diff --git a/build.gradle b/build.gradle index fe9f499..10121af 100644 --- a/build.gradle +++ b/build.gradle @@ -78,7 +78,7 @@ configure(subprojects) { subproject -> dependencies { testCompile "org.mockito:mockito-core:$mockitoVersion" testCompile "junit:junit:$junitVersion" -// testRuntime("log4j:log4j:$log4jVersion") + testRuntime("log4j:log4j:$log4jVersion") } } diff --git a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/GlobalSunJaasKerberosConfig.java b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/GlobalSunJaasKerberosConfig.java index 1612e2f..78ce52f 100644 --- a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/GlobalSunJaasKerberosConfig.java +++ b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/GlobalSunJaasKerberosConfig.java @@ -1,5 +1,5 @@ /* - * Copyright 2010 the original author or authors. + * Copyright 2010-2015 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -20,13 +20,15 @@ import org.springframework.beans.factory.InitializingBean; import org.springframework.beans.factory.config.BeanPostProcessor; /** + * Config for global jaas. + * * @author Mike Wiesner * @since 1.0 - * @version $Id:$ */ public class GlobalSunJaasKerberosConfig implements BeanPostProcessor, InitializingBean { private boolean debug = false; + private String krbConfLocation; public void afterPropertiesSet() throws Exception { @@ -38,32 +40,27 @@ public class GlobalSunJaasKerberosConfig implements BeanPostProcessor, Initializ } } - - - /** + + /** * Enable debug logs from the Sun Kerberos Implementation. Default is false. */ public void setDebug(boolean debug) { this.debug = debug; } - - /** + /** * Kerberos config file location can be specified here. - * + * * @param krbConfLocation */ public void setKrbConfLocation(String krbConfLocation) { this.krbConfLocation = krbConfLocation; } - - /* - * The following methods are not used here. This Bean implements only BeanPostProcessor to ensure that it - * is created before any other bean is created, because the system properties needed to be set very early - * in the startup-phase, but after the BeanFactoryPostProcessing. - */ - + // The following methods are not used here. This Bean implements only BeanPostProcessor to ensure that it + // is created before any other bean is created, because the system properties needed to be set very early + // in the startup-phase, but after the BeanFactoryPostProcessing. + public Object postProcessAfterInitialization(Object bean, String beanName) throws BeansException { return bean; } diff --git a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/KerberosAuthenticationProvider.java b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/KerberosAuthenticationProvider.java index 0b553f7..d395ecf 100644 --- a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/KerberosAuthenticationProvider.java +++ b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/KerberosAuthenticationProvider.java @@ -1,5 +1,5 @@ /* - * Copyright 2009 the original author or authors. + * Copyright 2009-2015 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -13,11 +13,8 @@ * See the License for the specific language governing permissions and * limitations under the License. */ - package org.springframework.security.extensions.kerberos; -import org.apache.commons.logging.Log; -import org.apache.commons.logging.LogFactory; import org.springframework.security.authentication.AuthenticationProvider; import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; import org.springframework.security.core.Authentication; @@ -26,38 +23,48 @@ import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.core.userdetails.UserDetailsService; /** + * {@link AuthenticationProvider} for kerberos. + * * @author Mike Wiesner * @since 1.0 - * @version $Id$ */ public class KerberosAuthenticationProvider implements AuthenticationProvider { - - private static final Log LOG = LogFactory.getLog(KerberosAuthenticationProvider.class); - + private KerberosClient kerberosClient; + private UserDetailsService userDetailsService; - - + @Override public Authentication authenticate(Authentication authentication) throws AuthenticationException { - UsernamePasswordAuthenticationToken auth = (UsernamePasswordAuthenticationToken) authentication; - String validatedUsername = kerberosClient.login(auth.getName(), auth.getCredentials().toString()); - UserDetails userDetails = this.userDetailsService.loadUserByUsername(validatedUsername); - UsernamePasswordAuthenticationToken output = new UsernamePasswordAuthenticationToken(userDetails, auth.getCredentials(), userDetails.getAuthorities()); - output.setDetails(authentication.getDetails()); + UsernamePasswordAuthenticationToken