Activate the Host authentication under the JBOSS_HOME/server/default/conf/login-config.xml file by adding the following host login module:

<!-- SPNEGO domain -->
<application-policy name="host">
  <authentication>
    <login-module code="com.sun.security.auth.module.Krb5LoginModule" flag="required">
      <module-option name="storeKey">true</module-option>
      <module-option name="useKeyTab">true</module-option>
      <module-option name="principal">HTTP/server.local.network@LOCAL.NETWORK</module-option>
      <module-option name="keyTab">/etc/krb5.keytab</module-option>
      <module-option name="doNotPrompt">true</module-option>
      <module-option name="debug">true</module-option>
    </login-module>
  </authentication>
 </application-policy>

The 'keyTab' value should point to the keytab file that was generated by the kadmin kerberos tool. When using Kerberos on Linux, it should be value of parameter admin_keytab from kdc.conf file. See the Section 5.7.6.1, “SPNEGO Server Configuration” section for more details.

Extend the core authentication mechanisms to support SPNEGO under JBOSS_HOME/server/default/deployers/jbossweb.deployer/META-INF/war-deployers-jboss-beans.xml by adding the 'SPNEGO' authenticators property.

<deployment xmlns="urn:jboss:bean-deployer:2.0">

<property name="authenticators">

  <map class="java.util.Properties" keyClass="java.lang.String" valueClass="java.lang.String">

    <entry>

      <key>BASIC</key>

      <value>org.apache.catalina.authenticator.BasicAuthenticator</value>

    </entry>

    <entry>

      <key>CLIENT-CERT</key>

      <value>org.apache.catalina.authenticator.SSLAuthenticator</value>

    </entry>

    <entry>

      <key>DIGEST</key>

      <value>org.apache.catalina.authenticator.DigestAuthenticator</value>

    </entry>

    <entry>

      <key>FORM</key>

      <value>org.apache.catalina.authenticator.FormAuthenticator</value>

    </entry>

    <entry>

      <key>NONE</key>

      <value>org.apache.catalina.authenticator.NonLoginAuthenticator</value>

    </entry>

    

    <!-- Add this entry -->

    <entry>

      <key>SPNEGO</key>

        <value>org.gatein.sso.spnego.GateInNegotiationAuthenticator</value>

    </entry>

  </map>

</property>

Add the GateIn SSO module binaries by copying GATEIN_SSO_HOME/spnego/gatein.ear/lib/sso-agent-VERSION.jar to the JBOSS_HOME/server/default/deploy/gatein.ear/lib directory. File GATEIN_SSO_HOME/spnego/gatein.ear/lib/spnego-VERSION.jar needs to be copied to the JBOSS_HOME/server/default/lib directory.

Download library jboss-negotiation-2.0.4.GA from location https://repository.jboss.org/nexus/content/groups/public/org/jboss/security/jboss-negotiation/2.0.4.GA/jboss-negotiation-2.0.4.GA.jar and copy this file to JBOSS_HOME/server/default/lib directory as well.

Modify the JBOSS_HOME/server/defaut/deploy/gatein.ear/META-INF/gatein-jboss-beans.xml file as below:

<deployment xmlns="urn:jboss:bean-deployer:2.0">



  <application-policy xmlns="urn:jboss:security-beans:1.0" name="gatein-form-auth-domain">

    <authentication>

      <login-module code="org.gatein.wci.security.WCILoginModule" flag="optional">

        <module-option name="portalContainerName">portal</module-option>

        <module-option name="realmName">gatein-domain</module-option>

      </login-module>

      <login-module code="org.exoplatform.services.security.jaas.SharedStateLoginModule" flag="required">

        <module-option name="portalContainerName">portal</module-option>

        <module-option name="realmName">gatein-domain</module-option>

      </login-module>



      <!-- Uncomment this part to check on each login if user is member of "/platform/users" group and if not

           create such membership -->

      <!--

      <login-module code="org.exoplatform.services.organization.idm.CustomMembershipLoginModule" flag="required">

        <module-option name="portalContainerName">portal</module-option>

        <module-option name="realmName">gatein-domain</module-option>

        <module-option name="membershipType">member</module-option>

        <module-option name="groupId">/platform/users</module-option>

      </login-module>

      -->



      <login-module code="org.exoplatform.services.security.j2ee.JbossLoginModule" flag="required">

        <module-option name="portalContainerName">portal</module-option>

<!-- logout needs to be performed from 'gatein-domain' as it is used for JaasSecurityManager. -->

        <module-option name="realmName">gatein-domain</module-option>

      </login-module>

    </authentication>

  </application-policy>





  <application-policy xmlns="urn:jboss:security-beans:1.0" name="gatein-domain">

    <authentication>

     <login-module

         code="org.gatein.sso.spnego.SPNEGOLoginModule"

         flag="requisite">

         <module-option name="password-stacking">useFirstPass</module-option>

         <module-option name="serverSecurityDomain">host</module-option>

     <module-option name="removeRealmFromPrincipal">true</module-option>

     <module-option name="usernamePasswordDomain">gatein-form-auth-domain</module-option>

