Is it possible to do optional kerberos authentication?
What I want is: if the client (browser) is not on the domain it is redirected to a username/password web login. Otherwise it will do SPNEGO do Kerberos authentication.
Is there is any solution for this? If Yes what are the configurations we required?
Yes. You can do this. When the server receives an unauthenticated request, it replies with a 401 ("Authorization required") which is a header WWW-Authenticate set to Negotiate. If the Kerberos authentication fails, the server also send a 401 back.
Whenever the client fails to authenticate (for example, if it doesn't have any Kerberos credentials, or the authentication failed) the 401 page content will be shown.
So, to solve your problem, all you have to do is to include the login page on the 401 page.
If you're need redirect to login page after server receives an unauthenticated request (like Elias Mårtenson said), you need configure spring security like this:
<?xml version="1.0" encoding="UTF-8" ?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:sec="http://www.springframework.org/schema/security"
xmlns:context="http://www.springframework.org/schema/context"
xsi:schemaLocation="http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.2.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd
http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd">
<sec:http entry-point-ref="spnegoEntryPoint" >
<sec:custom-filter ref="spnegoAuthenticationProcessingFilter" position="BASIC_AUTH_FILTER" />
<sec:form-login login-page="/login.xhtml" default-target-url="/index.xhtml" />
<sec:access-denied-handler error-page="/login.xhtml" />
</sec:http>
<bean id="spnegoAuthenticationProcessingFilter" class="org.springframework.security.extensions.kerberos.web.SpnegoAuthenticationProcessingFilter">
<property name="authenticationManager" ref="authenticationManager" />
</bean>
<sec:authentication-manager alias="authenticationManager">
<sec:authentication-provider ref="kerberosServiceAuthenticationProvider" /> <!-- Used with SPNEGO -->
<sec:authentication-provider ref="kerberosAuthenticationProvider"/> <!-- Used with form login -->
</sec:authentication-manager>
<bean id="kerberosAuthenticationProvider" class="org.springframework.security.extensions.kerberos.KerberosAuthenticationProvider">
<property name="kerberosClient">
<bean class="org.springframework.security.extensions.kerberos.SunJaasKerberosClient">
<property name="debug" value="true"/>
</bean>
</property>
<property name="userDetailsService" ref="customUserDetailsService"/>
</bean>
<bean id="kerberosServiceAuthenticationProvider" class="ru.rfcfefa.epod.common.base.interceptor.CustomKerberosServiceAuthenticationProvider">
<property name="ticketValidator">
<bean class="org.springframework.security.extensions.kerberos.SunJaasKerberosTicketValidator">
<property name="servicePrincipal" value="HTTP/serverName.domain.local" />
<!-- Setting keyTabLocation to a classpath resource will most likely not work in a Java EE application Server -->
<!-- See the Javadoc for more information on that -->
<property name="keyTabLocation" value="http-server.keytab" />
<property name="debug" value="true" />
</bean>
</property>
<property name="userDetailsService" ref="customUserDetailsService" />
</bean>
<bean class="org.springframework.security.extensions.kerberos.GlobalSunJaasKerberosConfig">
<property name="debug" value="true" />
<property name="krbConfLocation" value="krb5.conf"/>
</bean>
</beans>
[libdefaults]
default_realm = DOMAIN.LOCAL
default_tkt_enctypes = aes128-cts rc4-hmac des3-cbc-sha1 des-cbc-md5 des-cbc-crc
default_tgs_enctypes = aes128-cts rc4-hmac des3-cbc-sha1 des-cbc-md5 des-cbc-crc
permitted_enctypes = aes128-cts rc4-hmac des3-cbc-sha1 des-cbc-md5 des-cbc-crc
[realms]
DOMAIN.LOCAL = {
kdc = serverAD.domain.local
default_domain = DOMAIN.LOCAL
}
[domain_realm]
.DOMAIN.LOCAL = DOMAIN.LOCAL
if you're using Apache, the Cosign module can be adjusted to do this with some JavaScript on the (normal, in-band auth) login page, and a second path to the login controller that's Kerberos authenticated. The "regular" login form tests if access to a Kerberos-protected resource succeeds, and redirects the browser to complete login automatically if so.
To my mind the above seems a bit backwards, and it's objectionable to add a JavaScript requirement where it's not strictly necessary. I think Elias Mårtenson's answer has it right - attempt Kerberos and fall back to in-band login within an HTTP 401 response - but whether it's possible depends on your environment.
