Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Do not handle NTLM authentication requests #43

Merged
merged 1 commit into from Mar 9, 2018
Merged

Do not handle NTLM authentication requests #43

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
10 changes: 9 additions & 1 deletion ...gframework/security/kerberos/web/authentication/SpnegoAuthenticationProcessingFilter.java
View file
Open in desktop
Expand Up @@ -115,6 +115,14 @@ public class SpnegoAuthenticationProcessingFilter extends GenericFilterBean {
private SessionAuthenticationStrategy sessionStrategy = new NullAuthenticatedSessionStrategy();
private boolean skipIfAlreadyAuthenticated = true;

/**
* Authentication header prefix sent by IE/Windows when the domain controller fails to issue a Kerberos
* ticket for the URL.
*
* "TlRMTVNTUA" is the base64 encoding of "NTLMSSP". This will be followed by the actual token.
**/
private static final String NTLMSSP_PREFIX = "Negotiate TlRMTVNTUA";

@Override
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
HttpServletRequest request = (HttpServletRequest) req;
Expand All @@ -132,7 +140,7 @@ public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)

String header = request.getHeader("Authorization");

if (header != null && (header.startsWith("Negotiate ") || header.startsWith("Kerberos "))) {
if (header != null && ((header.startsWith("Negotiate ") && !header.startsWith(NTLMSSP_PREFIX)) || header.startsWith("Kerberos "))) {
if (logger.isDebugEnabled()) {
logger.debug("Received Negotiate Header for request " + request.getRequestURL() + ": " + header);
}
Expand Down
17 changes: 16 additions & 1 deletion ...a/org/springframework/security/kerberos/web/SpnegoAuthenticationProcessingFilterTest.java
View file
Open in desktop
Expand Up @@ -92,6 +92,8 @@ public class SpnegoAuthenticationProcessingFilterTest {

private static final String TOKEN_PREFIX_KERB = "Kerberos ";

private static final String TOKEN_NTLM = "Negotiate TlRMTVNTUAABAAAAl4II4gAAAAAAAAAAAAAAAAAAAAAGAbEdAAAADw==";

private static final BadCredentialsException BCE = new BadCredentialsException("");

@Before
Expand Down Expand Up @@ -132,7 +134,7 @@ private void everythingWorksWithHandlers(String tokenPrefix) throws Exception {
everythingWorks(tokenPrefix);
verify(successHandler).onAuthenticationSuccess(request, response, AUTHENTICATION);
verify(failureHandler, never()).onAuthenticationFailure(any(HttpServletRequest.class),
any(HttpServletResponse.class), any(AuthenticationException.class));
any(HttpServletResponse.class), any(AuthenticationException.class));
}

private void everythingWorks(String tokenPrefix) throws IOException,
Expand Down Expand Up @@ -160,6 +162,19 @@ public void testNoHeader() throws Exception {
assertEquals(null, SecurityContextHolder.getContext().getAuthentication());
}

@Test
public void testNTLMSSPHeader() throws Exception {
when(request.getHeader(HEADER)).thenReturn(TOKEN_NTLM);

filter.doFilter(request, response, chain);
// If the header is not present, the filter is not allowed to call
// authenticate()
verify(authenticationManager, never()).authenticate(any(Authentication.class));
// chain should go on
verify(chain).doFilter(request, response);
assertEquals(null, SecurityContextHolder.getContext().getAuthentication());
}

@Test
public void testAuthenticationFails() throws Exception {
authenticationFails();
Expand Down