Thursday, November 6. 2008SPNEGO Proxy authentication for JAVA Applications/Applets
It took me literally tens of hours to figure out how to do SPNEGO proxy authentication for JAVAs builtin HTTP routines. So let me share my results:
To make your Java Applications integrate with your well-established Kerberos SSO just set export _JAVA_OPTIONS="-Dsun.security.jgss.native=true -Dsun.security.jgss.lib=/usr/lib/libgssapi_krb5.so -Dhttp.auth.preference=spnego -Dhttp.proxyHost= (Location of your gssapi library might differ) Wednesday, January 2. 2008Some work-in-progress
During the last days I had some time to work on different things that were in the working queue for quite some time:
First of all, I had the chance to look at the possibilities for OpenAFS web-administration again. As I might have written before, the libadmin library is such a mess in terms of documentation and I really did not want to dig into this - so I wanted to try out what was possible using JAFS. Until now there was no support for use in non-KAS cells but then - some weeks ago - there was a post on openafs-dev about using it in a K5 cell (and also fixing the code for compiling with java 1.5) so this was the chance to try it out. It really took some time to get it kind of working - but finally (after patching out the various kas_ calls that were still in the code - which made the code block almost infinitly, and some other patches to make it compile) it did. After that I was almost unable to belive that the php-java-bridge was working perfectly out of the box. So I could take phpSATk build some objects and definitions around the interface (this unfortunatly was a bit more complicated than the other things I build so farr because I had to do the right type casts in the wrapper) and hell yeah ... now it seems to work. And I updated my php_afs extension to only take a kerberos ticket (from php_krb5) and perform "aklog"-ging to the afs cell to have the right token in kernel. This might be a pretty much glued together solution (and there are some problems like error handling which are not that nice), but yes - IT WORKS!! The other thing I had been working on is the ICAP server (which still needs some unique name Tuesday, April 24. 2007Doing GSS/Negotiate SSO using Mozilla Firefox, MIT Kerberos and PHP
Kerberos has been the de-facto industry standard for Single-Sign-On for many years but not yet been widely adapted for intranet/web-applications. Firefox supports GSSAPI (on Linux/Unix and Windows - using MIT Kerberos for Windows (KfW)) and SSPI (Windows) for Kerberos authentication quite a while, usable since version 1.5.
Because Microsoft also uses NTLM for SSO purposes they invented a GSSAPI pseudo-mechanism named SPNEGO to do negotiating of which of the protocols to use - fortunately MIT kerberbos (since version 1.5) supports SPNEGO (thanks to SUN donating a implementation) so we can use MITs GSSAPI library for the server side. SPNEGO is yet only supported on Linux platforms (KfW 3.1 includes a krb library of version 1.4.5 - 3.2 which is currently in beta status will have 1.6+) but at least Mozilla will automatically fall back to plain kerberos authentication which in case of a MIT server side will perfectly work. Update: KfW 3.2 has been released today - SPNEGO now works on Windows. I have not yet had a chance to experiment in a SSPI environment and there are rumors about Microsoft not implementing their own protocol (SPNEGO) correctly, so I cannot really say whether it is compatible. There is a (not yet standardized) extension to the HTTP/1.1 specification which specifies the "HTTP negotiate" authentication method. We try to use it for SSO on web-applications and web-resources. I wrote a PHP extension which gives server side support for this kind of authentication. Continue reading for directions on how to use it... Continue reading "Doing GSS/Negotiate SSO using Mozilla Firefox, MIT Kerberos and PHP"
(Page 1 of 1, totaling 3 entries)
|
QuicksearchArchivesKategorienBlog abonnierenProjects |