Tomcat authentication with Kerberos

[Wendy Smoak <ja...@wendysmoak.com>]

I have a standalone Tomcat 5.0 instance, and a third-party webapp that has 
support for authentication via LDAP.  Of course, we don't have LDAP, we have 
Kerberos.  It should be a simple matter to plug in a different Realm, right?

I'm finding it hard to believe that no one has done this (Tomcat 
authentication with Kerberos) yet, but Google just isn't turning up 
anything.

I started at the Realm HowTo [0] and found the JAASRealm section.

>From here it looks like I need to write my own LoginModule.  Except... there 
is com.sun.security.auth.module.Krb5LoginModule [1]. Can I just use that? 
(I thought we weren't supposed to use com.sun.* classes, but it's not as 
though I can write my *own* Kerberos LoginModule!)

After I (somehow) get the user authenticated with Kerberos, then I need to 
look in a [non-JDBC] database to get the Role information.  For User and 
Role, it looks like I can extend AbstractUser and AbstractRole... but where 
does the code go that would create instances?

In short, I'm confused.  Can anyone offer advice on what I need to do to 
make this work?  Or better yet, point to someone who has already done it? 
Thanks in advance!

[0] http://jakarta.apache.org/tomcat/tomcat-5.0-doc/realm-howto.html
[1] 
http://java.sun.com/j2se/1.4.2/docs/guide/security/jaas/spec/com/sun/security/auth/module/Krb5LoginModule.html

-- 
Wendy Smoak



---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org

Re: Tomcat authentication with Kerberos

[Wendy Smoak <ja...@wendysmoak.com>]

From: "Wendy Smoak" <ja...@wendysmoak.com>

>I have a standalone Tomcat 5.0 instance, and a third-party webapp that has 
>support for authentication via LDAP.  Of course, we don't have LDAP, we 
>have Kerberos.  It should be a simple matter to plug in a different Realm, 
>right?

Replying to myself for the benefit of the archives...

I came up with three examples of Kerberos authentication with Tomcat and 
JAASRealm:

   http://wiki.wsmoak.net/cgi-bin/wiki.pl?TomcatJspExamples

The first one is converting the 'jsp-examples' webapp to use Kerberos by 
adding/changing config files, no Java code is required.

>From there, I have a custom LoginModule that wraps Sun's Krb5LoginModule in 
order to add more roles to the Subject in the 'commit' method.  And finally, 
a custom Realm that extends JAASRealm and overrides 'authenticate' (for the 
same reason, to add roles).  I welcome comments on the code... it works, but 
considering that I'm only a week into learning about CMA and JAAS, I'm sure 
it could be improved.

I hope that once JSR 196 is final, someone will write a more robust 
LoginModule for Kerberos.  Failover would be nice... AFAICT you can only 
configure one kdc for Sun's Krb5LoginModule.

-- 
Wendy Smoak 


---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org