auth = (UsernamePasswordAuthenticationToken) authentication; + String validatedUsername = kerberosClient.login(auth.getName(), auth.getCredentials().toString()); + UserDetails userDetails = this.userDetailsService.loadUserByUsername(validatedUsername); + UsernamePasswordAuthenticationToken output = new UsernamePasswordAuthenticationToken(userDetails, + auth.getCredentials(), userDetails.getAuthorities()); + output.setDetails(authentication.getDetails()); return output; - + } + @Override public boolean supports(Class authentication) { return (UsernamePasswordAuthenticationToken.class.isAssignableFrom(authentication)); } - + + /** + * Sets the kerberos client. + * + * @param kerberosClient the new kerberos client + */ public void setKerberosClient(KerberosClient kerberosClient) { this.kerberosClient = kerberosClient; } - - + + /** + * Sets the user details service. + * + * @param detailsService the new user details service + */ public void setUserDetailsService(UserDetailsService detailsService) { this.userDetailsService = detailsService; } diff --git a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/KerberosServiceAuthenticationProvider.java b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/KerberosServiceAuthenticationProvider.java index 575919e..ada78e6 100644 --- a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/KerberosServiceAuthenticationProvider.java +++ b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/KerberosServiceAuthenticationProvider.java @@ -1,5 +1,5 @@ /* - * Copyright 2009 the original author or authors. + * Copyright 2009-2015 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -13,7 +13,6 @@ * See the License for the specific language governing permissions and * limitations under the License. */ - package org.springframework.security.extensions.kerberos; import org.apache.commons.logging.Log; @@ -29,7 +28,6 @@ import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.extensions.kerberos.web.SpnegoAuthenticationProcessingFilter; import org.springframework.util.Assert; - /** *

Authentication Provider which validates Kerberos Service Tickets * or SPNEGO Tokens (which includes Kerberos Service Tickets).

@@ -45,7 +43,6 @@ import org.springframework.util.Assert; * * @author Mike Wiesner * @since 1.0 - * @version $Id$ * @see KerberosTicketValidator * @see UserDetailsService * @see SpnegoAuthenticationProcessingFilter @@ -74,9 +71,7 @@ public class KerberosServiceAuthenticationProvider implements this.ticketValidator = ticketValidator; } - /* (non-Javadoc) - * @see org.springframework.security.authentication.AuthenticationProvider#authenticate(org.springframework.security.core.Authentication) - */ + @Override public Authentication authenticate(Authentication authentication) throws AuthenticationException { KerberosServiceRequestToken auth = (KerberosServiceRequestToken) authentication; @@ -90,9 +85,19 @@ public class KerberosServiceAuthenticationProvider implements KerberosServiceRequestToken responseAuth = new KerberosServiceRequestToken(userDetails, userDetails.getAuthorities(), token); responseAuth.setDetails(authentication.getDetails()); return responseAuth; - + } + @Override + public boolean supports(Class auth) { + return KerberosServiceRequestToken.class.isAssignableFrom(auth); + } + + @Override + public void afterPropertiesSet() throws Exception { + Assert.notNull(this.ticketValidator, "ticketValidator must be specified"); + Assert.notNull(this.userDetailsService, "userDetailsService must be specified"); + } /** * Allows subclasses to perform any additional checks of a returned UserDetails @@ -108,19 +113,4 @@ public class KerberosServiceAuthenticationProvider implements } - /* (non-Javadoc) - * @see org.springframework.security.authentication.AuthenticationProvider#supports(java.lang.Class) - */ - public boolean supports(Class auth) { - return KerberosServiceRequestToken.class.isAssignableFrom(auth); - } - - /* (non-Javadoc) - * @see org.springframework.beans.factory.InitializingBean#afterPropertiesSet() - */ - public void afterPropertiesSet() throws Exception { - Assert.notNull(this.ticketValidator, "ticketValidator must be specified"); - Assert.notNull(this.userDetailsService, "userDetailsService must be specified"); - } - } diff --git a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/KerberosServiceRequestToken.java b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/KerberosServiceRequestToken.java index 907ea0e..a5479d2 100644 --- a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/KerberosServiceRequestToken.java +++ b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/KerberosServiceRequestToken.java @@ -1,5 +1,5 @@ /* - * Copyright 2009 the original author or authors. + * Copyright 2009-2015 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -13,7 +13,6 @@ * See the License for the specific language governing permissions and * limitations under the License. */ - package org.springframework.security.extensions.kerberos; import java.util.Arrays; @@ -34,7 +33,6 @@ import org.springframework.security.extensions.kerberos.web.SpnegoAuthentication * * @author Mike Wiesner * @since 1.0 - * @version $Id$ * @see KerberosServiceAuthenticationProvider * @see SpnegoAuthenticationProcessingFilter */ @@ -99,21 +97,18 @@ public class KerberosServiceRequestToken extends AbstractAuthenticationToken { return true; } - /* (non-Javadoc) - * @see org.springframework.security.core.Authentication#getCredentials() - */ + @Override public Object getCredentials() { return null; } - /* (non-Javadoc) - * @see org.springframework.security.core.Authentication#getPrincipal() - */ + @Override public Object getPrincipal() { return this.principal; } - /** Returns the Kerberos token + /** + * Returns the Kerberos token */ public byte[] getToken() { return this.token; diff --git a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/SunJaasKerberosClient.java b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/SunJaasKerberosClient.java index af99648..667caba 100644 --- a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/SunJaasKerberosClient.java +++ b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/SunJaasKerberosClient.java @@ -1,5 +1,5 @@ /* - * Copyright 2009 the original author or authors. + * Copyright 2009-2015 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -13,7 +13,6 @@ * See the License for the specific language governing permissions and * limitations under the License. */ - package org.springframework.security.extensions.kerberos; import java.io.IOException; @@ -41,19 +40,18 @@ import org.springframework.security.authentication.BadCredentialsException; * * @author Mike Wiesner * @since 1.0 - * @version $Id$ */ public class SunJaasKerberosClient implements KerberosClient { private boolean debug = false; - private static final Log LOG = LogFactory.getLog(SunJaasKerberosClient.class); + @Override public String login(String username, String password) { LOG.debug("Trying to authenticate " + username + " with Kerberos"); String validatedUsername; - + try { LoginContext loginContext = new LoginContext("", null, new KerberosClientCallbackHandler(username, password), new LoginConfig(this.debug)); diff --git a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/SunJaasKerberosTicketValidator.java b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/SunJaasKerberosTicketValidator.java index a955a8d..a1d9e45 100644 --- a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/SunJaasKerberosTicketValidator.java +++ b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/SunJaasKerberosTicketValidator.java @@ -1,5 +1,5 @@ /* - * Copyright 2009 the original author or authors. + * Copyright 2009-2015 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -13,7 +13,6 @@ * See the License for the specific language governing permissions and * limitations under the License. */ - package org.springframework.security.extensions.kerberos; import java.security.Principal; @@ -48,7 +47,6 @@ import org.springframework.util.Assert; * * @author Mike Wiesner * @since 1.0 - * @version $Id$ */ public class SunJaasKerberosTicketValidator implements KerberosTicketValidator, InitializingBean { @@ -58,9 +56,7 @@ public class SunJaasKerberosTicketValidator implements KerberosTicketValidator, private boolean debug = false; private static final Log LOG = LogFactory.getLog(SunJaasKerberosTicketValidator.class); - /* (non-Javadoc) - * @see org.springframework.security.extensions.kerberos.KerberosTicketValidator#validateTicket(byte[]) - */ + @Override public String validateTicket(byte[] token) { String username = null; try { @@ -71,7 +67,32 @@ public class SunJaasKerberosTicketValidator implements KerberosTicketValidator, return username; } - /** The service principal of the application. + @Override + public void afterPropertiesSet() throws Exception { + Assert.notNull(this.servicePrincipal, "servicePrincipal must be specified"); + Assert.notNull(this.keyTabLocation, "keyTab must be specified"); + if (keyTabLocation instanceof ClassPathResource) { + LOG.warn("Your keytab is in the classpath. This file