SES-136 Option to provide content with WWW-Authentication:Negotiate Response of SpnegoEntryPoint by forward
This commit is contained in:
aschaefer
@@ -1,12 +1,9 @@
|
||||
/*
|
||||
* Copyright 2009 the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
@@ -16,41 +13,102 @@
|
||||
|
||||
package org.springframework.security.extensions.kerberos.web;
|
||||
|
||||
import java.io.IOException;
|
||||
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
import org.apache.commons.logging.Log;
|
||||
import org.apache.commons.logging.LogFactory;
|
||||
import org.springframework.security.core.AuthenticationException;
|
||||
import org.springframework.security.web.AuthenticationEntryPoint;
|
||||
import org.springframework.security.web.util.UrlUtils;
|
||||
import org.springframework.util.Assert;
|
||||
import org.springframework.util.StringUtils;
|
||||
|
||||
import javax.servlet.RequestDispatcher;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
import java.io.IOException;
|
||||
|
||||
/**
|
||||
* Sends back a request for a Negotiate Authentication to the browser.
|
||||
* <p>
|
||||
* With optional configured <code>forwardUrl</code> it is possible to use form login as fallback authentication.
|
||||
*
|
||||
* This approach enables security configuration to use SPNEGO in combination with login form as fallback for clients that do not support this kind of
|
||||
* authentication.Set Response Code 401 - unauthorized and forward to login page. A useful scenarion might be an environment where windows domain is
|
||||
* present but it is required to access the application also from non domain client devices. One could use a combination with form based LDAP login.
|
||||
* </p>
|
||||
* <p>
|
||||
* See <code>spnego-with-form-login.xml</code> in spring-security-kerberos-sample for details
|
||||
* </p>
|
||||
*
|
||||
*
|
||||
* @author Mike Wiesner
|
||||
* @author Andre Schaefer, Namics AG
|
||||
* @since 1.0
|
||||
* @version $Id$
|
||||
* @see SpnegoAuthenticationProcessingFilter
|
||||
*/
|
||||
public class SpnegoEntryPoint implements AuthenticationEntryPoint {
|
||||
public class SpnegoEntryPoint implements AuthenticationEntryPoint
|
||||
{
|
||||
|
||||
private static final Log LOG = LogFactory.getLog(SpnegoEntryPoint.class);
|
||||
private static final Log LOG = LogFactory.getLog(SpnegoEntryPoint.class);
|
||||
|
||||
/* (non-Javadoc)
|
||||
* @see org.springframework.security.web.AuthenticationEntryPoint#commence(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, org.springframework.security.core.AuthenticationException)
|
||||
*/
|
||||
public void commence(HttpServletRequest request, HttpServletResponse response,
|
||||
AuthenticationException ex) throws IOException, ServletException {
|
||||
if (LOG.isDebugEnabled()) {
|
||||
LOG.debug("Sending back Negotiate Header for request: "+request.getRequestURL());
|
||||
}
|
||||
response.addHeader("WWW-Authenticate", "Negotiate");
|
||||
response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
|
||||
response.flushBuffer();
|
||||
private String forwardUrl;
|
||||
|
||||
}
|
||||
protected boolean forward = false;
|
||||
|
||||
/**
|
||||
* Using this constructor the EntryPoint will Sends back a request for a Negotiate Authentication to the browser
|
||||
* without providing a fallback mechanism for login, Use constructor with forwardUrl to provide form based login.
|
||||
*/
|
||||
public SpnegoEntryPoint()
|
||||
{
|
||||
}
|
||||
|
||||
/**
|
||||
* This constructor enables security configuration to use SPNEGO in combination with login form as fallback for clients that do not support this
|
||||
* kind of authentication.
|
||||
*
|
||||
* @param forwardUrl
|
||||
* URL where the login page can be found. Should either be relative to the web-app context path
|
||||
* (include a leading {@code /}) or an absolute URL.
