Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add native SSPI authentication support on Windows using JNA via Waffle #212

merged 7 commits into from Dec 1, 2014


Copy link

@ringerc ringerc commented Nov 13, 2014

PgJDBC previously used Kerberos/GSSAPI via JSSE to try to authenticate to a SSPI server. This required registry changes and lots of JSSE system properties if you wanted to try to authenticate using existing Windows client single-sign-on credentials. It only worked on some Windows versions and required different options for almost every Windows version.

Instead, use the client's SSPI API via JNA to delegate the work to Windows.

PgJDBC is built with Waffle support on all platforms, but it's only usable on Windows. Other platforms can continue to use the existing Kerberos approach to authenticating against SSPI endpoints, as can Windows if Waffle isn't present. The new parameter gsslib (see doc/doc.xml) lets you control this.

If you try to use SSPI where it's not supported or without Waffle on your classpath you get an informative PSQLException.

The existing maven-ant-tasks integration is enhanced significantly, so it's now used to download the dependencies for building against Waffle and to put them in lib/ for IDE users.

Additionally, as part of those changes the code now generates the pom.xml on the fly, rather than using a templated POM. This allows the POM to include PgJDBC's dependencies without manual editing.

This still needs some more testing - with/without Waffle present, with Waffle present but JNA missing, on Windows/non-windows - but it's largely ready to go.

ringerc added 7 commits Oct 30, 2014
We need Waffle and its underlying JNA dependencies in order to support
SSPI authentication on Windows. We compile that support on all platforms,
it just only actually works when running on a Windows host.
This change will cause code that was previously attempting direct SSPI
negotiation against a Kerberos server to instead use Windows' SSPI support
if it is available.

SSPI support using waffle-jni is always compiled, but the libraries are
not included in the default PgJDBC jar. They must be added on the classpath
or included in a "fat jar" for SSPI to work. When missing, PgJDBC throws
an informative exception.

This commit changes the default behaviour of the driver to use SSPI, but only if:

* Waffle-JNA is present on the classpath;
* We're running on Windows; and
* 'sspi' mode was requested by the server.

... so unless a project already has Waffle-JNA on its classpath for other
reasons you won't notice the change unless you take explicit action.

The new parameter `gsslib`, modeled after the libpq parameter of the same
name, is added to allow users to override whether SSPI is used where it
is available. The default is automatic selection as outlined above.

This parameter also lets you force use of SSPI against a server that makes a
`gssapi` mode auth request. That way a Windows client with existing
single-sign-on credentials for an spnego-enabled Kerberos server can re-use its
existing credentials via SSPI. Unlike libpq, which defaults to using SSPI on
Windows, PgJDBC will not attempt to use SSPI for a GSSAPI auth request this
unless explicitly forced to, as most Java users will prefer to do GSSAPI via
JSSE rather than via Windows SSPI.
Instead of defining our own slf4j version, reference the one from the Waffle
POM directly when we're bundling a copy of slf4j-simple as part of our
distribution zip. This means the version will always match what Waffle
Remove src/pom/pom.xml and generate it from maven-ant-tasks, so we can
automatically include dependency information.
@ringerc ringerc force-pushed the ringerc:sia-jdbc-sspi branch from 62515c3 to 9d75466 Nov 13, 2014
ringerc added a commit that referenced this pull request Dec 1, 2014
Add native SSPI authentication support on Windows using JNA via Waffle

See individual commits for details.

This patch makes some significant changes to the build process, adding heavier use of maven-ant-tasks, dependency fetching, POM generation, etc.

Uploading of snapshots to Maven Central has not been tested and may be affected by this change.
@ringerc ringerc merged commit 2c91dc0 into pgjdbc:master Dec 1, 2014
1 check passed
1 check passed
continuous-integration/travis-ci The Travis CI build passed
@ringerc ringerc added the enhancement label Dec 1, 2014
ringerc added a commit that referenced this pull request Dec 2, 2014
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
None yet
Linked issues

Successfully merging this pull request may close these issues.

None yet

1 participant
You can’t perform that action at this time.