Add native SSPI authentication support on Windows using JNA via Waffle #212
PgJDBC previously used Kerberos/GSSAPI via JSSE to try to authenticate to a SSPI server. This required registry changes and lots of JSSE system properties if you wanted to try to authenticate using existing Windows client single-sign-on credentials. It only worked on some Windows versions and required different options for almost every Windows version.
Instead, use the client's SSPI API via JNA to delegate the work to Windows.
PgJDBC is built with Waffle support on all platforms, but it's only usable on Windows. Other platforms can continue to use the existing Kerberos approach to authenticating against SSPI endpoints, as can Windows if Waffle isn't present. The new parameter
If you try to use SSPI where it's not supported or without Waffle on your classpath you get an informative PSQLException.
The existing maven-ant-tasks integration is enhanced significantly, so it's now used to download the dependencies for building against Waffle and to put them in
Additionally, as part of those changes the code now generates the
This still needs some more testing - with/without Waffle present, with Waffle present but JNA missing, on Windows/non-windows - but it's largely ready to go.
This change will cause code that was previously attempting direct SSPI negotiation against a Kerberos server to instead use Windows' SSPI support if it is available. SSPI support using waffle-jni is always compiled, but the libraries are not included in the default PgJDBC jar. They must be added on the classpath or included in a "fat jar" for SSPI to work. When missing, PgJDBC throws an informative exception. This commit changes the default behaviour of the driver to use SSPI, but only if: * Waffle-JNA is present on the classpath; * We're running on Windows; and * 'sspi' mode was requested by the server. ... so unless a project already has Waffle-JNA on its classpath for other reasons you won't notice the change unless you take explicit action. The new parameter `gsslib`, modeled after the libpq parameter of the same name, is added to allow users to override whether SSPI is used where it is available. The default is automatic selection as outlined above. This parameter also lets you force use of SSPI against a server that makes a `gssapi` mode auth request. That way a Windows client with existing single-sign-on credentials for an spnego-enabled Kerberos server can re-use its existing credentials via SSPI. Unlike libpq, which defaults to using SSPI on Windows, PgJDBC will not attempt to use SSPI for a GSSAPI auth request this unless explicitly forced to, as most Java users will prefer to do GSSAPI via JSSE rather than via Windows SSPI.
Remove src/pom/pom.xml and generate it from maven-ant-tasks, so we can automatically include dependency information.
Add native SSPI authentication support on Windows using JNA via Waffle See individual commits for details. This patch makes some significant changes to the build process, adding heavier use of maven-ant-tasks, dependency fetching, POM generation, etc. Uploading of snapshots to Maven Central has not been tested and may be affected by this change.