Question

Here’s the scenario. I am code running on a web server in an AD domain. Some client has connected to me. How do I get that client’s username, without having the client fill out a form in their browser? Must use Java technologies on the web server side.

edit:

I ended up using the Spring Security Negotiate Filter as described at the below link. There is a tutorial available. Using request.getPrincipal().getName() from within a servlet gives the username.

http://waffle.codeplex.com/

Answer 1

You need to set up the Spring Security Kerberos extension – this is the only out of the box way to do what you’re describing in Spring Security 3. This supports SPNEGO negotiation, but requires some amount of setup on the server (and knowledge of how SPNEGO and Kerberos works).

There’s not much documentation – but Mike’s sample applications that he ships with 1.0M2 are great, and cover most of the common scenarios, including automated SPNEGO authentication.

The key thing for SPNEGO is to set up a custom AuthenticationEntryPoint – you’ll need to do this with a custom spring bean as follows:

<bean id="kerbEntryPoint" class="org.springframework.security.extensions.kerberos.web.SpnegoEntryPoint" />

<bean id="kerbAuthenticationProcessingFilter" class="org.springframework.security.extensions.kerberos.web.SpnegoAuthenticationProcessingFilter">
    <property name="authenticationManager" ref="authenticationManager" />
</bean>

… there are more beans that’ll be required besides these (again, refer to the samples w/the Kerberos extension). Post back if you get further along with Spring Security or if you want exact details (since there are a number of beans / config bits involved, some knowledge of your configuration would be helpful, such as whether you are using the <http> namespace style or not).

Other than this option, you would have to set up a similar type of SPNEGO auth (such as using WAFFLE, as you suggest) – other SO questions cover this pretty well.

Finally, you could possibly front Tomcat with another web server which supports SPNEGO or NTLM better, such as Microsoft IIS or Apache Web Server with mod_spnego.

Hopefully one of these ideas would work for you!