      </login-module>

      <login-module

         code="org.gatein.sso.agent.login.SPNEGORolesModule"

         flag="required">

      <module-option name="password-stacking">useFirstPass</module-option>

      <module-option name="portalContainerName">portal</module-option>

      <module-option name="realmName">gatein-domain</module-option>

      </login-module>

   </authentication>

  </application-policy>



</deployment>

This activates SPNEGO LoginModules with fallback to FORM authentication. When SPNEGO is not available and it needs to fallback to FORM, it will use gatein-form-auth-domain security domain. More details below.

Modify JBOSS_HOME/server/default/deploy/gatein.ear/02portal.war/WEB-INF/web.xml as below.

<!--    <login-config>

      <auth-method>FORM</auth-method>

      <realm-name>gatein-domain</realm-name>

        <form-login-config>

          <form-login-page>/initiatelogin</form-login-page>

            <form-error-page>/errorlogin</form-error-page>

      </form-login-config>

    </login-config>

-->

    <login-config>

      <auth-method>SPNEGO</auth-method>

      <realm-name>SPNEGO</realm-name>

      <form-login-config>

         <form-login-page>/initiatelogin</form-login-page>

         <form-error-page>/errorlogin</form-error-page>

     </form-login-config>

    </login-config>

This integrates SPNEGO support into the Portal web archive by switching the authentication mechanism from the default "FORM"-based to "SPNEGO"-based authentication. You can notice that SPNEGO part also contains element form-login-config, which is needed if you want to enable fallback to FORM based authentication. In this case, portal will try to authenticate user with his Kerberos ticket through SPNEGO. If user don't have Kerberos ticket, he will be redirected to FORM (GateIn 3.2 login screen). So first attempt is for login with SPNEGO and next attempt is for login with FORM, which is used only if login through SPNEGO is not successful (For example user don't have valid Kerberos ticket or his browser doesn't support SPNEGO with our Kerberos server).

If you don't want fallback to FORM, you can disable form-login-config part and have only:

    <login-config>

      <auth-method>SPNEGO</auth-method>

      <realm-name>SPNEGO</realm-name>

<!--      <form-login-config>

         <form-login-page>/initiatelogin</form-login-page>

         <form-error-page>/errorlogin</form-error-page>

     </form-login-config>

-->

    </login-config>

In this case user needs to authenticate through SPNEGO and if that fails, FORM is not shown but user has authentication error with HTTP code 401.

Integrate the request pre-processing needed for SPNEGO via filters by adding the following filters to the JBOSS_HOME/server/default/deploy/gatein.ear/02portal.war/WEB-INF/web.xml at the top of the Filter chain.

<filter>
  <filter-name>LoginRedirectFilter</filter-name>
  <filter-class>org.gatein.sso.agent.filter.LoginRedirectFilter</filter-class>
  <init-param>
  <!-- This should point to your SSO authentication server -->
    <param-name>LOGIN_URL</param-name>
    <param-value>/portal/private/classic</param-value>
  </init-param>
</filter>

<filter>
 <filter-name>SPNEGOFilter</filter-name>
 <filter-class>org.gatein.sso.agent.filter.SPNEGOFilter</filter-class>
</filter>

<filter-mapping>
  <filter-name>LoginRedirectFilter</filter-name>
  <url-pattern>/*</url-pattern>
</filter-mapping>

<filter-mapping>
  <filter-name>SPNEGOFilter</filter-name>
  <url-pattern>/login</url-pattern>
</filter-mapping>

In JBOSS_HOME/server/default/deploy/gatein.ear/web.war/groovy/groovy/webui/component/UIBannerPortlet.gtml file modify the 'Sign In' link as follows:

<!--
<a class="Login" onclick="$signInAction"><%=_ctx.appRes("UILoginForm.label.Signin")%></a>
-->
<a class="Login" href="/portal/sso"><%=_ctx.appRes("UILoginForm.label.Signin")%></a>

Start the GateIn 3.2 portal using the command below.

sudo ./run.sh -Djava.security.krb5.realm=LOCAL.NETWORK -Djava.security.krb5.kdc=server.local.network -c default -b server.local.network

Login to Kerberos with the command.

kinit -A demo

You should be able to click the 'Sign In' link on the GateIn 3.2 portal and the 'demo' user from the GateIn 3.2 portal should be automatically logged in.

Let's try to destroy kerberos ticket with command

kdestroy

Then try to login again. You will now be placed to login screen of GateIn 3.2 because you don't have active Kerberos ticket. You can login with predefined account and password "demo"/"gtn" .