Closed StephMirabel closed 3 months ago
Duplicate of gh-203
Thanks a lot for the update! I confirm that the following solution within filterChain()
based on your updated sample, is working fine. Since I'm securing a REST server, I don't need login/logout forms. However, I need to disable CSRF to allow POST operations.
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
ProviderManager providerManager = new ProviderManager(kerberosAuthenticationProvider(),
kerberosServiceAuthenticationProvider());
http
.authorizeHttpRequests((authz) -> authz
// do not authenticate clients on the /info endpoint
.requestMatchers("/info").permitAll()
// always permit /error endpoint (default redirect for rendering error messages)
.requestMatchers("/error").permitAll()
// require authentication without role constraint on any other endpoint
.anyRequest().authenticated())
// disabling cross site request forgery filter to allow POST requests
.csrf((csrf) -> csrf.disable())
// exception handling for Kerberos negotiate challenge to the client
.exceptionHandling(((exceptions) -> exceptions
.authenticationEntryPoint(spnegoEntryPoint())))
// add Kerberos authenticator knowing the expected users
.authenticationProvider(kerberosAuthenticationProvider())
// add validator of Kerberos service tickets
.authenticationProvider(kerberosServiceAuthenticationProvider())
// add filter which processes the "Authorization: Negotiate" header sent by the client
// containing the service ticket
.addFilterBefore(
spnegoAuthenticationProcessingFilter(providerManager),
BasicAuthenticationFilter.class);
return http.build();
}
It would be nice to have the spring-security-kerberos-samples working with spring-security version 6.x. Some adaptations are required. E.g. in
WebSecurityConfig.filterChain()
the following changes worked for me in the sec-server-spnego-form-auth sample: