
+ }
+ return new KerberosTicketValidation(gssName.toString(),
+ servicePrincipal,
+ responseToken,
+ context);
}
}
+
+
/**
* Normally you need a JAAS config file in order to use the JAAS Kerberos Login Module,
* with this class it is not needed and you can have different configurations in one JVM.
@@ -188,11 +292,15 @@ public class SunJaasKerberosTicketValidator implements KerberosTicketValidator,
private static class LoginConfig extends Configuration {
private String keyTabLocation;
private String servicePrincipalName;
+ private String realmName;
+ private boolean multiTier;
private boolean debug;
- public LoginConfig(String keyTabLocation, String servicePrincipalName, boolean debug) {
+ public LoginConfig(String keyTabLocation, String servicePrincipalName, String realmName, boolean multiTier, boolean debug) {
this.keyTabLocation = keyTabLocation;
this.servicePrincipalName = servicePrincipalName;
+ this.realmName = realmName;
+ this.multiTier = multiTier;
this.debug = debug;
}
@@ -207,7 +315,14 @@ public class SunJaasKerberosTicketValidator implements KerberosTicketValidator,
if (this.debug) {
options.put("debug", "true");
}
- options.put("isInitiator", "false");
+
+ if (this.realmName != null) {
+ options.put("realm", realmName);
+ }
+
+ if (!multiTier) {
+ options.put("isInitiator", "false");
+ }
return new AppConfigurationEntry[] { new AppConfigurationEntry("com.sun.security.auth.module.Krb5LoginModule",
AppConfigurationEntry.LoginModuleControlFlag.REQUIRED, options), };
diff --git a/spring-security-kerberos-core/src/test/java/org/springframework/security/kerberos/authentication/KerberosAuthenticationProviderTest.java b/spring-security-kerberos-core/src/test/java/org/springframework/security/kerberos/authentication/KerberosAuthenticationProviderTest.java
index a784d01..d49f673 100644
--- a/spring-security-kerberos-core/src/test/java/org/springframework/security/kerberos/authentication/KerberosAuthenticationProviderTest.java
+++ b/spring-security-kerberos-core/src/test/java/org/springframework/security/kerberos/authentication/KerberosAuthenticationProviderTest.java
@@ -29,8 +29,6 @@ import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
-import org.springframework.security.kerberos.authentication.KerberosAuthenticationProvider;
-import org.springframework.security.kerberos.authentication.KerberosClient;
/**
* Test class for {@link KerberosAuthenticationProvider}
@@ -49,6 +47,7 @@ public class KerberosAuthenticationProviderTest {
private static final UsernamePasswordAuthenticationToken INPUT_TOKEN = new UsernamePasswordAuthenticationToken(TEST_USER, TEST_PASSWORD);
private static final List AUTHORITY_LIST = AuthorityUtils.createAuthorityList("ROLE_ADMIN");
private static final UserDetails USER_DETAILS = new User(TEST_USER, "empty", true, true, true,true, AUTHORITY_LIST);
+ private static final JaasSubjectHolder JAAS_SUBJECT_HOLDER = new JaasSubjectHolder(null, TEST_USER);
@Before
public void before() {
@@ -63,7 +62,7 @@ public class KerberosAuthenticationProviderTest {
@Test
public void testLoginOk() throws Exception {
when(userDetailsService.loadUserByUsername(TEST_USER)).thenReturn(USER_DETAILS);
- when(kerberosClient.login(TEST_USER, TEST_PASSWORD)).thenReturn(TEST_USER);
+ when(kerberosClient.login(TEST_USER, TEST_PASSWORD)).thenReturn(JAAS_SUBJECT_HOLDER);
Authentication authenticate = provider.authenticate(INPUT_TOKEN);
diff --git a/spring-security-kerberos-test/src/main/java/org/springframework/security/kerberos/test/MiniKdc.java b/spring-security-kerberos-test/src/main/java/org/springframework/security/kerberos/test/MiniKdc.java
index a71a0f5..f11f2d3 100644
--- a/spring-security-kerberos-test/src/main/java/org/springframework/security/kerberos/test/MiniKdc.java
+++ b/spring-security-kerberos-test/src/main/java/org/springframework/security/kerberos/test/MiniKdc.java
@@ -104,6 +104,7 @@ import java.util.UUID;
*
* @author Original Hadoop MiniKdc Authors
* @author Janne Valkealahti
+ * @author Bogdan Mustiata
*
*/
public class MiniKdc {
@@ -539,4 +540,28 @@ public class MiniKdc {
keytab.setEntries(entries);
keytab.write(keytabFile);
}
+
+ /**
+ * Creates multiple principals in the KDC and adds them to a keytab file.
+ *
+ * @param keytabFile keytab file to add the created principal.
+ * @param principal The principal to store in the keytab file.
+ * @param password The password for the principal.
+ * @throws Exception thrown if the principals or the keytab file could not be created.
+ */
+ public void createKeyabFile(File keytabFile, String principal, String password) throws Exception {
+ Keytab keytab = new Keytab();
+ List entries = new ArrayList();
+
+ KerberosTime timestamp = new KerberosTime();
+ for (Map.Entry entry : KerberosKeyFactory.getKerberosKeys(principal,
+ password).entrySet()) {
+ EncryptionKey ekey = entry.getValue();
+ byte keyVersion = (byte) ekey.getKeyVersion();
+ entries.add(new KeytabEntry(principal, 1L, timestamp, keyVersion, ekey));
+ }
+
+ keytab.setEntries(entries);
+ keytab.write(keytabFile);
+ }
}