Package org.codelibs.fess.sso.spnego

Class SpnegoAuthenticator

java.lang.Object
org.codelibs.fess.sso.spnego.SpnegoAuthenticator
All Implemented Interfaces:
SsoAuthenticator
public class SpnegoAuthenticator extends Object implements SsoAuthenticator
SPNEGO (Security Provider Negotiation Protocol) authenticator implementation. This class provides Single Sign-On (SSO) authentication using the SPNEGO protocol, which is commonly used for Kerberos-based authentication in Windows environments. It handles the negotiation between client and server to establish a secure authentication context without requiring users to explicitly enter credentials. The authenticator supports various configuration options including delegation, basic authentication fallback, and localhost authentication bypass.

  • Field Details

    • SPNEGO_INITIALIZED

      protected static final String SPNEGO_INITIALIZED
      Configuration key for SPNEGO initialization status.
      See Also:

    • SPNEGO_EXCLUDE_DIRS

      protected static final String SPNEGO_EXCLUDE_DIRS
      Configuration key for directories to exclude from SPNEGO authentication.
      See Also:

    • SPNEGO_ALLOW_DELEGATION

      protected static final String SPNEGO_ALLOW_DELEGATION
      Configuration key for enabling delegation in SPNEGO authentication.
      See Also:

    • SPNEGO_ALLOW_LOCALHOST

      protected static final String SPNEGO_ALLOW_LOCALHOST
      Configuration key for allowing localhost authentication bypass.
      See Also:

    • SPNEGO_PROMPT_NTLM

      protected static final String SPNEGO_PROMPT_NTLM
      Configuration key for prompting NTLM authentication.
      See Also:

    • SPNEGO_ALLOW_UNSECURE_BASIC

      protected static final String SPNEGO_ALLOW_UNSECURE_BASIC
      Configuration key for allowing unsecure basic authentication.
      See Also:

    • SPNEGO_ALLOW_BASIC

      protected static final String SPNEGO_ALLOW_BASIC
      Configuration key for allowing basic authentication.
      See Also:

    • SPNEGO_PREAUTH_PASSWORD

      protected static final String SPNEGO_PREAUTH_PASSWORD
      Configuration key for pre-authentication password.
      See Also:

    • SPNEGO_PREAUTH_USERNAME

      protected static final String SPNEGO_PREAUTH_USERNAME
      Configuration key for pre-authentication username.
      See Also:

    • SPNEGO_LOGIN_SERVER_MODULE

      protected static final String SPNEGO_LOGIN_SERVER_MODULE
      Configuration key for login server module name.
      See Also:

    • SPNEGO_LOGIN_CLIENT_MODULE

      protected static final String SPNEGO_LOGIN_CLIENT_MODULE
      Configuration key for login client module name.
      See Also:

    • SPNEGO_KRB5_CONF

      protected static final String SPNEGO_KRB5_CONF
      Configuration key for Kerberos configuration file path.
      See Also:

    • SPNEGO_LOGIN_CONF

      protected static final String SPNEGO_LOGIN_CONF
      Configuration key for login configuration file path.
      See Also:

    • SPNEGO_LOGGER_LEVEL

      protected static final String SPNEGO_LOGGER_LEVEL
      Configuration key for SPNEGO logger level.
      See Also:

    • authenticator

      protected org.codelibs.spnego.SpnegoAuthenticator authenticator
      The underlying SPNEGO authenticator instance.

  • Constructor Details

    • SpnegoAuthenticator

      public SpnegoAuthenticator()
      Constructs a new SPNEGO authenticator.

  • Method Details

    • init

      @PostConstruct public void init()
      Initializes the SPNEGO authenticator and registers it with the SSO manager. This method is called automatically after dependency injection is complete.

    • getAuthenticator

      protected org.codelibs.spnego.SpnegoAuthenticator getAuthenticator()
      Gets or creates the SPNEGO authenticator instance. This method implements lazy initialization with synchronization to ensure the authenticator is only created once. It configures the authenticator with the appropriate SPNEGO settings and marks initialization as complete.
      Returns:
      The configured SPNEGO authenticator instance
      Throws:
      SsoLoginException - if SPNEGO initialization fails

    • getLoginCredential

      public org.lastaflute.web.login.credential.LoginCredential getLoginCredential()
      Attempts to obtain login credentials using SPNEGO authentication. This method processes the HTTP request to extract and validate SPNEGO authentication tokens. It handles the SPNEGO handshake process and extracts the user principal from successful authentication.
      Specified by:
      getLoginCredential in interface SsoAuthenticator
      Returns:
      The login credential containing the authenticated username, an ActionResponseCredential for authentication challenges, or null if no authentication information is available
      Throws:
      SsoLoginException - if SPNEGO authentication fails

    • resolveCredential

      public void resolveCredential(FessLoginAssist.LoginCredentialResolver resolver)
      Resolves the SPNEGO credential to a user entity. This method handles the resolution of SPNEGO credentials by checking if the user is an admin user or needs to be authenticated through LDAP.
      Specified by:
      resolveCredential in interface SsoAuthenticator
      Parameters:
      resolver - The credential resolver to use for user lookup

    • getResponse

      public org.lastaflute.web.response.ActionResponse getResponse(SsoResponseType responseType)
      Gets the action response for the specified SSO response type. SPNEGO authentication typically doesn't require special response handling for metadata or logout operations, so this method returns null.
      Specified by:
      getResponse in interface SsoAuthenticator
      Parameters:
      responseType - The type of SSO response requested
      Returns:
      Always returns null for SPNEGO authentication

    • logout

      public String logout(org.codelibs.fess.mylasta.action.FessUserBean user)
      Performs logout for the specified user. SPNEGO authentication relies on the underlying Kerberos infrastructure for session management, so no specific logout URL is provided.
      Specified by:
      logout in interface SsoAuthenticator
      Parameters:
      user - The user to logout
      Returns:
      Always returns null as SPNEGO doesn't provide a logout URL