5.3. 瀏覽器配置

我們需要啓用我們用於訪問受保護資源的 Web 瀏覽器，以便在 Web 應用程序中使用“Negotiate”身份驗證方案。 幸運的是，像 Chrome 這樣的現代 Web 瀏覽器默認支持“Negotiate”身份驗證方案。

此外，我們可以配置瀏覽器以提供“集成身份驗證”。 在這種模式下，當遇到“Negotiate”挑戰時，瀏覽器會嘗試利用已登錄到 KDC principals 的主機機器緩存憑據。 但是，我們在這裏不會使用這種模式，以保持明確性。

5.4. 域配置

我們可以理解，我們可能沒有實際的域來測試我們的 Web 應用程序。 但是，我們不能使用 localhost 或 127.0.0.1 或任何其他 IP 地址進行 Kerberos 身份驗證。 但是，有一種簡單的解決方案，即在“hosts”文件中設置條目，例如：

demo.kerberos.baeldung.com 127.0.0.1

6. Spring to Our Rescue!

Finally, as we’ve got the basics clear, it is time to test the theory. But, won’t it be cumbersome to create a web application supporting SPNEGO and Kerberos? Not if we use Spring. Spring has a Kerberos Extension as part of Spring Security that supports SPNEGO with Kerberos seamlessly.

Almost all we have to do is just configurations in Spring Security to enable SPNEGO with Kerberos. We’ll use Java-style configurations here, but an XML configuration can be set up as easily.

6.1. Maven Dependencies

The first thing we have to set up are the dependencies:

<dependency>
    <groupId>org.springframework.security.kerberos</groupId>
    <artifactId>spring-security-kerberos-web</artifactId>
    <version>${kerberos.extension.version}</version>
</dependency>
<dependency>
    <groupId>org.springframework.security.kerberos</groupId>
    <artifactId>spring-security-kerberos-client</artifactId>
    <version>${kerberos.extension.version}</version>
</dependency>

These dependencies are available for download from Maven Central.

6.2. SPNEGO Configurations

Firstly, SPNEGO is integrated into Spring Security as a Filter in HTTPSecurity:

 @Override
 public void configure(HttpSecurity http) throws Exception {
     AuthenticationManager authenticationManager = http.getSharedObject(AuthenticationManager.class);
     http.addFilterBefore(spnegoAuthenticationProcessingFilter(authenticationManager),
         BasicAuthenticationFilter.class);
}

This only shows the part required to configure SPNEGO Filter and is not a complete HTTPSecurity configuration, which should be configured as per application security requirements.

Next, we need to provide the SPNEGO Filter as Bean:

@Bean
public SpnegoAuthenticationProcessingFilter spnegoAuthenticationProcessingFilter(
  AuthenticationManager authenticationManager) {
    SpnegoAuthenticationProcessingFilter filter = new SpnegoAuthenticationProcessingFilter();
    filter.setAuthenticationManager(authenticationManager);
    return filter;
}

6.3. Kerberos Configurations

In addition, We can configure Kerberos by adding AuthenticationProvider to AuthenticationManagerBuilder in Spring Security:

 @Bean
 public AuthenticationManager authManager(HttpSecurity http) throws Exception {
     return http.getSharedObject(AuthenticationManagerBuilder.class)
         .authenticationProvider(kerberosAuthenticationProvider())
         .authenticationProvider(kerberosServiceAuthenticationProvider())
         .build();
}

The first thing we have to provide is a KerberosAuthenticationProvider as a Bean. This is an implementation of AuthenticationProvider, and this is where we set SunJaasKerberosClient as a KerberosClient:

@Bean
public KerberosAuthenticationProvider kerberosAuthenticationProvider() {
    KerberosAuthenticationProvider provider = new KerberosAuthenticationProvider();
    SunJaasKerberosClient client = new SunJaasKerberosClient();
    provider.setKerberosClient(client);
    provider.setUserDetailsService(userDetailsService());
    return provider;
}

Next, we also have to provide a KerberosServiceAuthenticationProvider as a Bean. This is the class that validates Kerberos Service Tickets or SPNEGO Tokens:

@Bean
public KerberosServiceAuthenticationProvider kerberosServiceAuthenticationProvider() {
    KerberosServiceAuthenticationProvider provider = new KerberosServiceAuthenticationProvider();
    provider.setTicketValidator(sunJaasKerberosTicketValidator());
    provider.setUserDetailsService(userDetailsService());
    return provider;
}

Lastly, we need to provide a SunJaasKerberosTicketValidator as a Bean. This is an implementation of KerberosTicketValidator and uses SUN JAAS Login Module:

@Bean
public SunJaasKerberosTicketValidator sunJaasKerberosTicketValidator() {
    SunJaasKerberosTicketValidator ticketValidator = new SunJaasKerberosTicketValidator();
    ticketValidator.setServicePrincipal("HTTP/[email protected]");
    ticketValidator.setKeyTabLocation(new FileSystemResource("baeldung.keytab"));
    return ticketValidator;
}

6.4. User Details

We’ve seen references to a UserDetailsService in our AuthenticationProvider earlier, so why do we need it? Well, as we’ve come to know Kerberos, it is purely an authentication mechanism that is ticket-based.

So, while it’s able to identify the user, it doesn’t provide other details related to the user, like their authorizations. We need a valid UserDetailsService provided to our AuthenticationProvider to fill this gap.

6.5. Running the Application

This is pretty much what we need to set up a web application with Spring Security enabled for SPNEGO with Kerberos. When we boot up the web application and access any page therein, the web browser should prompt for username and password, prepare a SPNEGO token with Service Ticket, and send it to the application.

The application should be able to process it using the credentials in the keytab file and respond with successful authentication.

However, as we saw earlier, setting up a working Kerberos environment is complicated and quite brittle. If things don’t work as expected, it’s worthwhile to check all the steps again. A simple mistake like mismatch in the domain name can lead to failure with error messages that aren’t particularly helpful.

7. SPNEGO 和 Kerberos 的實際應用

現在我們已經瞭解了 Kerberos 認證的工作原理以及如何在 Web 應用程序中使用 SPNEGO 與 Kerberos，我們可能會質疑它的必要性。雖然這在企業網絡中作為 SSO 機制使用完全合理，但為什麼我們應該在 Web 應用程序中使用它？

原因在於，即使在多年來，Kerberos 仍然在企業應用程序中得到積極使用，尤其是在 Windows 應用程序中。如果一個組織擁有多個內部和外部 Web 應用程序，那麼將相同的 SSO 基礎設施擴展到這些應用程序中，無疑是有意義的。這使得組織中的管理員和用户能夠通過不同的應用程序獲得無縫體驗。

8. 結論

總而言之，在本教程中，我們理解了 Kerberos 身份驗證協議的基礎知識。我們還討論了 SPNEGO 作為 GSS-API 的一部分，以及如何利用它在 HTTP 上促進基於 Kerberos 的 Web 應用程序身份驗證。此外，我們嘗試構建一個利用 Spring Security 內置對 SPNEGO 的支持的 небольшой веб-приложение。

本教程只是對一種強大且經過驗證的身份驗證機制的快速預覽。我們還有很多可以學習和欣賞的信息！