如何在基于Java的自定义web服务器中集成windows身份验证（SSO）？

Question

我有一个基于Java的自定义Web服务器应用程序，我需要支持单点登录。我对这个问题进行了研究，发现我可以使用JAAS来实现SSO。我已经将我的超文本传输协议服务器配置为接受身份验证握手过程，因此我将登录用户身份验证编码在我的java应用程序中，并将我的JAAS身份验证功能传递给它。
现在，我需要使用我的域控制器对用户进行身份验证。因此，我使用jaas.conf文件来定义LoginModule：

SSOAUTH {
  com.sun.security.auth.module.Krb5LoginModule required  
  useKeyTab=false
  storeKey=true
  useTicketCache=false
  debug=true;
};

如您所见，我想使用Kerberos协议。
第一个问题是：我需要为我的域控制器进行一些安装/配置来支持此协议吗？

这是我的Web服务器应用程序中的java代码，它将使用JAAS处理整个身份验证过程：

public class LDAPClient
{
   private static final String LOGIN_MODULE_NAME = "SSOAUTH";


/**
 * Constructor
 * @param domain
 * @param ldapServer
 * @param jaasConfigPath
 */
public LDAPClient(String domain, String ldapServer, String jaasConfigPath)
{
    System.setProperty("sun.security.krb5.debug", "true");
    System.setProperty("java.security.krb5.realm", domain);
    System.setProperty("java.security.krb5.kdc", ldapServer); // LDAP active directory server name
    System.setProperty("javax.security.auth.useSubjectCredsOnly", "true");
    System.setProperty("java.security.auth.login.config", jaasConfigPath); // path to the jaas.conf file.
}


/**
 * Authenticates the given kerberos token and returns the client principal.
 *
 * @param argKerberosTokenAsBase64 The kerberos content token.
 * @return
 * @throws Exception
 */
public String authenticate(String argKerberosTokenAsBase64) throws Exception
{
    BASE64Decoder decoder = new BASE64Decoder();
    byte[] kerberosToken = decoder.decodeBuffer(argKerberosTokenAsBase64.substring("Negotiate ".length()));
    String clientName;

    try
    {
        // Login to the KDC and obtain subject for the service principal
        Subject subject = createServiceSubject(argKerberosTokenAsBase64);
        if (subject != null)
        {
            clientName = acceptSecurityContext(subject, kerberosToken).toUpperCase();
            System.out.println("Security context successfully initialized!");
        }
        else
        {
            throw new Exception("Unable to obtain kerberos service context");
        }
    }
    catch (Throwable throwable)
    {
        System.out.println("Token: " + argKerberosTokenAsBase64);
        throwable.printStackTrace();
        throw new Exception(throwable);
    }

    return clientName;
}

/**
 * Creates service subject based on the service principal and service
 * password.
 *
 * @param password
 * @return
 * @throws LoginException
 */
private static Subject createServiceSubject(String password)
        throws LoginException
{
    // "Client" references the JAAS configuration in the jaas.conf file.
    LoginContext loginCtx = new LoginContext(LOGIN_MODULE_NAME, new LoginCallbackHandler(password));
    loginCtx.login();
    return loginCtx.getSubject();
}

/**
 * Completes the security context initialisation and returns the client
 * name.
 * @param argSubject
 * @param serviceTicket
 * @return
 * @throws GSSException
 */
private static String acceptSecurityContext(Subject argSubject, final byte[] serviceTicket) throws GSSException
{
    // Accept the context and return the client principal name.
    return (String) Subject.doAs(argSubject, new PrivilegedAction()
    {
        public Object run()
        {
            try
            {
                // Identify the server that communications are being made
                // to.
                GSSManager manager = GSSManager.getInstance();
                GSSContext context = manager.createContext((GSSCredential) null);
                context.acceptSecContext(serviceTicket, 0, serviceTicket.length);
                return context.getSrcName().toString();
            }
            catch (GSSException exp)
            {
                throw new RuntimeException(exp);
            }
        }
    });
}

}

我有以下LoginException：javax。安全授权。登录名。LoginException：预身份验证信息无效（24）

我正在将kerberos身份验证令牌传递给LoginContext，请参阅对createServiceSubject（）的调用，以便获取主题，是否正确，或者我在这里遗漏了什么

这是System.out调试错误的一部分：

>>>KRBError:
 sTime is Wed Feb 12 14:29:17 IST 2014 1392208157000
 suSec is 301542
 error code is 25
 error Message is Additional pre-authentication required
 realm is DOMAIN.LOCAL
 sname is krbtgt/DOMAIN.LOCAL
 eData provided.
 msgType is 30
>>>Pre-Authentication Data:
 PA-DATA type = 19
 PA-ETYPE-INFO2 etype = 23
 PA-ETYPE-INFO2 salt = null
 salt for 3 is DOMAIN.LOCALskadar
>>>Pre-Authentication Data:
 PA-DATA type = 2
 PA-ENC-TIMESTAMP
>>>Pre-Authentication Data:
 PA-DATA type = 16
>>>Pre-Authentication Data:
 PA-DATA type = 15
AcquireTGT: PREAUTH FAILED/REQUIRED, re-send AS-REQ
Updated salt from pre-auth = DOMAIN.LOCALskadar
>>>KrbAsReq salt is DOMAIN.LOCALskadar
Pre-Authenticaton: find key for etype = 3
AS-REQ: Add PA_ENC_TIMESTAMP now
>>> EType: sun.security.krb5.internal.crypto.DesCbcMd5EType

Answer 1

如果您在Tomcat上，请为Apache Tomcat 6使用SPNEGO/Kerberos验证器和Active Directory域。