![]() Version: 10.0.0-alpha0 |
private support for your internal/customer projects ... custom extensions and distributions ... versioned snapshots for indefinite support ... scalability guidance for your apps and Ajax/Comet projects ... development services for sponsored feature development
Simple and Protected GSSAPI Negotiation Mechanism (SPNEGO) is a way for users to be seamlessly authenticated when running on systems that rely on Kerberos for authentication, such as Windows Active Directory based networks.
Jetty supports this type of authentication and authorization through the JDK (which has been enabled since the later versions of Java 6 and 7).
To run with SPNEGO enabled the following command line options are required:
-Djava.security.krb5.conf=/path/to/krb5.ini
For debugging the SPNEGO authentication the following options are helpful:
-Dorg.eclipse.jetty.LEVEL=debug -Dsun.security.spnego.debug=true -Dsun.security.jgss.debug=true -Dsun.security.krb5.debug=true
SPNEGO authentication must be enabled in the webapp in the following way. The name of the role will be different for your network.
<security-constraint>
<web-resource-collection>
<web-resource-name>Secure Area</web-resource-name>
<url-pattern>/secure/me/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<!-- this is the domain that the user is a member of -->
<role-name>MORTBAY.ORG</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>SPNEGO</auth-method>
<realm-name>Test Realm</realm-name>
<!-- optionally to add custom error page -->
<spnego-login-config>
<spnego-error-page>/loginError.html?param=foo</spnego-error-page>
</spnego-login-config>
</login-config>A corresponding UserRealm needs to be created either programmatically if
embedded, via the jetty.xml or in a context file for the webapp.
This is what the configuration within a context XML file would look like:
<Get name="securityHandler">
<Set name="loginService">
<New class="org.eclipse.jetty.security.ConfigurableSpnegoLoginService">
<Arg>Test Realm</Arg>
<Arg><Ref refid="authorizationService" /></Arg>
<Set name="keyTabPath"><Ref refid="keyTabPath" /></Set>
</New>
</Set>
</Get>On the Windows Active Domain Controller run:
$ setspn -A HTTP/linux.mortbay.org ADUser
To create the keyTab file use the following process:
$ ktpass -out c:\dir\krb5.keytab -princ HTTP/linux.mortbay.org@MORTBAY.ORG -mapUser ADUser -mapOp set -pass ADUserPWD -crypto RC4-HMAC-NT -pType KRB5_NT_PRINCIPAL
This step will give you the keyTab file which should then be copied to the machine running the http server and referenced from the configuration files.
The follows steps have been required to inform Firefox that it should use a negotiation dialog to authenticate.
network.negotiate-auth.delegation-uris to http://,https://network.negotiate-auth.trusted-uris to http://,https://The follows steps have been required to inform Internet Explorer that it should use a negotiation dialog to authenticate.
http:// and/or https:// — use the hostname, not the IP)Enable Integrated Windows AuthenticationYou must use hostname and not the IP. If you use the IP it will default to NTLM authentication. The following conditions must be true for SPNEGO authentication to work: