如何为Tomcat设置透明的kerberos认证？

Question

$ java -version
java version "1.7.0_65"
OpenJDK Runtime Environment (IcedTea 2.5.1) (7u65-2.5.1-5~deb7u1)
OpenJDK 64-Bit Server VM (build 24.65-b04, mixed mode)

$ java -cp /usr/share/tomcat7/lib/catalina.jar org.apache.catalina.util.ServerInfo
Server version: Apache Tomcat/7.0.28
Server built:   Apr 8 2014 08:47:08
Server number:  7.0.28.0
OS Name:        Linux
OS Version:     3.2.0-4-amd64
Architecture:   amd64
JVM Version:    1.7.0_65-b32
JVM Vendor:     Oracle Corporation

Answer 1

从“Web应用程序”一节逐步开始：

步骤1:$catalina_home/ / /meta-inf/context.xml

<Valve className="org.apache.catalina.authenticator.SpnegoAuthenticator" />

步骤2:$CATALINA_HOME/ / /WEB-INF/web.xml

<security-constraint>
    <display-name>All users</display-name>
    <web-resource-collection>
      <web-resource-name>All requests</web-resource-name>
      <url-pattern>/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>*</role-name>
    </auth-constraint>
  </security-constraint>

  <security-role>
    <description>All users</description>
    <role-name>*</role-name>
  </security-role>

  <login-config>
    <auth-method>SPNEGO</auth-method>
  </login-config>

<Host name="somesrv.domain.local" appBase="somesrv"
        unpackWARs="true" autoDeploy="true">
    ...
    <Realm className="org.apache.catalina.realm.JNDIRealm"
           connectionURL="ldap://pdc.domain.local:389"
           alternateURL="ldap://bdc.domain.local:389"
           connectionName="CN=tomcat,OU=Services,DC=domain,DC=local"
           connectionPassword="qwerty"
           referrals="follow"
           userBase="OU=someou,DC=domain,DC=local"
           userSearch="(sAMAccountName={0})"
           userSubtree="true"
           roleBase="OU=Security Groups,DC=domain,DC=local"
           roleName="name"
           roleSubtree="true"
           roleSearch="(member={0})" />
</Host>