Spring/spring-security-kerberos
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Polish

Browse Source
This commit is contained in:
Janne Valkealahti
2015-02-26 13:41:28 +00:00
parent e8633c0e2f
commit fc005b49b8
13 changed files with 154 additions and 194 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
build.gradle
View File

@@ -78,7 +78,7 @@ configure(subprojects) { subproject ->
dependencies {
testCompile "org.mockito:mockito-core:$mockitoVersion"
testCompile "junit:junit:$junitVersion"
// testRuntime("log4j:log4j:$log4jVersion")
testRuntime("log4j:log4j:$log4jVersion")
}
}

27
spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/GlobalSunJaasKerberosConfig.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2010 the original author or authors.
* Copyright 2010-2015 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -20,13 +20,15 @@ import org.springframework.beans.factory.InitializingBean;
import org.springframework.beans.factory.config.BeanPostProcessor;
/**
* Config for global jaas.
*
* @author Mike Wiesner
* @since 1.0
* @version $Id:$
*/
public class GlobalSunJaasKerberosConfig implements BeanPostProcessor, InitializingBean {
private boolean debug = false;
private String krbConfLocation;
public void afterPropertiesSet() throws Exception {
@@ -38,32 +40,27 @@ public class GlobalSunJaasKerberosConfig implements BeanPostProcessor, Initializ
}
}
/**
/**
* Enable debug logs from the Sun Kerberos Implementation. Default is false.
*/
public void setDebug(boolean debug) {
this.debug = debug;
}
/**
/**
* Kerberos config file location can be specified here.
*
*
* @param krbConfLocation
*/
public void setKrbConfLocation(String krbConfLocation) {
this.krbConfLocation = krbConfLocation;
}
/*
* The following methods are not used here. This Bean implements only BeanPostProcessor to ensure that it
* is created before any other bean is created, because the system properties needed to be set very early
* in the startup-phase, but after the BeanFactoryPostProcessing.
*/
// The following methods are not used here. This Bean implements only BeanPostProcessor to ensure that it
// is created before any other bean is created, because the system properties needed to be set very early
// in the startup-phase, but after the BeanFactoryPostProcessing.
public Object postProcessAfterInitialization(Object bean, String beanName) throws BeansException {
return bean;
}

45
spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/KerberosAuthenticationProvider.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2009 the original author or authors.
* Copyright 2009-2015 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -13,11 +13,8 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.extensions.kerberos;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
@@ -26,38 +23,48 @@ import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
/**
* {@link AuthenticationProvider} for kerberos.
*
* @author Mike Wiesner
* @since 1.0
* @version $Id$
*/
public class KerberosAuthenticationProvider implements AuthenticationProvider {
private static final Log LOG = LogFactory.getLog(KerberosAuthenticationProvider.class);
private KerberosClient kerberosClient;
private UserDetailsService userDetailsService;
@Override
public Authentication authenticate(Authentication authentication) throws AuthenticationException {
UsernamePasswordAuthenticationToken auth = (UsernamePasswordAuthenticationToken) authentication;
String validatedUsername = kerberosClient.login(auth.getName(), auth.getCredentials().toString());
UserDetails userDetails = this.userDetailsService.loadUserByUsername(validatedUsername);
UsernamePasswordAuthenticationToken output = new UsernamePasswordAuthenticationToken(userDetails, auth.getCredentials(), userDetails.getAuthorities());
output.setDetails(authentication.getDetails());
UsernamePasswordAuthenticationToken auth = (UsernamePasswordAuthenticationToken) authentication;
String validatedUsername = kerberosClient.login(auth.getName(), auth.getCredentials().toString());
UserDetails userDetails = this.userDetailsService.loadUserByUsername(validatedUsername);
UsernamePasswordAuthenticationToken output = new UsernamePasswordAuthenticationToken(userDetails,
auth.getCredentials(), userDetails.getAuthorities());
output.setDetails(authentication.getDetails());
return output;
}
@Override
public boolean supports(Class<? extends Object> authentication) {
return (UsernamePasswordAuthenticationToken.class.isAssignableFrom(authentication));
}
/**
* Sets the kerberos client.
*
* @param kerberosClient the new kerberos client
*/
public void setKerberosClient(KerberosClient kerberosClient) {
this.kerberosClient = kerberosClient;
}
/**
* Sets the user details service.
*
* @param detailsService the new user details service
*/
public void setUserDetailsService(UserDetailsService detailsService) {
this.userDetailsService = detailsService;
}