needs special protection and shouldn't be in the classpath. JAAS may also not be able to load this file from classpath."); + } + String keyTabLocationAsString = this.keyTabLocation.getURL().toExternalForm(); + // We need to remove the file prefix (if there is one), as it is not supported in Java 7 anymore. + // As Java 6 accepts it with and without the prefix, we don't need to check for Java 7 + if (keyTabLocationAsString.startsWith("file:")) + { + keyTabLocationAsString = keyTabLocationAsString.substring(5); + } + LoginConfig loginConfig = new LoginConfig(keyTabLocationAsString, this.servicePrincipal, + this.debug); + Set princ = new HashSet(1); + princ.add(new KerberosPrincipal(this.servicePrincipal)); + Subject sub = new Subject(false, princ, new HashSet(), new HashSet()); + LoginContext lc = new LoginContext("", sub, null, loginConfig); + lc.login(); + this.serviceSubject = lc.getSubject(); + } + + /** + * The service principal of the application. * For web apps this is HTTP/full-qualified-domain-name@DOMAIN. * The keytab must contain the key for this principal. * @@ -106,38 +127,9 @@ public class SunJaasKerberosTicketValidator implements KerberosTicketValidator, this.debug = debug; } - /* (non-Javadoc) - * @see org.springframework.beans.factory.InitializingBean#afterPropertiesSet() - */ - public void afterPropertiesSet() throws Exception { - Assert.notNull(this.servicePrincipal, "servicePrincipal must be specified"); - Assert.notNull(this.keyTabLocation, "keyTab must be specified"); - if (keyTabLocation instanceof ClassPathResource) { - LOG.warn("Your keytab is in the classpath. This file needs special protection and shouldn't be in the classpath. JAAS may also not be able to load this file from classpath."); - } - String keyTabLocationAsString = this.keyTabLocation.getURL().toExternalForm(); - // We need to remove the file prefix (if there is one), as it is not supported in Java 7 anymore. - // As Java 6 accepts it with and without the prefix, we don't need to check for Java 7 - if (keyTabLocationAsString.startsWith("file:")) - { - keyTabLocationAsString = keyTabLocationAsString.substring(5); - } - LoginConfig loginConfig = new LoginConfig(keyTabLocationAsString, this.servicePrincipal, - this.debug); - Set princ = new HashSet(1); - princ.add(new KerberosPrincipal(this.servicePrincipal)); - Subject sub = new Subject(false, princ, new HashSet(), new HashSet()); - LoginContext lc = new LoginContext("", sub, null, loginConfig); - lc.login(); - this.serviceSubject = lc.getSubject(); - } - /** * This class is needed, because the validation must run with previously generated JAAS subject * which belongs to the service principal and was loaded out of the keytab during startup. - * - * @author Mike Wiesner - * @since 1.0 */ private static class KerberosValidateAction implements PrivilegedExceptionAction { byte[] kerberosTicket; @@ -159,9 +151,6 @@ public class SunJaasKerberosTicketValidator implements KerberosTicketValidator, /** * Normally you need a JAAS config file in order to use the JAAS Kerberos Login Module, * with this class it is not needed and you can have different configurations in one JVM. - * - * @author Mike Wiesner - * @since 1.0 */ private static class LoginConfig extends Configuration { private String keyTabLocation; diff --git a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoAuthenticationProcessingFilter.java b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoAuthenticationProcessingFilter.java index 8a2fcff..2e9bc60 100644 --- a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoAuthenticationProcessingFilter.java +++ b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoAuthenticationProcessingFilter.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2008 the original author or authors. + * Copyright 2002-2015 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -13,7 +13,6 @@ * See the License for the specific language governing permissions and * limitations under the License. */ - package org.springframework.security.extensions.kerberos.web; import java.io.IOException; @@ -36,7 +35,6 @@ import org.springframework.security.extensions.kerberos.KerberosServiceAuthentic import org.springframework.security.extensions.kerberos.KerberosServiceRequestToken; import org.springframework.security.web.authentication.AuthenticationFailureHandler; import org.springframework.security.web.authentication.AuthenticationSuccessHandler; -import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler; import org.springframework.security.web.authentication.WebAuthenticationDetailsSource; import org.springframework.security.web.authentication.session.NullAuthenticatedSessionStrategy; import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy; @@ -47,33 +45,33 @@ import org.springframework.web.filter.GenericFilterBean; * Parses the SPNEGO authentication Header, which was generated by the browser * and creates a {@link KerberosServiceRequestToken} out if it. It will then * call the {@link AuthenticationManager}. - * + * *

