[CONF] Apache CXF Documentation > JAXRS Kerberos

[confluence]

JAXRS Kerberos Page edited by Sergey Beryozkin Changes (8) ... h1. Introduction h2. Kerberos h2. HTTP Negotiate scheme h2. GSS API h21. Client configuration h32. HTTPConduit Please see [this page|http://cxf.apache.org/docs/client-http-transport-including-ssl-support.html#ClientHTTPTransport%28includingSSLsupport%29-SpnegoAuthentication%28Kerberos%29] for the information about Spnego/Kerberos HTTPConduit client support. h32. Interceptor org.apache.cxf.jaxrs.security.KerberosAuthOutInterceptor can be used as an alternative to configuring HTTPConduit. KerberosAuthOutInterceptor and the HTTPConduit Spnego handler share the same base code. Having HTTPConduit configuration can be enough in many cases especially when SSL is also being setup at the conduit level. Using the interceptor can be handy when testing as well as when setting few extra properties which is not easy to set up at the generic HTTP Conduit Authorization Policy level. The interceptor properties are explained in the following sub-sections h3. Authorization Policy As explained on [this page|http://cxf.apache.org/docs/client-http-transport-including-ssl-support.html#ClientHTTPTransport%28includingSSLsupport%29-SpnegoAuthentication%28Kerberos%29], Authorization Policy typically needs to have its type set to "Negotiate" and its "authorization" property set to the name of the JAAS context. AuthorizationPolicy is set as a "policy" property on the interceptor, example: {code:java} WebClient wc = WebClient.create("http://localhost:" + PORT + "/bookstore/books/123"); KerberosAuthOutInterceptor kbInterceptor = new KerberosAuthOutInterceptor(); AuthorizationPolicy policy = new AuthorizationPolicy(); policy.setAuthorizationType(HttpAuthHeader.AUTH_TYPE_NEGOTIATE); policy.setAuthorization("KerberosClientKeyTab"); kbInterceptor.setPolicy(policy); WebClient.getConfig(wc).getOutInterceptors().add(kbInterceptor); Book b = wc.get(Book.class); {code} h3. Configuring the service principal name By default, the service principal name is calculated by concatenating "HTTP", "/" and the name of the target host, example, when invoking on "http://localhost:8080/services", the service principal name is set to "HTTP/localhost". The "servicePrincipalName" and "realm" properties can be used to customize it, example, setting "servicePrincipalName" to "HTTP/www.mycompany.com" and realm to "services.org" will result in the "HTTP/www.mycompany....@services.org" service principal name being used. h3. Using JAAS Configuration Both HTTPConduit and interceptor handlers need a "java.security.auth.login.config" system property set up. This property needs to point to the file containing the configuration of the specific Kerberos login module. Instead of setting this system property and maintaining a configuration file, one might want to use an implementation of javax.security.auth.login.Configuration and set it on the interceptor as a "loginConfig" property. h21. Server configuration h1. Credential Delegation Full Content JAX-RS Kerberos Support Introduction Kerberos HTTP Negotiate scheme GSS API Client configuration HTTPConduit Interceptor Authorization Policy Configuring the service principal name Using JAAS Configuration Server configuration Credential Delegation Introduction Kerberos HTTP Negotiate scheme GSS API Client configuration HTTPConduit Please see this page for the information about Spnego/Kerberos HTTPConduit client support. Interceptor org.apache.cxf.jaxrs.security.KerberosAuthOutInterceptor can be used as an alternative to configuring HTTPConduit. KerberosAuthOutInterceptor and the HTTPConduit Spnego handler share the same base code. Having HTTPConduit configuration can be enough in many cases especially when SSL is also being setup at the conduit level. Using the interceptor can be handy when testing as well as when setting few extra properties which is not easy to set up at the generic HTTP Conduit Authorization Policy level. The interceptor properties are explained in the following sub-sections Authorization Policy As explained on this page, Authorization Policy typically needs to have its type set to "Negotiate" and its "authorization" property set to the name of the JAAS context. AuthorizationPolicy is set as a "policy" property on the interceptor, example: WebClient wc = WebClient.create("http://localhost:" + PORT + "/bookstore/books/123"); KerberosAuthOutInterceptor kbInterceptor = new KerberosAuthOutInterceptor(); AuthorizationPolicy policy = new AuthorizationPolicy(); policy.setAuthorizationType(HttpAuthHeader.AUTH_TYPE_NEGOTIATE); policy.setAuthorization("KerberosClientKeyTab"); kbInterceptor.setPolicy(policy); WebClient.getConfig(wc).getOutInterceptors().add(kbInterceptor); Book b = wc.get(Book.class); Configuring the service principal name By default, the service principal name is calculated by concatenating "HTTP", "/" and the name of the target host, example, when invoking on "http://localhost:8080/services", the service principal name is set to "HTTP/localhost". The "servicePrincipalName" and "realm" properties can be used to customize it, example, setting "servicePrincipalName" to "HTTP/www.mycompany.com" and realm to "services.org" will result in the "HTTP/www.mycompany....@services.org" service principal name being used. Using JAAS Configuration Both HTTPConduit and interceptor handlers need a "java.security.auth.login.config" system property set up. This property needs to point to the file containing the configuration of the specific Kerberos login module. Instead of setting this system property and maintaining a configuration file, one might want to use an implementation of javax.security.auth.login.Configuration and set it on the interceptor as a "loginConfig" property. Server configuration Credential Delegation Change Notification Preferences View Online | View Changes | Add Comment