36
spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/KerberosServiceAuthenticationProvider.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2009 the original author or authors.
* Copyright 2009-2015 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -13,7 +13,6 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.extensions.kerberos;
import org.apache.commons.logging.Log;
@@ -29,7 +28,6 @@ import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.extensions.kerberos.web.SpnegoAuthenticationProcessingFilter;
import org.springframework.util.Assert;
/**
* <p>Authentication Provider which validates Kerberos Service Tickets
* or SPNEGO Tokens (which includes Kerberos Service Tickets).</p>
@@ -45,7 +43,6 @@ import org.springframework.util.Assert;
*
* @author Mike Wiesner
* @since 1.0
* @version $Id$
* @see KerberosTicketValidator
* @see UserDetailsService
* @see SpnegoAuthenticationProcessingFilter
@@ -74,9 +71,7 @@ public class KerberosServiceAuthenticationProvider implements
this.ticketValidator = ticketValidator;
}
/* (non-Javadoc)
* @see org.springframework.security.authentication.AuthenticationProvider#authenticate(org.springframework.security.core.Authentication)
*/
@Override
public Authentication authenticate(Authentication authentication)
throws AuthenticationException {
KerberosServiceRequestToken auth = (KerberosServiceRequestToken) authentication;
@@ -90,9 +85,19 @@ public class KerberosServiceAuthenticationProvider implements
KerberosServiceRequestToken responseAuth = new KerberosServiceRequestToken(userDetails, userDetails.getAuthorities(), token);
responseAuth.setDetails(authentication.getDetails());
return responseAuth;
}
@Override
public boolean supports(Class<? extends Object> auth) {
return KerberosServiceRequestToken.class.isAssignableFrom(auth);
}
@Override
public void afterPropertiesSet() throws Exception {
Assert.notNull(this.ticketValidator, "ticketValidator must be specified");
Assert.notNull(this.userDetailsService, "userDetailsService must be specified");
}
/**
* Allows subclasses to perform any additional checks of a returned <code>UserDetails</code>
@@ -108,19 +113,4 @@ public class KerberosServiceAuthenticationProvider implements
}
/* (non-Javadoc)
* @see org.springframework.security.authentication.AuthenticationProvider#supports(java.lang.Class)
*/
public boolean supports(Class<? extends Object> auth) {
return KerberosServiceRequestToken.class.isAssignableFrom(auth);
}
/* (non-Javadoc)
* @see org.springframework.beans.factory.InitializingBean#afterPropertiesSet()
*/
public void afterPropertiesSet() throws Exception {
Assert.notNull(this.ticketValidator, "ticketValidator must be specified");
Assert.notNull(this.userDetailsService, "userDetailsService must be specified");
}
}

15
spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/KerberosServiceRequestToken.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2009 the original author or authors.
* Copyright 2009-2015 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -13,7 +13,6 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.extensions.kerberos;
import java.util.Arrays;
@@ -34,7 +33,6 @@ import org.springframework.security.extensions.kerberos.web.SpnegoAuthentication
*
* @author Mike Wiesner
* @since 1.0
* @version $Id$
* @see KerberosServiceAuthenticationProvider
* @see SpnegoAuthenticationProcessingFilter
*/
@@ -99,21 +97,18 @@ public class KerberosServiceRequestToken extends AbstractAuthenticationToken {
return true;
}
/* (non-Javadoc)
* @see org.springframework.security.core.Authentication#getCredentials()
*/
@Override
public Object getCredentials() {
return null;
}
/* (non-Javadoc)
* @see org.springframework.security.core.Authentication#getPrincipal()
*/
@Override
public Object getPrincipal() {
return this.principal;
}
/** Returns the Kerberos token
/**
* Returns the Kerberos token
*/
public byte[] getToken() {
return this.token;

