KerberosAuthenticationProvider vs. KerberosServiceAuthenticationProvider

Question

Moin!

I use Spring Security 5 with Kerberos for the SSO authentication in my project.

In the WebSecurityConfig I register two AuthenticationProvider

@Override
public void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(msfUserDetailsService).passwordEncoder(passwordEncoder());
        assertThatUnlimitedCryptographyEnabled();

        // Two providers
        auth.authenticationProvider(kerberosAuthenticationProvider());
        auth.authenticationProvider(kerberosServiceAuthenticationProvider());
}

This seems to be the way its done as seen in these two examples:

However I don't see why I need both of them. During authentication the KerberosServiceAuthenticationProvider is the one that is validating Kerberos tickets (see JavaDoc)

However what is the KerberosAuthenticationProvider for? The JavaDoc in this case just says

AuthenticationProvider for kerberos.

Did you try it without `KerberosAuthenticationProvider`? What happend? It is only needed for form login or HTTP basic login. I think, it is only needed as a fallback, no SSO is possible. — dur, May 15 '19 at 15:45
You are right, it works without. The chain of AuthenticationProvider contains a DaoAuthenticationProvider at the end which handles password credentials. So far the KerberosAuthenticationProvider seems to be not needed at all. Maybe the DaoAuthenticationProvider is missing in older versions... — Ruik, May 17 '19 at 10:39

score 2 · Accepted Answer · answered Aug 19 '19 at 12:58

As you said: KerberosServiceAuthenticationProvider is used to validate tickets in SSO authentication, whereas KerberosAuthenticationProvider is used for form based authentications, which are usually used as a fallback when SSO is not supported on client side (e.g. browsers on linux systems). This type of authentication is handled by UsernamePasswordAuthenticationFilter which is applied in WebSecurityConfigurerAdapter:

public class SecurityConfig extends WebSecurityConfigurerAdapter {

  @Override
  protected void configure(HttpSecurity httpSecurity) throws Exception {
     httpSecurity
      ...
      .formLogin()
  ...
  }
  ...
}

If you do not use form login then you can omit this provider as pointed in comments.

KerberosAuthenticationProvider vs. KerberosServiceAuthenticationProvider

1 Answers1