Migrate samples to spring-security 6.x

[StephMirabel]

It would be nice to have the spring-security-kerberos-samples working with spring-security version 6.x. Some adaptations are required. E.g. in WebSecurityConfig.filterChain() the following changes worked for me in the sec-server-spnego-form-auth sample:

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    KerberosAuthenticationProvider kerberosAuthenticationProvider = kerberosAuthenticationProvider();
    KerberosServiceAuthenticationProvider kerberosServiceAuthenticationProvider = kerberosServiceAuthenticationProvider();
    ProviderManager providerManager = new ProviderManager(kerberosAuthenticationProvider,
                kerberosServiceAuthenticationProvider);

    http
        .authorizeHttpRequests((authz) -> authz
            .requestMatchers("/", "/home").permitAll()
            .anyRequest().authenticated()
        )
        .exceptionHandling(Customizer.withDefaults())
                .httpBasic(httpSecurityHttpBasicConfigurer ->
                        httpSecurityHttpBasicConfigurer.authenticationEntryPoint(spnegoEntryPoint()))
                .formLogin()
                        .loginPage("/login").permitAll()
                .and()
        .logout()
               .permitAll()
               .and()
        .authenticationProvider(kerberosAuthenticationProvider())
        .authenticationProvider(kerberosServiceAuthenticationProvider())
        .addFilterBefore(spnegoAuthenticationProcessingFilter(providerManager),
                    BasicAuthenticationFilter.class);
    return http.build();
}

[rwinch]

Duplicate of gh-203

[StephMirabel]

Thanks a lot for the update! I confirm that the following solution within filterChain() based on your updated sample, is working fine. Since I'm securing a REST server, I don't need login/logout forms. However, I need to disable CSRF to allow POST operations.

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    ProviderManager providerManager = new ProviderManager(kerberosAuthenticationProvider(),
        kerberosServiceAuthenticationProvider());

    http
      .authorizeHttpRequests((authz) -> authz
          // do not authenticate clients on the /info endpoint
          .requestMatchers("/info").permitAll()
          // always permit /error endpoint (default redirect for rendering error messages)
          .requestMatchers("/error").permitAll()
          // require authentication without role constraint on any other endpoint
          .anyRequest().authenticated())

      // disabling cross site request forgery filter to allow POST requests
      .csrf((csrf) -> csrf.disable())

      // exception handling for Kerberos negotiate challenge to the client
      .exceptionHandling(((exceptions) -> exceptions
          .authenticationEntryPoint(spnegoEntryPoint())))

      // add Kerberos authenticator knowing the expected users
      .authenticationProvider(kerberosAuthenticationProvider())

      // add validator of Kerberos service tickets
      .authenticationProvider(kerberosServiceAuthenticationProvider())

      // add filter which processes the "Authorization: Negotiate" header sent by the client
      // containing the service ticket
      .addFilterBefore(
          spnegoAuthenticationProcessingFilter(providerManager),
          BasicAuthenticationFilter.class);
    return http.build();
    }