Skip to content
This repository

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP

Jetty (HttpServlet) SPNEGO + PAC demo

branch: master

Fetching latest commit…

Octocat-spinner-32-eaf2f5

Cannot retrieve the latest commit at this time

Octocat-spinner-32 src
Octocat-spinner-32 .gitignore
Octocat-spinner-32 README
Octocat-spinner-32 pom.xml
README
SPNEGO Servlet + Microsoft PAC demo
===================================


Introduction
============

This project demonstrates the use of the filter found at[1] as a simple HttpServlet using Jetty. So be sure to read their docs (especially their pre-flight routine).
In addition it also demonstrate the use of the PAC parser found at[2] to parse the PAC information found in an Active Directory (or Samba 4) issued Kerberos ticket[3]. This contains authorization information about the authenticated user principal (think: group information in the form of SID etc.).

[1] http://spnego.sourceforge.net
[2] http://jaaslounge.sourceforge.net/
[3] http://appliedcrypto.com/spnego/pac/ms_kerberos_pac.html

Used Settings
=============

Hostname: example.com
SPN: HTTP/example.com
Domain username: Zeus
Domain username password: Z3usP@55

/etc/krb5.conf:
-->8--snip-->8--snip-->8---
[libdefaults]
        default_realm = EXAMPLE.COM
	forwardable = true

[realms]
        EXAMPLE.COM = {
                kdc = adserver.example.com
		default_domain = EXAMPLE.COM
		kpasswd_server = adserver.example.com
        }

[domain_realm]
        .example.com = EXAMPLE.COM
        example.com = EXAMPLE.COM

[login]
        krb4_convert = true
        krb4_get_tickets = false
-->8--snip-->8--snip-->8---

Browser configuration:

1) IE:  Configure trusted websites to include "http://example.com" and allow negotiation for that website (@TODO be more specific)
2) Google-chrome:  start from command line with: google-chrome --auth-server-whitelist="*example.com" --auth-negotiate-delegate-whitelist="*example.com"
3) Firefox: go to about:config, "say you'll be careful", change the value for 'network.negotiate-auth.trusted-uris' into 'https://,http://example.com' and the value for 'network.negotiate-auth.delegation-uris' into 'http://example.com'


Build/Run Instructions
======================

Build/run using: mvn jetty:run         (and have a cup of tea (coffee), if you happen to have an empty local maven repo)


Available Servlets
==================

1) http://example.com:8080/filtered/spnego

	Shows how to use the forked spnego-pac filter to authenticate users against a Kerberos (i.e. Active Directory) and how to read the logon info (PAC, e.g. group SID) from the authenticated principal (for kerberos tickets issues by Active Directory, Samba v4).

2) http://example.com:8080/spnego

	Works like 1) but exposes the underlying code in a single file (for people who like to know how it works).


Notes
=====

1) If your client is on a POSIX platform (Linux, etc.), be sure to run 'kinit' first, otherwise you will not be able to authenticate and the browsers won't tell you what is happening.
2) In Windows you cannot run the server and the client on the same host, because Windows will try to use NTLM then, which you don't want because it's insecure.
3) There are probably more caveats that I now fail to remember/mention, sorry about that.

Something went wrong with that request. Please try again.