* A typical Spring Security configuration might look like this: *

- * + * * 
  * <beans xmlns="http://www.springframework.org/schema/beans"
  * xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:sec="http://www.springframework.org/schema/security"
  * xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
  * 	http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd">
- * 
+ *
  * <sec:http entry-point-ref="spnegoEntryPoint">
  * 	<sec:intercept-url pattern="/secure/**" access="IS_AUTHENTICATED_FULLY" />
  * 	<sec:custom-filter ref="spnegoAuthenticationProcessingFilter" position="BASIC_AUTH_FILTER" />
  * </sec:http>
- * 
+ *
  * <bean id="spnegoEntryPoint" class="org.springframework.security.extensions.kerberos.web.SpnegoEntryPoint" />
- * 
+ *
  * <bean id="spnegoAuthenticationProcessingFilter"
  * 	class="org.springframework.security.extensions.kerberos.web.SpnegoAuthenticationProcessingFilter">
  * 	<property name="authenticationManager" ref="authenticationManager" />
  * </bean>
- * 
+ *
  * <sec:authentication-manager alias="authenticationManager">
  * 	<sec:authentication-provider ref="kerberosServiceAuthenticationProvider" />
  * </sec:authentication-manager>
- * 
+ *
  * <bean id="kerberosServiceAuthenticationProvider"
  * 	class="org.springframework.security.extensions.kerberos.KerberosServiceAuthenticationProvider">
  * 	<property name="ticketValidator">
@@ -84,7 +82,7 @@ import org.springframework.web.filter.GenericFilterBean;
  * 	</property>
  * 	<property name="userDetailsService" ref="inMemoryUserDetailsService" />
  * </bean>
- * 
+ *
  * <bean id="inMemoryUserDetailsService"
  * 	class="org.springframework.security.core.userdetails.memory.InMemoryDaoImpl">
  * 	<property name="userProperties">
@@ -95,23 +93,22 @@ import org.springframework.web.filter.GenericFilterBean;
  * </bean>
  * </beans>
  *
- * + * * If you get a "GSSException: Channel binding mismatch (Mechanism * level:ChannelBinding not provided!) have a look at this bug.
* A workaround unti this is fixed in the JVM is to change * HKEY_LOCAL_MACHINE\System * \CurrentControlSet\Control\LSA\SuppressExtendedProtection to 0x02 - * - * + * + * * @author Mike Wiesner * @since 1.0 - * @version $Id$ * @see KerberosServiceAuthenticationProvider * @see SpnegoEntryPoint */ public class SpnegoAuthenticationProcessingFilter extends GenericFilterBean { - + private AuthenticationDetailsSource authenticationDetailsSource = new WebAuthenticationDetailsSource(); private AuthenticationManager authenticationManager; private AuthenticationSuccessHandler successHandler; @@ -119,13 +116,7 @@ public class SpnegoAuthenticationProcessingFilter extends GenericFilterBean { private SessionAuthenticationStrategy sessionStrategy = new NullAuthenticatedSessionStrategy(); private boolean skipIfAlreadyAuthenticated = true; - - /* - * (non-Javadoc) - * - * @see javax.servlet.Filter#doFilter(javax.servlet.ServletRequest, - * javax.servlet.ServletResponse, javax.servlet.FilterChain) - */ + @Override public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException { HttpServletRequest request = (HttpServletRequest) req; HttpServletResponse response = (HttpServletResponse) res; @@ -171,17 +162,23 @@ public class SpnegoAuthenticationProcessingFilter extends GenericFilterBean { if (successHandler != null) { successHandler.onAuthenticationSuccess(request, response, authentication); } - + } chain.doFilter(request, response); } + @Override + public void afterPropertiesSet() throws ServletException { + super.afterPropertiesSet(); + Assert.notNull(this.authenticationManager, "authenticationManager must be specified"); + } + /** * The authentication manager for validating the ticket. - * - * @param authenticationManager + * + * @param authenticationManager the authentication manager */ public void setAuthenticationManager(AuthenticationManager authenticationManager) { this.authenticationManager = authenticationManager; @@ -191,8 +188,8 @@ public class SpnegoAuthenticationProcessingFilter extends GenericFilterBean { * This handler is called after a successful authentication. One can add * additional authentication behavior by setting this.
* Default is null, which means nothing additional happens - * - * @param successHandler + * + * @param successHandler the authentication success handler */ public void setSuccessHandler(AuthenticationSuccessHandler successHandler) { this.successHandler = successHandler; @@ -205,52 +202,47 @@ public class SpnegoAuthenticationProcessingFilter extends GenericFilterBean { * he will just stop the communication with server and therefore this * handler will not be called in this case.
* Default is null, which means that the Filter returns the HTTP 500 code - * - * @param failureHandler + * + * @param failureHandler the authentication failure handler */ public void setFailureHandler(AuthenticationFailureHandler failureHandler) { this.failureHandler = failureHandler; } - - + + /** * Should Kerberos authentication be skipped if a user is already authenticated * for this request (e.g. in the HTTP session). - * + * * @param skipIfAlreadyAuthenticated default is true */ public void setSkipIfAlreadyAuthenticated(boolean skipIfAlreadyAuthenticated) { this.skipIfAlreadyAuthenticated = skipIfAlreadyAuthenticated; } - + /** - * The session handling strategy which will be invoked immediately after an authentication request is - * successfully processed by the AuthenticationManager. Used, for example, to handle changing of the - * session identifier to prevent session fixation attacks. - * - * @param sessionStrategy the implementation to use. If not set a null implementation is - * used. - */ + * The session handling strategy which will be invoked immediately after an + * authentication request is successfully processed by the + * AuthenticationManager. Used, for example, to handle changing of + * the session identifier to prevent session fixation attacks. + * + * @param sessionStrategy the implementation to use. If not set a null + * implementation is used. + */ public void setSessionAuthenticationStrategy(SessionAuthenticationStrategy sessionStrategy) { this.sessionStrategy = sessionStrategy; } - - public void setAuthenticationDetailsSource(AuthenticationDetailsSource authenticationDetailsSource) { + + /** + * Sets the authentication details source. + * + * @param authenticationDetailsSource the authentication details source + */ + public void setAuthenticationDetailsSource( + AuthenticationDetailsSource authenticationDetailsSource) { Assert.notNull(authenticationDetailsSource, "AuthenticationDetailsSource required"); this.authenticationDetailsSource = authenticationDetailsSource; } - /* - * (non-Javadoc) - * - * @see - * org.springframework.web.filter.GenericFilterBean#afterPropertiesSet() - */ - @Override - public void afterPropertiesSet() throws ServletException { - super.afterPropertiesSet(); - Assert.notNull(this.authenticationManager, "authenticationManager must be specified"); - } - } diff --git a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoEntryPoint.java b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoEntryPoint.java index 2e3a2d5..c45c5c8 100644 --- a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoEntryPoint.java +++ b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/web/SpnegoEntryPoint.java @@ -1,5 +1,5 @@ /* - * Copyright 2009 the original author or authors. + * Copyright 2009-2015 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -13,7 +13,6 @@ * See the License for the specific language governing permissions and * limitations under the License. */ - package org.springframework.security.extensions.kerberos.web; import java.io.IOException; @@ -32,16 +31,13 @@ import org.springframework.security.web.AuthenticationEntryPoint; * * @author Mike Wiesner * @since 1.0 - * @version $Id$ * @see SpnegoAuthenticationProcessingFilter */ public class SpnegoEntryPoint implements