|
||||
*/
|
||||
public SpnegoEntryPoint(String forwardUrl)
|
||||
{
|
||||
this();
|
||||
if (StringUtils.hasText(forwardUrl))
|
||||
{
|
||||
Assert.isTrue(UrlUtils.isValidRedirectUrl(forwardUrl), "forwardUrl specified must be a valid forward URL");
|
||||
Assert.isTrue(!UrlUtils.isAbsoluteUrl(forwardUrl), "loginFormURL specified must not be absolute");
|
||||
this.forwardUrl = forwardUrl;
|
||||
this.forward = true;
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* (non-Javadoc)
|
||||
* @see org.springframework.security.web.AuthenticationEntryPoint#commence(javax.servlet.http.HttpServletRequest,
|
||||
* javax.servlet.http.HttpServletResponse, org.springframework.security.core.AuthenticationException)
|
||||
*/
|
||||
public void commence( HttpServletRequest request,
|
||||
HttpServletResponse response,
|
||||
AuthenticationException ex) throws IOException, ServletException
|
||||
{
|
||||
if (LOG.isDebugEnabled())
|
||||
{
|
||||
LOG.debug("Add header WWW-Authenticate:Negotiate to "+request.getRequestURL()+", forward: " + (forward ? forwardUrl :"no"));
|
||||
}
|
||||
response.addHeader("WWW-Authenticate", "Negotiate");
|
||||
response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
|
||||
|
||||
if (forward)
|
||||
{
|
||||
RequestDispatcher dispatcher = request.getRequestDispatcher(forwardUrl);
|
||||
dispatcher.forward(request, response);
|
||||
}
|
||||
else
|
||||
{
|
||||
response.flushBuffer();
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
@@ -15,31 +15,55 @@
|
||||
*/
|
||||
package org.springframework.security.extensions.kerberos.web;
|
||||
|
||||
import static org.mockito.Mockito.*;
|
||||
import org.junit.Test;
|
||||
|
||||
import javax.servlet.RequestDispatcher;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
import org.junit.Test;
|
||||
import static org.mockito.Matchers.anyString;
|
||||
import static org.mockito.Mockito.*;
|
||||
|
||||
/**
|
||||
* Test class for {@link SpnegoEntryPoint}
|
||||
*
|
||||
* @author Mike Wiesner
|
||||
* @author Andre Schaefer, Namics AG
|
||||
* @since 1.0
|
||||
* @version $Id$
|
||||
*/
|
||||
public class SpnegoEntryPointTest {
|
||||
|
||||
private SpnegoEntryPoint entryPoint = new SpnegoEntryPoint();
|
||||
@Test
|
||||
public void testEntryPointOk() throws Exception {
|
||||
SpnegoEntryPoint entryPoint = new SpnegoEntryPoint();
|
||||
HttpServletResponse response = mock(HttpServletResponse.class);
|
||||
HttpServletRequest request = mock(HttpServletRequest.class);
|
||||
RequestDispatcher requestDispatcher = mock(RequestDispatcher.class);
|
||||
when(request.getRequestDispatcher(anyString())).thenReturn(requestDispatcher);
|
||||
entryPoint.commence(request, response, null);
|
||||
verify(response).addHeader("WWW-Authenticate", "Negotiate");
|
||||
verify(response).setStatus(HttpServletResponse.SC_UNAUTHORIZED);
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testEntryPointOk() throws Exception {
|
||||
HttpServletResponse response = mock(HttpServletResponse.class);
|
||||
@Test
|
||||
public void testEntryPointForwardOk() throws Exception {
|
||||
String forwardUrl = "/login";
|
||||
SpnegoEntryPoint entryPoint = new SpnegoEntryPoint(forwardUrl);
|
||||
HttpServletResponse response = mock(HttpServletResponse.class);
|
||||
HttpServletRequest request = mock(HttpServletRequest.class);
|
||||
RequestDispatcher requestDispatcher = mock(RequestDispatcher.class);
|
||||
when(request.getRequestDispatcher(anyString())).thenReturn(requestDispatcher);
|
||||
entryPoint.commence(request, response, null);
|
||||
verify(response).addHeader("WWW-Authenticate", "Negotiate");
|
||||
verify(response).setStatus(HttpServletResponse.SC_UNAUTHORIZED);
|
||||
verify(request).getRequestDispatcher(forwardUrl);
|
||||
verify(requestDispatcher).forward(request,response);
|
||||
|
||||
entryPoint.commence(null, response, null);
|
||||
|
||||
verify(response).addHeader("WWW-Authenticate", "Negotiate");
|
||||
verify(response).setStatus(HttpServletResponse.SC_UNAUTHORIZED);
|
||||
}
|
||||
}
|
||||
|
||||
@Test(expected = IllegalArgumentException.class)
|
||||
public void testEntryPointForwardAbsolute() throws Exception {
|
||||
new SpnegoEntryPoint("http://test/login");
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user