8
spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/SunJaasKerberosClient.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2009 the original author or authors.
* Copyright 2009-2015 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -13,7 +13,6 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.extensions.kerberos;
import java.io.IOException;
@@ -41,19 +40,18 @@ import org.springframework.security.authentication.BadCredentialsException;
*
* @author Mike Wiesner
* @since 1.0
* @version $Id$
*/
public class SunJaasKerberosClient implements KerberosClient {
private boolean debug = false;
private static final Log LOG = LogFactory.getLog(SunJaasKerberosClient.class);
@Override
public String login(String username, String password) {
LOG.debug("Trying to authenticate " + username + " with Kerberos");
String validatedUsername;
try {
LoginContext loginContext = new LoginContext("", null, new KerberosClientCallbackHandler(username, password),
new LoginConfig(this.debug));

67
spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/SunJaasKerberosTicketValidator.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2009 the original author or authors.
* Copyright 2009-2015 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -13,7 +13,6 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.extensions.kerberos;
import java.security.Principal;
@@ -48,7 +47,6 @@ import org.springframework.util.Assert;
*
* @author Mike Wiesner
* @since 1.0
* @version $Id$
*/
public class SunJaasKerberosTicketValidator implements KerberosTicketValidator, InitializingBean {
@@ -58,9 +56,7 @@ public class SunJaasKerberosTicketValidator implements KerberosTicketValidator,
private boolean debug = false;
private static final Log LOG = LogFactory.getLog(SunJaasKerberosTicketValidator.class);
/* (non-Javadoc)
* @see org.springframework.security.extensions.kerberos.KerberosTicketValidator#validateTicket(byte[])
*/
@Override
public String validateTicket(byte[] token) {
String username = null;
try {
@@ -71,7 +67,32 @@ public class SunJaasKerberosTicketValidator implements KerberosTicketValidator,
return username;
}
/** The service principal of the application.
@Override
public void afterPropertiesSet() throws Exception {
Assert.notNull(this.servicePrincipal, "servicePrincipal must be specified");
Assert.notNull(this.keyTabLocation, "keyTab must be specified");
if (keyTabLocation instanceof ClassPathResource) {
LOG.warn("Your keytab is in the classpath. This file needs special protection and shouldn't be in the classpath. JAAS may also not be able to load this file from classpath.");
}
String keyTabLocationAsString = this.keyTabLocation.getURL().toExternalForm();
// We need to remove the file prefix (if there is one), as it is not supported in Java 7 anymore.
// As Java 6 accepts it with and without the prefix, we don't need to check for Java 7
if (keyTabLocationAsString.startsWith("file:"))
{
keyTabLocationAsString = keyTabLocationAsString.substring(5);
}
LoginConfig loginConfig = new LoginConfig(keyTabLocationAsString, this.servicePrincipal,
this.debug);
Set<Principal> princ = new HashSet<Principal>(1);
princ.add(new KerberosPrincipal(this.servicePrincipal));
Subject sub = new Subject(false, princ, new HashSet<Object>(), new HashSet<Object>());
LoginContext lc = new LoginContext("", sub, null, loginConfig);
lc.login();
this.serviceSubject = lc.getSubject();
}
/**
* The service principal of the application.
* For web apps this is <code>HTTP/full-qualified-domain-name@DOMAIN</code>.
* The keytab must contain the key for this principal.
*
@@ -106,38 +127,9 @@ public class SunJaasKerberosTicketValidator implements KerberosTicketValidator,
this.debug = debug;
}
/* (non-Javadoc)
* @see org.springframework.beans.factory.InitializingBean#afterPropertiesSet()
*/
public void afterPropertiesSet() throws Exception {
Assert.notNull(this.servicePrincipal, "servicePrincipal must be specified");
Assert.notNull(this.keyTabLocation, "keyTab must be specified");
if (keyTabLocation instanceof ClassPathResource) {
LOG.warn("Your keytab is in the classpath. This file needs special protection and shouldn't be in the classpath. JAAS may also not be able to load this file from classpath.");
}
String keyTabLocationAsString = this.keyTabLocation.getURL().toExternalForm();
// We need to remove the file prefix (if there is one), as it is not supported in Java 7 anymore.
// As Java 6 accepts it with and without the prefix, we don't need to check for Java 7
if (keyTabLocationAsString.startsWith("file:"))
{
keyTabLocationAsString = keyTabLocationAsString.substring(5);
}
LoginConfig loginConfig = new LoginConfig(keyTabLocationAsString, this.servicePrincipal,
this.debug);
Set<Principal> princ = new HashSet<Principal>(1);
princ.add(new KerberosPrincipal(this.servicePrincipal));
Subject sub = new Subject(false, princ, new HashSet<Object>(), new HashSet<Object>());
LoginContext lc = new LoginContext("", sub, null, loginConfig);
lc.login();
this.serviceSubject = lc.getSubject();
}
/**
* This class is needed, because the validation must run with previously generated JAAS subject
* which belongs to the service principal and was loaded out of the keytab during startup.
*
* @author Mike Wiesner
* @since 1.0
*/
private static class KerberosValidateAction implements PrivilegedExceptionAction<String> {
byte[] kerberosTicket;
@@ -159,9 +151,6 @@ public class SunJaasKerberosTicketValidator implements KerberosTicketValidator,
/**
* Normally you need a JAAS config file in order to use the JAAS Kerberos Login Module,
* with this class it is not needed and you can have different configurations in one JVM.
*
* @author Mike Wiesner
* @since 1.0
*/
private static class LoginConfig extends Configuration {
private String keyTabLocation;