AuthenticationEntryPoint { private static final Log LOG = LogFactory.getLog(SpnegoEntryPoint.class); - /* (non-Javadoc) - * @see org.springframework.security.web.AuthenticationEntryPoint#commence(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, org.springframework.security.core.AuthenticationException) - */ + @Override public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException ex) throws IOException, ServletException { if (LOG.isDebugEnabled()) { @@ -50,7 +46,6 @@ public class SpnegoEntryPoint implements AuthenticationEntryPoint { response.addHeader("WWW-Authenticate", "Negotiate"); response.setStatus(HttpServletResponse.SC_UNAUTHORIZED); response.flushBuffer(); - } } diff --git a/spring-security-kerberos-core/src/test/java/org/springframework/security/extensions/kerberos/KerberosAuthenticationProviderTest.java b/spring-security-kerberos-core/src/test/java/org/springframework/security/extensions/kerberos/KerberosAuthenticationProviderTest.java index 4ee6783..26bb677 100644 --- a/spring-security-kerberos-core/src/test/java/org/springframework/security/extensions/kerberos/KerberosAuthenticationProviderTest.java +++ b/spring-security-kerberos-core/src/test/java/org/springframework/security/extensions/kerberos/KerberosAuthenticationProviderTest.java @@ -1,5 +1,5 @@ /* - * Copyright 2009 the original author or authors. + * Copyright 2009-2015 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -13,7 +13,6 @@ * See the License for the specific language governing permissions and * limitations under the License. */ - package org.springframework.security.extensions.kerberos; import static org.junit.Assert.*; @@ -36,20 +35,19 @@ import org.springframework.security.core.userdetails.UserDetailsService; * * @author Mike Wiesner * @since 1.0 - * @version $Id$ */ public class KerberosAuthenticationProviderTest { private KerberosAuthenticationProvider provider; private KerberosClient kerberosClient; private UserDetailsService userDetailsService; - + private static final String TEST_USER = "Testuser@SPRINGSOURCE.ORG"; private static final String TEST_PASSWORD = "password"; private static final UsernamePasswordAuthenticationToken INPUT_TOKEN = new UsernamePasswordAuthenticationToken(TEST_USER, TEST_PASSWORD); private static final List AUTHORITY_LIST = AuthorityUtils.createAuthorityList("ROLE_ADMIN"); private static final UserDetails USER_DETAILS = new User(TEST_USER, "empty", true, true, true,true, AUTHORITY_LIST); - + @Before public void before() { // mocking @@ -59,16 +57,16 @@ public class KerberosAuthenticationProviderTest { this.provider.setKerberosClient(kerberosClient); this.provider.setUserDetailsService(userDetailsService); } - + @Test public void testLoginOk() throws Exception { when(userDetailsService.loadUserByUsername(TEST_USER)).thenReturn(USER_DETAILS); when(kerberosClient.login(TEST_USER, TEST_PASSWORD)).thenReturn(TEST_USER); - + Authentication authenticate = provider.authenticate(INPUT_TOKEN); - + verify(kerberosClient).login(TEST_USER, TEST_PASSWORD); - + assertNotNull(authenticate); assertEquals(TEST_USER, authenticate.getName()); assertEquals(USER_DETAILS, authenticate.getPrincipal()); diff --git a/spring-security-kerberos-core/src/test/java/org/springframework/security/extensions/kerberos/KerberosServiceAuthenticationProviderTest.java b/spring-security-kerberos-core/src/test/java/org/springframework/security/extensions/kerberos/KerberosServiceAuthenticationProviderTest.java index 978ca29..668a41c 100644 --- a/spring-security-kerberos-core/src/test/java/org/springframework/security/extensions/kerberos/KerberosServiceAuthenticationProviderTest.java +++ b/spring-security-kerberos-core/src/test/java/org/springframework/security/extensions/kerberos/KerberosServiceAuthenticationProviderTest.java @@ -1,5 +1,5 @@ /* - * Copyright 2009 the original author or authors. + * Copyright 2009-2015 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -13,7 +13,6 @@ * See the License for the specific language governing permissions and * limitations under the License. */ - package org.springframework.security.extensions.kerberos; import static org.junit.Assert.