如何配置JBoss EAP 6.3 WebApp以进行Kerberos身份验证

2 回答

• 1

  看看我的SPNEGO演示项目https://github.com/kwart/spnego-demo

  尝试使其与链接的kerberos-using-apacheds项目一起使用 .

  如果您可以成功对ApacheDS Kerberos进行身份验证，请尝试更改配置（ krb5.conf 和 host 安全域中的 Krb5LoginModule 选项）以使用Active Directory进行身份验证 .

  常见的陷阱是错误的 SPN name . 服务主体必须采用 HTTP/hostname@REALM 格式（例如 HTTP/www.my-company.com@MY-COMPANY.COM ）

  您可以在我的旧演示文稿中找到其他一些提示 - http://www.slideshare.net/josef.cacek/dev-conf2013-ltkerberosas7

  回复于 2024-05-03T12:19:01+08:00
• 1

  谢谢你们 . 正如我之前所说，我们终于做到了 . 我们的解决方案是

  0）客户端计算机必须在域中，前提是域凭据不够 .

  创建密钥表（对于2008服务器是关键的kvno 0）：

  ktpass -out bbb.keytab -princ HTTP/bbb.cez.loc@CEZ.LOC -mapUser CEZ.LOC\bbb -mapOp set -pass password -ptype KRB5_NT_PRINCIPAL -kvno 0
  
  ktab  -k bbb.keytab -l -e -t
  Keytab name: bbb.keytab
  KVNO Timestamp      Principal
  0 1/1/70 1:00 AM HTTP/bbb.cez.loc@CEZ.LOC (23:RC4 with HMAC)
  

  停止JBoss并将其传输到JBoss配置文件夹下的linux . /opt/jboss-domain/standalone/configuration/bbb.keytab

  1）JBoss配置（standalone.xml）

  <system-properties>
    <property name="java.security.krb5.kdc" value="CEZ.LOC"/>
    <property name="java.security.krb5.realm" value="CEZ.LOC"/>
    <property name="java.net.debug" value="all"/>
    <property name="sun.security.krb5.debug" value="true"/>
  </system-properties>
  
  <security-domain name="host" cache-type="default">
    <authentication>
      <login-module code="Kerberos" flag="required">
         <module-option name="storeKey" value="true"/>
         <module-option name="useKeyTab" value="true"/>
         <module-option name="principal" value="HTTP/bbb.cez.loc@CEZ.LOC"/>
         <module-option name="keyTab" value="/opt/jboss-domain/standalone/configuration/bbb.keytab"/>
         <module-option name="doNotPrompt" value="true"/>
         <module-option name="debug" value="true"/>
      </login-module>
   </authentication>
  </security-domain>
  
  <security-domain name="SPNEGO" cache-type="default">
  <authentication>
    <login-module code="SPNEGO" flag="requisite">
       <module-option name="password-stacking" value="useFirstPass"/>
       <module-option name="serverSecurityDomain" value="host"/>
    </login-module>
  </authentication>
  </security-domain>
  

  2）Web App配置：

  web.xml:
  <security-constraint>
      <web-resource-collection>
          <web-resource-name>Restricted</web-resource-name>
          <url-pattern>/rest/*</url-pattern>
      </web-resource-collection>
      <auth-constraint>
          <role-name>*</role-name>
      </auth-constraint>
      <user-data-constraint>
          <transport-guarantee>NONE</transport-guarantee>
      </user-data-constraint>
  </security-constraint>
  <security-role>
      <role-name>*</role-name>
  </security-role>
  
  jboss-web.xml:
  <jboss-web>  
      <security-domain>java:/jaas/SPNEGO</security-domain>  
          <valve>  
          <class-name>org.jboss.security.negotiation.NegotiationAuthenticator</class-name>  
          </valve>  
      <context-root>kerberoes</context-root>  
  </jboss-web>
  
  jboss-deployment-structure.xml:
  <jboss-deployment-structure>  
    <deployment>  
      <dependencies>  
        <module name="org.jboss.security.negotiation" />  
      </dependencies>  
    </deployment>  
  </jboss-deployment-structure>
  

  3）在AD上重启密钥分发服务

  4）启动JBoss

  5）将JBoss Web服务器地址添加到可信主机，进入Intranet部分下的Internet设置 . 一切都从那一刻起作用 .

  Rest Web App可以使用它来获取有效的凭据：

  import java.text.SimpleDateFormat;
  import java.util.Calendar;
  import java.util.Date;
  import javax.ws.rs.GET;
  import javax.ws.rs.Path;
  import javax.ws.rs.core.Application;
  import javax.ws.rs.core.Context;
  import javax.ws.rs.core.Response;
  import javax.ws.rs.core.SecurityContext;
  
  @Path("/ping")
  public class Ping extends Application
  {
      @Context  
      private SecurityContext mySecurityContext;  
  
      @GET
      public Response doGET() 
      {
          try
          {
              Date now = Calendar.getInstance().getTime();        
              String reportDate = new SimpleDateFormat("yyyy/MM/dd HH:mm:ss").format(now);
              String returnString = "";
  
              // return ok json
              returnString = "Time: " + reportDate + "<br>\n";
              returnString += "User: " +
              mySecurityContext.getAuthenticationScheme() + " / " + 
              mySecurityContext.getUserPrincipal().getName() + "<br>\n";
             return Response.status(200).entity(returnString).build();
          }
          catch (Exception e)
          {
             return Response.status(500).entity("Exception! " +
             e.getMessage()).build();
          }
      }
  }
  

  回复于 2024-05-03T12:19:01+08:00