102
spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoAuthenticationProcessingFilter.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2008 the original author or authors.
* Copyright 2002-2015 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -13,7 +13,6 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.extensions.kerberos.web;
import java.io.IOException;
@@ -36,7 +35,6 @@ import org.springframework.security.extensions.kerberos.KerberosServiceAuthentic
import org.springframework.security.extensions.kerberos.KerberosServiceRequestToken;
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler;
import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
import org.springframework.security.web.authentication.session.NullAuthenticatedSessionStrategy;
import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy;
@@ -47,33 +45,33 @@ import org.springframework.web.filter.GenericFilterBean;
* Parses the SPNEGO authentication Header, which was generated by the browser
* and creates a {@link KerberosServiceRequestToken} out if it. It will then
* call the {@link AuthenticationManager}.
*
*
* <p>
* A typical Spring Security configuration might look like this:
* </p>
*
*
* <pre>
* &lt;beans xmlns=&quot;http://www.springframework.org/schema/beans&quot;
* xmlns:xsi=&quot;http://www.w3.org/2001/XMLSchema-instance&quot; xmlns:sec=&quot;http://www.springframework.org/schema/security&quot;
* xsi:schemaLocation=&quot;http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
* http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd&quot;&gt;
*
*
* &lt;sec:http entry-point-ref=&quot;spnegoEntryPoint&quot;&gt;
* &lt;sec:intercept-url pattern=&quot;/secure/**&quot; access=&quot;IS_AUTHENTICATED_FULLY&quot; /&gt;
* &lt;sec:custom-filter ref=&quot;spnegoAuthenticationProcessingFilter&quot; position=&quot;BASIC_AUTH_FILTER&quot; /&gt;
* &lt;/sec:http&gt;
*
*
* &lt;bean id=&quot;spnegoEntryPoint&quot; class=&quot;org.springframework.security.extensions.kerberos.web.SpnegoEntryPoint&quot; /&gt;
*
*
* &lt;bean id=&quot;spnegoAuthenticationProcessingFilter&quot;
* class=&quot;org.springframework.security.extensions.kerberos.web.SpnegoAuthenticationProcessingFilter&quot;&gt;
* &lt;property name=&quot;authenticationManager&quot; ref=&quot;authenticationManager&quot; /&gt;
* &lt;/bean&gt;
*
*
* &lt;sec:authentication-manager alias=&quot;authenticationManager&quot;&gt;
* &lt;sec:authentication-provider ref=&quot;kerberosServiceAuthenticationProvider&quot; /&gt;
* &lt;/sec:authentication-manager&gt;
*
*
* &lt;bean id=&quot;kerberosServiceAuthenticationProvider&quot;
* class=&quot;org.springframework.security.extensions.kerberos.KerberosServiceAuthenticationProvider&quot;&gt;
* &lt;property name=&quot;ticketValidator&quot;&gt;
@@ -84,7 +82,7 @@ import org.springframework.web.filter.GenericFilterBean;
* &lt;/property&gt;
* &lt;property name=&quot;userDetailsService&quot; ref=&quot;inMemoryUserDetailsService&quot; /&gt;
* &lt;/bean&gt;
*
*
* &lt;bean id=&quot;inMemoryUserDetailsService&quot;
* class=&quot;org.springframework.security.core.userdetails.memory.InMemoryDaoImpl&quot;&gt;
* &lt;property name=&quot;userProperties&quot;&gt;
@@ -95,23 +93,22 @@ import org.springframework.web.filter.GenericFilterBean;
* &lt;/bean&gt;
* &lt;/beans&gt;
* </pre>
*
*
* If you get a "GSSException: Channel binding mismatch (Mechanism
* level:ChannelBinding not provided!) have a look at this <a
* href="http://bugs.sun.com/view_bug.do?bug_id=6851973">bug</a>.<br />
* A workaround unti this is fixed in the JVM is to change
* HKEY_LOCAL_MACHINE\System
* \CurrentControlSet\Control\LSA\SuppressExtendedProtection to 0x02
*
*
*
*
* @author Mike Wiesner
* @since 1.0
* @version $Id$
* @see KerberosServiceAuthenticationProvider
* @see SpnegoEntryPoint
*/
public class SpnegoAuthenticationProcessingFilter extends GenericFilterBean {
private AuthenticationDetailsSource<HttpServletRequest,?> authenticationDetailsSource = new WebAuthenticationDetailsSource();
private AuthenticationManager authenticationManager;
private AuthenticationSuccessHandler successHandler;
@@ -119,13 +116,7 @@ public class SpnegoAuthenticationProcessingFilter extends GenericFilterBean {
