org.apache.catalina.authenticator

Class SpnegoAuthenticator

java.lang.Object

org.apache.catalina.util.LifecycleBase

org.apache.catalina.util.LifecycleMBeanBase

org.apache.catalina.valves.ValveBase

org.apache.catalina.authenticator.AuthenticatorBase

org.apache.catalina.authenticator.SpnegoAuthenticator

All Implemented Interfaces:

MBeanRegistration, RegistrationListener, Authenticator, Contained, JmxEnabled, Lifecycle, Valve

public class SpnegoAuthenticator
extends AuthenticatorBase

A SPNEGO authenticator that uses the SPNEGO/Kerberos support built in to Java 6. Successful Kerberos authentication depends on the correct configuration of multiple components. If the configuration is invalid, the error messages are often cryptic although a Google search will usually point you in the right direction.

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	SpnegoAuthenticator.AcceptAction This class gets a gss credential via a privileged action.
static class	SpnegoAuthenticator.AuthenticateAction
static class	SpnegoAuthenticator.SpnegoTokenFixer This class implements a hack around an incompatibility between the SPNEGO implementation in Windows and the SPNEGO implementation in Java 8 update 40 onwards.

Nested classes/interfaces inherited from interface org.apache.catalina.Lifecycle

Lifecycle.SingleUse

Field Summary

Fields inherited from class org.apache.catalina.authenticator.AuthenticatorBase

alwaysUseSession, AUTH_HEADER_NAME, cache, changeSessionIdOnAuthentication, context, disableProxyCaching, REALM_NAME, securePagesWithPragma, secureRandomAlgorithm, secureRandomClass, secureRandomProvider, sessionIdGenerator, sm, sso

Fields inherited from class org.apache.catalina.valves.ValveBase

asyncSupported, container, containerLog, next

Fields inherited from class org.apache.catalina.util.LifecycleMBeanBase

mserver

Fields inherited from interface org.apache.catalina.Lifecycle

AFTER_DESTROY_EVENT, AFTER_INIT_EVENT, AFTER_START_EVENT, AFTER_STOP_EVENT, BEFORE_DESTROY_EVENT, BEFORE_INIT_EVENT, BEFORE_START_EVENT, BEFORE_STOP_EVENT, CONFIGURE_START_EVENT, CONFIGURE_STOP_EVENT, PERIODIC_EVENT, START_EVENT, STOP_EVENT

Constructor Summary

Constructors

Constructor and Description
SpnegoAuthenticator()

Method Summary

Modifier and Type	Method and Description
boolean	authenticate(Request request, HttpServletResponse response) Authenticate the user making this request, based on the login configuration of the Context with which this Authenticator is associated.
boolean	getApplyJava8u40Fix()
protected String	getAuthMethod()
String	getLoginConfigName()
String	getNoKeepAliveUserAgents()
protected void	initInternal() Sub-classes wishing to perform additional initialization should override this method, ensuring that super.initInternal() is the first call in the overriding method.
boolean	isStoreDelegatedCredential()
void	setApplyJava8u40Fix(boolean applyJava8u40Fix)
void	setLoginConfigName(String loginConfigName)
void	setNoKeepAliveUserAgents(String noKeepAliveUserAgents)
void	setStoreDelegatedCredential(boolean storeDelegatedCredential)

Methods inherited from class org.apache.catalina.authenticator.AuthenticatorBase

associate, checkForCachedAuthentication, doLogin, getAlwaysUseSession, getCache, getChangeSessionIdOnAuthentication, getContainer, getDisableProxyCaching, getRealmName, getRequestCertificates, getSecurePagesWithPragma, getSecureRandomAlgorithm, getSecureRandomClass, getSecureRandomProvider, invoke, login, logout, notify, reauthenticateFromSSO, register, setAlwaysUseSession, setCache, setChangeSessionIdOnAuthentication, setContainer, setDisableProxyCaching, setSecurePagesWithPragma, setSecureRandomAlgorithm, setSecureRandomClass, setSecureRandomProvider, startInternal, stopInternal

Methods inherited from class org.apache.catalina.valves.ValveBase

backgroundProcess, getDomainInternal, getNext, getObjectNameKeyProperties, isAsyncSupported, setAsyncSupported, setNext, toString

Methods inherited from class org.apache.catalina.util.LifecycleMBeanBase

destroyInternal, getDomain, getObjectName, postDeregister, postRegister, preDeregister, preRegister, register, setDomain, unregister

Methods inherited from class org.apache.catalina.util.LifecycleBase

addLifecycleListener, destroy, findLifecycleListeners, fireLifecycleEvent, getState, getStateName, init, removeLifecycleListener, setState, setState, start, stop

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Constructor Detail

SpnegoAuthenticator

public SpnegoAuthenticator()

Method Detail

getLoginConfigName

public String getLoginConfigName()

setLoginConfigName

public void setLoginConfigName(String loginConfigName)

isStoreDelegatedCredential

public boolean isStoreDelegatedCredential()

setStoreDelegatedCredential

public void setStoreDelegatedCredential(boolean storeDelegatedCredential)

getNoKeepAliveUserAgents

public String getNoKeepAliveUserAgents()

setNoKeepAliveUserAgents

public void setNoKeepAliveUserAgents(String noKeepAliveUserAgents)

getApplyJava8u40Fix

public boolean getApplyJava8u40Fix()

setApplyJava8u40Fix

public void setApplyJava8u40Fix(boolean applyJava8u40Fix)

getAuthMethod

protected String getAuthMethod()

Specified by:

getAuthMethod in class AuthenticatorBase

initInternal

protected void initInternal()
                     throws LifecycleException

Description copied from class: LifecycleMBeanBase

Sub-classes wishing to perform additional initialization should override this method, ensuring that super.initInternal() is the first call in the overriding method.

Overrides:

initInternal in class ValveBase

Throws:

LifecycleException

authenticate

public boolean authenticate(Request request,
                            HttpServletResponse response)
                     throws IOException

Description copied from interface: Authenticator

Authenticate the user making this request, based on the login configuration of the Context with which this Authenticator is associated.

Parameters:

request - Request we are processing

response - Response we are populating

Returns:

true if any specified constraints have been satisfied, or false if one more constraints were not satisfied (in which case an authentication challenge will have been written to the response).

Throws:

IOException - if an input/output error occurs