You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@directory.apache.org by Enrique Rodriguez <en...@gmail.com> on 2007/06/09 05:37:37 UTC
[Kerberos] Kerberos + Wicket, part 2
Hi, Directory developers,
I committed an example Wicket web app to my personal sandbox [1]. I
put it in my sandbox because it now requires JDK 1.6 to work. This
example app used to work with Firefox, but it appears Firefox behavior
has changed in such a way that JDK 1.5 no longer works. I pinged some
colleagues and I'm still researching if there is a work-around.
Firefox used to send a "GSSAPI/Kerberos v5 OID" and at some point in
the last 6 months it started sending a "SPNEGO OID." The problem is
that Java 1.5 only supports "GSSAPI/Kerberos v5" and so you get an
exception from jGSS when the SPNEGO OID shows up. However, with Java
1.6 "SPNEGO" is handled properly. This causes a compatibility issue
for us since as a project we are on 1.5 hence the commit to my
sandbox. I'm still trying to determine whether there is a way to
configure which OID (mechanism) Firefox uses in the response.
Firefox used to send 1.2.840.113554.1.2.2 (GSSAPI/Kerberos v5).
Firefox now sends 1.3.6.1.5.5.2 (SPNEGO), along with Kerberos as a
negotiable mechanism. This is beneficial behavior for MS
compatibility, just not for JDK compatiblity.
- 1.2.840.113554.1.2.2 Kerberos v5 (MIT)
- 1.3.5.1.5.2 Kerberos v5 (mechanism)
- 1.2.840.48018.1.2.2 Kerberos v5 (MS)
I see this behavior with Firefox 1.5.0.12 and 2.0.0.1.
Other than that, if you run the example web app with JDK 1.6 it works
great. I added the minimum of web pages around it to show how you
could authenticate a session. Also, criticism of my Wicket skillz is
welcome; I'm a bit new to it.
Enrique
[1] http://svn.apache.org/repos/asf/directory/sandbox/erodriguez/kerberos-spnego/
Re: [Kerberos] Kerberos + Wicket, part 2
Posted by Emmanuel Lecharny <el...@apache.org>.
Enrique Rodriguez a écrit :
> Other than that, if you run the example web app with JDK 1.6 it works
> great.
Juts had to modify the pom.xml, removing the 'provided' scope for this
dependency :
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>nlog4j</artifactId>
<version>1.2.25</version>
<!--scope>provided</scope-->
</dependency>
Otherwise, you get an exception because nlog4j.jar is not packaged
withing the war.
I didn't committed it yet, still testing the app.
Thanks for the webapp, Enrique !
Emmanuel
Re: [Kerberos] Kerberos + Wicket, part 2
Posted by Enrique Rodriguez <en...@gmail.com>.
On 6/11/07, Alex Karasulu <ak...@apache.org> wrote:
> ...
> There is also a jetty plugin for mvn that can be used to run this via the
> command line.
> I don't know if requiring an IDE for people to play with it is going to
> promote them
> to just checkout and run it. This means some setup work to get the project
> into
> Eclipse if not downloading it. Not everyone uses Eclipse.
I setup the POM to support 'mvn jetty:run'.
Enrique
Re: [Kerberos] Kerberos + Wicket, part 2
Posted by Alex Karasulu <ak...@apache.org>.
On 6/11/07, Enrique Rodriguez <en...@gmail.com> wrote:
>
> On 6/9/07, Emmanuel Lecharny <el...@apache.org> wrote:
> > Enrique Rodriguez a écrit :
> I updated the doco, as with the GSSAPI doc, to have more details and
> to use config for ApacheDS 1.5.1. Also, there is a Start class that
> you should be able to run in Eclipse as a Java application and have it
> start an embedded Jetty server and bind to 8080. I think that is the
> easiest way to get this example running and skip the WAR deployment.
> This is why the POM has the Jetty/Tomcat/nlog4j setup the way it is.
> I recommend trying it in Eclipse first. Don't forget to configure the
> JRE to be 1.6 for this specific Eclipse project. I couldn't figure
> out how to get the mvn eclipse plugin to set this automatically and,
> trust me, I tried.
There is also a jetty plugin for mvn that can be used to run this via the
command line.
I don't know if requiring an IDE for people to play with it is going to
promote them
to just checkout and run it. This means some setup work to get the project
into
Eclipse if not downloading it. Not everyone uses Eclipse.
Alex
Re: [Kerberos] Kerberos + Wicket, part 2
Posted by Enrique Rodriguez <en...@gmail.com>.
