Add native SSPI authentication support on Windows using JNA via Waffle #212
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
We need Waffle and its underlying JNA dependencies in order to support SSPI authentication on Windows. We compile that support on all platforms, it just only actually works when running on a Windows host.
This change will cause code that was previously attempting direct SSPI negotiation against a Kerberos server to instead use Windows' SSPI support if it is available. SSPI support using waffle-jni is always compiled, but the libraries are not included in the default PgJDBC jar. They must be added on the classpath or included in a "fat jar" for SSPI to work. When missing, PgJDBC throws an informative exception. This commit changes the default behaviour of the driver to use SSPI, but only if: * Waffle-JNA is present on the classpath; * We're running on Windows; and * 'sspi' mode was requested by the server. ... so unless a project already has Waffle-JNA on its classpath for other reasons you won't notice the change unless you take explicit action. The new parameter `gsslib`, modeled after the libpq parameter of the same name, is added to allow users to override whether SSPI is used where it is available. The default is automatic selection as outlined above. This parameter also lets you force use of SSPI against a server that makes a `gssapi` mode auth request. That way a Windows client with existing single-sign-on credentials for an spnego-enabled Kerberos server can re-use its existing credentials via SSPI. Unlike libpq, which defaults to using SSPI on Windows, PgJDBC will not attempt to use SSPI for a GSSAPI auth request this unless explicitly forced to, as most Java users will prefer to do GSSAPI via JSSE rather than via Windows SSPI.
Instead of defining our own slf4j version, reference the one from the Waffle POM directly when we're bundling a copy of slf4j-simple as part of our distribution zip. This means the version will always match what Waffle expects.
Remove src/pom/pom.xml and generate it from maven-ant-tasks, so we can automatically include dependency information.
ringerc
force-pushed
the
sia-jdbc-sspi
branch
from
62515c3
to
9d75466
Compare
ringerc
added a commit
that referenced
this pull request
Dec 1, 2014
Add native SSPI authentication support on Windows using JNA via Waffle See individual commits for details. This patch makes some significant changes to the build process, adding heavier use of maven-ant-tasks, dependency fetching, POM generation, etc. Uploading of snapshots to Maven Central has not been tested and may be affected by this change.
ringerc
added a commit
that referenced
this pull request
Dec 2, 2014
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
PgJDBC previously used Kerberos/GSSAPI via JSSE to try to authenticate to a SSPI server. This required registry changes and lots of JSSE system properties if you wanted to try to authenticate using existing Windows client single-sign-on credentials. It only worked on some Windows versions and required different options for almost every Windows version.
Instead, use the client's SSPI API via JNA to delegate the work to Windows.
PgJDBC is built with Waffle support on all platforms, but it's only usable on Windows. Other platforms can continue to use the existing Kerberos approach to authenticating against SSPI endpoints, as can Windows if Waffle isn't present. The new parameter
gsslib(seedoc/doc.xml) lets you control this.If you try to use SSPI where it's not supported or without Waffle on your classpath you get an informative PSQLException.
The existing maven-ant-tasks integration is enhanced significantly, so it's now used to download the dependencies for building against Waffle and to put them in
lib/for IDE users.Additionally, as part of those changes the code now generates the
pom.xmlon the fly, rather than using a templated POM. This allows the POM to include PgJDBC's dependencies without manual editing.This still needs some more testing - with/without Waffle present, with Waffle present but JNA missing, on Windows/non-windows - but it's largely ready to go.