private SessionAuthenticationStrategy sessionStrategy = new NullAuthenticatedSessionStrategy();
private boolean skipIfAlreadyAuthenticated = true;
/*
* (non-Javadoc)
*
* @see javax.servlet.Filter#doFilter(javax.servlet.ServletRequest,
* javax.servlet.ServletResponse, javax.servlet.FilterChain)
*/
@Override
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
HttpServletRequest request = (HttpServletRequest) req;
HttpServletResponse response = (HttpServletResponse) res;
@@ -171,17 +162,23 @@ public class SpnegoAuthenticationProcessingFilter extends GenericFilterBean {
if (successHandler != null) {
successHandler.onAuthenticationSuccess(request, response, authentication);
}
}
chain.doFilter(request, response);
}
@Override
public void afterPropertiesSet() throws ServletException {
super.afterPropertiesSet();
Assert.notNull(this.authenticationManager, "authenticationManager must be specified");
}
/**
* The authentication manager for validating the ticket.
*
* @param authenticationManager
*
* @param authenticationManager the authentication manager
*/
public void setAuthenticationManager(AuthenticationManager authenticationManager) {
this.authenticationManager = authenticationManager;
@@ -191,8 +188,8 @@ public class SpnegoAuthenticationProcessingFilter extends GenericFilterBean {
* This handler is called after a successful authentication. One can add
* additional authentication behavior by setting this.<br />
* Default is null, which means nothing additional happens
*
* @param successHandler
*
* @param successHandler the authentication success handler
*/
public void setSuccessHandler(AuthenticationSuccessHandler successHandler) {
this.successHandler = successHandler;
@@ -205,52 +202,47 @@ public class SpnegoAuthenticationProcessingFilter extends GenericFilterBean {
* he will just stop the communication with server and therefore this
* handler will not be called in this case.<br />
* Default is null, which means that the Filter returns the HTTP 500 code
*
* @param failureHandler
*
* @param failureHandler the authentication failure handler
*/
public void setFailureHandler(AuthenticationFailureHandler failureHandler) {
this.failureHandler = failureHandler;
}
/**
* Should Kerberos authentication be skipped if a user is already authenticated
* for this request (e.g. in the HTTP session).
*
*
* @param skipIfAlreadyAuthenticated default is true
*/
public void setSkipIfAlreadyAuthenticated(boolean skipIfAlreadyAuthenticated) {
this.skipIfAlreadyAuthenticated = skipIfAlreadyAuthenticated;
}
/**
* The session handling strategy which will be invoked immediately after an authentication request is
* successfully processed by the <tt>AuthenticationManager</tt>. Used, for example, to handle changing of the
* session identifier to prevent session fixation attacks.
*
* @param sessionStrategy the implementation to use. If not set a null implementation is
* used.
*/
* The session handling strategy which will be invoked immediately after an
* authentication request is successfully processed by the
* <tt>AuthenticationManager</tt>. Used, for example, to handle changing of
* the session identifier to prevent session fixation attacks.
*
* @param sessionStrategy the implementation to use. If not set a null
* implementation is used.
*/
public void setSessionAuthenticationStrategy(SessionAuthenticationStrategy sessionStrategy) {
this.sessionStrategy = sessionStrategy;
}
public void setAuthenticationDetailsSource(AuthenticationDetailsSource<HttpServletRequest,?> authenticationDetailsSource) {
/**
* Sets the authentication details source.
*
* @param authenticationDetailsSource the authentication details source
*/
public void setAuthenticationDetailsSource(
AuthenticationDetailsSource<HttpServletRequest, ?> authenticationDetailsSource) {
Assert.notNull(authenticationDetailsSource, "AuthenticationDetailsSource required");
this.authenticationDetailsSource = authenticationDetailsSource;
}
/*
* (non-Javadoc)
*
* @see
* org.springframework.web.filter.GenericFilterBean#afterPropertiesSet()
*/
@Override
public void afterPropertiesSet() throws ServletException {
super.afterPropertiesSet();
Assert.notNull(this.authenticationManager, "authenticationManager must be specified");
}
}

