org.exoplatform.services.security.sso.spnego
Class SpnegoHandler

java.lang.Object
  org.exoplatform.services.security.sso.spnego.SpnegoHandler

Direct Known Subclasses:

ServletSpnegoHandler

public class SpnegoHandler
extends Object

Thin Spnego wrapping mechanism for org.ietf.jgss GSS-API.

Spnego is not supported by Java 5, but is in Java 6, however Spnego in itself is very simple and is just a thin wrapper over GSS-API, and this class provides support for Spnego in Java 5.

The implementation is a generic implementation, which means that it works with more than Kerberos as the underlying GSS-API mechanism (however Kerberos is the only one that Java 5 JAAS supports anyway).

This class needs two things to work:

1. System property javax.security.auth.useSubjectCredsOnly set to false.
2. System property java.security.auth.login.config to point to a file with JAAS login configuration. The login configuration needs to contain this:

   
      com.sun.security.jgss.accept {
        com.sun.security.auth.module.Krb5LoginModule 
        required 
        storeKey=true 
        keyTab="/etc/krb5.keytab"
        doNotPrompt=true 
        useKeyTab=true 
        realm="SALAD.TAGLAB.COM" 
        principal="HTTP/banana.salad.taglab.com@SALAD.TAGLAB.COM" 
        debug=true;
      };
    

   Where you would need to adjust /etc/krb5.keytab to point to a keytab containing the principal pointed out by principal=. Please note that the service principal must be named HTTP/servername@REALM. Where servername MUST be the name you are typing into the URL-bar of the browser AND is the reverse lookup name for the IP that corresponds to what was typed in.

XXX The class should be updated to use Java 6 Spnego once generally in use.

This implementation was made following: http://msdn2.microsoft.com/en-us/library/ms995330.aspx

Author:

Martin Algesten

Nested Class Summary

static class

SpnegoHandler.State State of the SpnegoHandler.

Constructor Summary

SpnegoHandler()
Creates a new SpnegoHandler .

Method Summary

byte[]	authenticate(byte[] token) Performs the actual authentication against the GSS-API.
protected byte[]	constructResponse(boolean isKerberosMicrosoft, byte[] gssApiToken) Constructs the response byte array from the give input.
GSSContext	getGSSContext()
SpnegoHandler.State	getState()
boolean	isComplete() Tells if negotiation is complete or if more roundtrips to authenticate() is expected.
boolean	isEstablished()
boolean	isFailed()
void	setUnauthorized() Sets the state to UNAUTHORIZED.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

SpnegoHandler

public SpnegoHandler()
              throws GSSSpnegoException

Creates a new SpnegoHandler .

Throws:

GSSSpnegoException - If we failed to establish the GSS-API context.

Method Detail

authenticate

public byte[] authenticate(byte[] token)
                    throws SpnegoException

Performs the actual authentication against the GSS-API. The authentication might take several roundtrips to the server (with Kerberos this doesn't happen) which means that depending on the result there might be more roundtrips.

The method unwraps the nested GSS-API token from the Spnego token and passes that into the GSSContext that was established in the constructor.

Parameters:

token - the spnego message.

Returns:

sendback tokens.

Throws:

SpnegoException - if an exception is encountered whilst doing the authentication.

constructResponse

protected byte[] constructResponse(boolean isKerberosMicrosoft,
                                   byte[] gssApiToken)

Constructs the response byte array from the give input.

Parameters:

isKerberosMicrosoft - is Kerberos Microsoft.

gssApiToken - input tokens.

Returns:

response byte array.

isComplete

public boolean isComplete()

Tells if negotiation is complete or if more roundtrips to authenticate() is expected.

Returns:

true if authentication is complete, false otherwise.

getState

public SpnegoHandler.State getState()

Returns:

the current state.

setUnauthorized

public void setUnauthorized()

Sets the state to UNAUTHORIZED. This might be interesting to a user of the object, it has no effect on the handler itself.

getGSSContext

public GSSContext getGSSContext()

Returns:

the GSSContext.

isEstablished

public boolean isEstablished()

Returns:

true if the credentials have been established, false otherwise..

isFailed

public boolean isFailed()

Returns:

true if the negotiation has failed, false otherwise .