2

I have some questions about setting up SPNEGO without use of form fall back.

I am writing a web service that uses SPNEGO authentication and returns a signed JWT for the authenticated principal. I don't have any use for forms (can't use forms with authentication-only principals, for example).

  1. Can I skip the formLogin() and logout() parts as shown in the spring SPNEGO reference, and use the zero-argument SpnegoEntryPoint constructor?
  2. It seems from looking at the source for SPNEGO filter that if the Authorization header is missing then the filter doesn't actually return a 401 Unauthorized response with a WWW-Authenticate: Negotiate challenge to the caller. That is, there is no else to the check on line 135. Am I reading this correctly? The RFC states

    If the server receives a request for an access-protected object, and if an acceptable Authorization header has not been sent, the server responds with a "401 Unauthorized" status code, and a "WWW- Authenticate:" header

  3. If the above is correct, are clients expected to preemptively send the Authorization header?

Thanks!

EDIT (and probably RESOLVED): My original security config had:

http.exceptionHandling()
    .authenticationEntryPoint(spnegoEntryPoint())
    .and()
.authorizeRequests()
    .antMatchers("/v1/**").permitAll()
    .anyRequest().authenticated()
    .and()
.addFilterBefore()...`

When I remove .antMatchers("/v1/**").permitAll() the SpnegoEntryPoint kicks in and I now see a 401 with WWW-Authenticate: Negotiate response.

Of course now I get a Server not found in Kerberos database gss_init_sec_context() failure but i suspect that has to do with SPN setup or host name resolution (since I am testing this locally on my Macbook) than the Spring app.

Will update once finally when I get this working.

PerennialN00b
  • 49
  • 3

1 Answers1

1
  1. Yes, the zero argument cosntructor is correct.
  2. The Filter is not responsible for setting the Status and Header. The SpnegoEntryPoint is. org.springframework.security.kerberos.web.authentication.SpnegoEntryPoint.commence(HttpServletRequest, HttpServletResponse, AuthenticationException)
  3. No, see 2.
Martin Theiss
  • 775
  • 4
  • 5
  • So, when does the entry point get invoked? Only upon an exception? I am trying to step through the entry point as well as filter and execution never hits the entry point upon a request. – PerennialN00b Feb 21 '18 at 14:52