9
spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoEntryPoint.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2009 the original author or authors.
* Copyright 2009-2015 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -13,7 +13,6 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.extensions.kerberos.web;
import java.io.IOException;
@@ -32,16 +31,13 @@ import org.springframework.security.web.AuthenticationEntryPoint;
*
* @author Mike Wiesner
* @since 1.0
* @version $Id$
* @see SpnegoAuthenticationProcessingFilter
*/
public class SpnegoEntryPoint implements AuthenticationEntryPoint {
private static final Log LOG = LogFactory.getLog(SpnegoEntryPoint.class);
/* (non-Javadoc)
* @see org.springframework.security.web.AuthenticationEntryPoint#commence(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, org.springframework.security.core.AuthenticationException)
*/
@Override
public void commence(HttpServletRequest request, HttpServletResponse response,
AuthenticationException ex) throws IOException, ServletException {
if (LOG.isDebugEnabled()) {
@@ -50,7 +46,6 @@ public class SpnegoEntryPoint implements AuthenticationEntryPoint {
response.addHeader("WWW-Authenticate", "Negotiate");
response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
response.flushBuffer();
}
}

16
spring-security-kerberos-core/src/test/java/org/springframework/security/extensions/kerberos/KerberosAuthenticationProviderTest.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2009 the original author or authors.
* Copyright 2009-2015 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -13,7 +13,6 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.extensions.kerberos;
import static org.junit.Assert.*;
@@ -36,20 +35,19 @@ import org.springframework.security.core.userdetails.UserDetailsService;
*
* @author Mike Wiesner
* @since 1.0
* @version $Id$
*/
public class KerberosAuthenticationProviderTest {
private KerberosAuthenticationProvider provider;
private KerberosClient kerberosClient;
private UserDetailsService userDetailsService;
private static final String TEST_USER = "Testuser@SPRINGSOURCE.ORG";
private static final String TEST_PASSWORD = "password";
private static final UsernamePasswordAuthenticationToken INPUT_TOKEN = new UsernamePasswordAuthenticationToken(TEST_USER, TEST_PASSWORD);
private static final List<GrantedAuthority> AUTHORITY_LIST = AuthorityUtils.createAuthorityList("ROLE_ADMIN");
private static final UserDetails USER_DETAILS = new User(TEST_USER, "empty", true, true, true,true, AUTHORITY_LIST);
@Before
public void before() {
// mocking
@@ -59,16 +57,16 @@ public class KerberosAuthenticationProviderTest {
this.provider.setKerberosClient(kerberosClient);
this.provider.setUserDetailsService(userDetailsService);
}
@Test
public void testLoginOk() throws Exception {
when(userDetailsService.loadUserByUsername(TEST_USER)).thenReturn(USER_DETAILS);
when(kerberosClient.login(TEST_USER, TEST_PASSWORD)).thenReturn(TEST_USER);
Authentication authenticate = provider.authenticate(INPUT_TOKEN);
verify(kerberosClient).login(TEST_USER, TEST_PASSWORD);
assertNotNull(authenticate);
assertEquals(TEST_USER, authenticate.getName());
assertEquals(USER_DETAILS, authenticate.getPrincipal());

6
spring-security-kerberos-core/src/test/java/org/springframework/security/extensions/kerberos/KerberosServiceAuthenticationProviderTest.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2009 the original author or authors.
* Copyright 2009-2015 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -13,7 +13,6 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.extensions.kerberos;
import static org.junit.Assert.*;
@@ -41,7 +40,6 @@ import org.springframework.security.core.userdetails.UsernameNotFoundException;
*
* @author Mike Wiesner
* @since 1.0
* @version $Id$
*/
public class KerberosServiceAuthenticationProviderTest {
@@ -74,7 +72,7 @@ public class KerberosServiceAuthenticationProviderTest {
assertEquals(AUTHORITY_LIST, output.getAuthorities());
assertEquals(USER_DETAILS, output.getPrincipal());
}
@Test
public void testAuthenticationDetailsPropagation() throws Exception {
KerberosServiceRequestToken requestToken = new KerberosServiceRequestToken(TEST_TOKEN);

7
spring-security-kerberos-core/src/test/java/org/springframework/security/extensions/kerberos/web/SpnegoAuthenticationProcessingFilterTest.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2009 the original author or authors.
* Copyright 2009-2015 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -45,10 +45,9 @@ import org.springframework.security.web.authentication.WebAuthenticationDetailsS
/**
* Test class for {@link SpnegoAuthenticationProcessingFilter}
*
*
* @author Mike Wiesner
* @since 1.0
* @version $Id$
*/
public class SpnegoAuthenticationProcessingFilterTest {
@@ -174,7 +173,7 @@ public class SpnegoAuthenticationProcessingFilterTest {
SecurityContextHolder.clearContext();
}
}
@Test
public void testAlreadyAuthenticatedNotActive() throws Exception {
try {

8
spring-security-kerberos-core/src/test/java/org/springframework/security/extensions/kerberos/web/SpnegoEntryPointTest.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2009 the original author or authors.
* Copyright 2009-2015 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -17,6 +17,7 @@ package org.springframework.security.extensions.kerberos.web;
import static org.mockito.Mockito.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.junit.Test;
@@ -25,8 +26,8 @@ import org.junit.Test;
* Test class for {@link SpnegoEntryPoint}
*
* @author Mike Wiesner
* @author Janne Valkealahti
* @since 1.0
* @version $Id$
*/
public class SpnegoEntryPointTest {
@@ -34,9 +35,10 @@ public class SpnegoEntryPointTest {
@Test
public void testEntryPointOk() throws Exception {
HttpServletRequest request = mock(HttpServletRequest.class);
HttpServletResponse response = mock(HttpServletResponse.class);
entryPoint.commence(null, response, null);
entryPoint.commence(request, response, null);
verify(response).addHeader("WWW-Authenticate", "Negotiate");
verify(response).setStatus(HttpServletResponse.SC_UNAUTHORIZED);