*; @@ -41,7 +40,6 @@ import org.springframework.security.core.userdetails.UsernameNotFoundException; * * @author Mike Wiesner * @since 1.0 - * @version $Id$ */ public class KerberosServiceAuthenticationProviderTest { @@ -74,7 +72,7 @@ public class KerberosServiceAuthenticationProviderTest { assertEquals(AUTHORITY_LIST, output.getAuthorities()); assertEquals(USER_DETAILS, output.getPrincipal()); } - + @Test public void testAuthenticationDetailsPropagation() throws Exception { KerberosServiceRequestToken requestToken = new KerberosServiceRequestToken(TEST_TOKEN); diff --git a/spring-security-kerberos-core/src/test/java/org/springframework/security/extensions/kerberos/web/SpnegoAuthenticationProcessingFilterTest.java b/spring-security-kerberos-core/src/test/java/org/springframework/security/extensions/kerberos/web/SpnegoAuthenticationProcessingFilterTest.java index 5c0dfc2..626c859 100644 --- a/spring-security-kerberos-core/src/test/java/org/springframework/security/extensions/kerberos/web/SpnegoAuthenticationProcessingFilterTest.java +++ b/spring-security-kerberos-core/src/test/java/org/springframework/security/extensions/kerberos/web/SpnegoAuthenticationProcessingFilterTest.java @@ -1,5 +1,5 @@ /* - * Copyright 2009 the original author or authors. + * Copyright 2009-2015 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -45,10 +45,9 @@ import org.springframework.security.web.authentication.WebAuthenticationDetailsS /** * Test class for {@link SpnegoAuthenticationProcessingFilter} - * + * * @author Mike Wiesner * @since 1.0 - * @version $Id$ */ public class SpnegoAuthenticationProcessingFilterTest { @@ -174,7 +173,7 @@ public class SpnegoAuthenticationProcessingFilterTest { SecurityContextHolder.clearContext(); } } - + @Test public void testAlreadyAuthenticatedNotActive() throws Exception { try { diff --git a/spring-security-kerberos-core/src/test/java/org/springframework/security/extensions/kerberos/web/SpnegoEntryPointTest.java b/spring-security-kerberos-core/src/test/java/org/springframework/security/extensions/kerberos/web/SpnegoEntryPointTest.java index 14fe9cb..20c4981 100644 --- a/spring-security-kerberos-core/src/test/java/org/springframework/security/extensions/kerberos/web/SpnegoEntryPointTest.java +++ b/spring-security-kerberos-core/src/test/java/org/springframework/security/extensions/kerberos/web/SpnegoEntryPointTest.java @@ -1,5 +1,5 @@ /* - * Copyright 2009 the original author or authors. + * Copyright 2009-2015 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -17,6 +17,7 @@ package org.springframework.security.extensions.kerberos.web; import static org.mockito.Mockito.*; +import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import org.junit.Test; @@ -25,8 +26,8 @@ import org.junit.Test; * Test class for {@link SpnegoEntryPoint} * * @author Mike Wiesner + * @author Janne Valkealahti * @since 1.0 - * @version $Id$ */ public class SpnegoEntryPointTest { @@ -34,9 +35,10 @@ public class SpnegoEntryPointTest { @Test public void testEntryPointOk() throws Exception { + HttpServletRequest request = mock(HttpServletRequest.class); HttpServletResponse response = mock(HttpServletResponse.class); - entryPoint.commence(null, response, null); + entryPoint.commence(request, response, null); verify(response).addHeader("WWW-Authenticate", "Negotiate"); verify(response).setStatus(HttpServletResponse.SC_UNAUTHORIZED);