On 6/9/07, Emmanuel Lecharny <el...@apache.org> wrote:
> Enrique Rodriguez a écrit :
> > Firefox used to send a "GSSAPI/Kerberos v5 OID" and at some point in
> > the last 6 months it started sending a "SPNEGO OID." The problem is
> > that Java 1.5 only supports "GSSAPI/Kerberos v5" and so you get an
> > exception from jGSS when the SPNEGO OID shows up. However, with Java
> > 1.6 "SPNEGO" is handled properly. This causes a compatibility issue
> > for us since as a project we are on 1.5 hence the commit to my
> > sandbox. I'm still trying to determine whether there is a way to
> > configure which OID (mechanism) Firefox uses in the response.
>
> from what I have seen on web lately, I'm not sure. May be by browsing FF
> code source ?
Yeah, I started poking around with lxr and bonsai and I asked a
Mozilla colleague to help when he gets a chance.
> ...
> Ok. Just a question, not sure is it relevant : if we have our own SPNEGO
> codec, would it help ? (because we have this codec somewhere, but sandboxed)
I'm afraid that in addition to any codecs there is always protocol
workflow and so this would turn into a sizable undertaking.
> ...
> Np, this is just a demo/test apps. As soon as it works ... I bet we
> would like to create a more serious demonstrator some time, but I don't
> know how we can set it up on directory.a.o.
I updated the doco, as with the GSSAPI doc, to have more details and
to use config for ApacheDS 1.5.1. Also, there is a Start class that
you should be able to run in Eclipse as a Java application and have it
start an embedded Jetty server and bind to 8080. I think that is the
easiest way to get this example running and skip the WAR deployment.
This is why the POM has the Jetty/Tomcat/nlog4j setup the way it is.
I recommend trying it in Eclipse first. Don't forget to configure the
JRE to be 1.6 for this specific Eclipse project. I couldn't figure
out how to get the mvn eclipse plugin to set this automatically and,
trust me, I tried.
Enrique
Re: [Kerberos] Kerberos + Wicket, part 2
Posted by Emmanuel Lecharny <el...@apache.org>.
Enrique Rodriguez a écrit :
> Hi, Directory developers,
>
> I committed an example Wicket web app to my personal sandbox [1]. I
> put it in my sandbox because it now requires JDK 1.6 to work. This
> example app used to work with Firefox, but it appears Firefox behavior
> has changed in such a way that JDK 1.5 no longer works. I pinged some
> colleagues and I'm still researching if there is a work-around.
oh...
>
> Firefox used to send a "GSSAPI/Kerberos v5 OID" and at some point in
> the last 6 months it started sending a "SPNEGO OID." The problem is
> that Java 1.5 only supports "GSSAPI/Kerberos v5" and so you get an
> exception from jGSS when the SPNEGO OID shows up. However, with Java
> 1.6 "SPNEGO" is handled properly. This causes a compatibility issue
> for us since as a project we are on 1.5 hence the commit to my
> sandbox. I'm still trying to determine whether there is a way to
> configure which OID (mechanism) Firefox uses in the response.
from what I have seen on web lately, I'm not sure. May be by browsing FF
code source ?
>
> Firefox used to send 1.2.840.113554.1.2.2 (GSSAPI/Kerberos v5).
> Firefox now sends 1.3.6.1.5.5.2 (SPNEGO), along with Kerberos as a
> negotiable mechanism. This is beneficial behavior for MS
> compatibility, just not for JDK compatiblity.
>
> - 1.2.840.113554.1.2.2 Kerberos v5 (MIT)
> - 1.3.5.1.5.2 Kerberos v5 (mechanism)
> - 1.2.840.48018.1.2.2 Kerberos v5 (MS)
>
> I see this behavior with Firefox 1.5.0.12 and 2.0.0.1.
Ok. Just a question, not sure is it relevant : if we have our own SPNEGO
codec, would it help ? (because we have this codec somewhere, but sandboxed)
>
> Other than that, if you run the example web app with JDK 1.6 it works
> great. I added the minimum of web pages around it to show how you
> could authenticate a session.
Ok, this is just fine !
> Also, criticism of my Wicket skillz is
> welcome; I'm a bit new to it.
Np, this is just a demo/test apps. As soon as it works ... I bet we
would like to create a more serious demonstrator some time, but I don't
know how we can set it up on directory.a.o.
>
> Enrique
>
> [1]
> http://svn.apache.org/repos/asf/directory/sandbox/erodriguez/kerberos-spnego/
>
>