Package net.shibboleth.idp.authn.spnego.impl

Class SPNEGOAuthnController

java.lang.Object

net.shibboleth.idp.authn.spnego.impl.SPNEGOAuthnController

@Controller
@RequestMapping("%{idp.authn.spnego.externalAuthnPath:/Authn/SPNEGO}")
public class SPNEGOAuthnController
extends Object

MVC controller for managing the SPNEGO exchanges implemented as an ExternalAuthentication mechanism.

The handler methods either return contents back to the browser by returning an appropriate ResponseEntity<String> object, or they return back to the flow by calling ExternalAuthentication.finishExternalAuthentication(String, HttpServletRequest, HttpServletResponse) and returning null. On unrecoverable errors, an exception is thrown.

Field Summary

Fields

Modifier and Type	Field	Description
private StringDigester	cspDigester	CSP digest computation bean.
private IdentifierGenerationStrategy	cspNonceGenerator	CSP nonce generator bean.
private final org.slf4j.Logger	log	Class logger.
static final String	NTLM_UNSUPPORTED	Event ID indicating that NTLM was attempted by the client.
static final String	SPNEGO_NOT_AVAILABLE	Event ID indicating that SPNEGO is not supported by the client or is not available for other reasons.

Constructor Summary

Constructors

Constructor	Description
SPNEGOAuthnController()

Method Summary

Modifier and Type	Method	Description
ModelAndView	continueSPNEGO(String conversationKey, String authorizationHeader, HttpServletRequest httpRequest, HttpServletResponse httpResponse)	Process an input GSS token from the client and attempt to complete the context establishment process.
protected GSSContextAcceptor	createGSSContextAcceptor(SPNEGOContext spnegoCtx)	Create a new GSSContextAcceptor object.
private ModelAndView	createModelAndView(ProfileRequestContext profileRequestContext, HttpServletRequest httpRequest, HttpServletResponse httpResponse)	Create a ModelAndView object to return.
private void	finishWithError(String key, HttpServletRequest httpRequest, HttpServletResponse httpResponse, String error)	Finish the authentication process with an error.
private void	finishWithException(String key, HttpServletRequest httpRequest, HttpServletResponse httpResponse, Exception ex)	Finish the authentication process with an exception.
private void	finishWithSuccess(String key, HttpServletRequest httpRequest, HttpServletResponse httpResponse, KerberosPrincipal kerberosPrincipal)	Finish the authentication process successfully.
private SPNEGOContext	getSPNEGOContext(ProfileRequestContext prc)	Navigate to the SPNEGOContext in the context tree.
void	handleError(String conversationKey, HttpServletRequest httpRequest, HttpServletResponse httpResponse)	Respond to a user signaling that an error occurred.
private boolean	isNTLMMechanism(byte[] token)	Check if the GSS-API data represents an NTLM mechanism request.
private ModelAndView	replyUnauthorizedNegotiate(ProfileRequestContext profileRequestContext, HttpServletRequest httpRequest, HttpServletResponse httpResponse)	Send back an empty Negotiate challenge.
private ModelAndView	replyUnauthorizedNegotiate(ProfileRequestContext profileRequestContext, HttpServletRequest httpRequest, HttpServletResponse httpResponse, String base64Token)	Send back a Negotiate challenge token.
void	setCSPDigester(StringDigester digester)	Sets a StringDigester to use in computing CSP digests in views.
void	setCSPNonceGenerator(IdentifierGenerationStrategy strategy)	Sets an IdentifierGenerationStrategy to use in computing CSP nonces in views.
ModelAndView	startSPNEGO(String conversationKey, HttpServletRequest httpRequest, HttpServletResponse httpResponse)	Handle initial request that starts SPNEGO.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

SPNEGO_NOT_AVAILABLE

@Nonnull
@NotEmpty
public static final String SPNEGO_NOT_AVAILABLE

Event ID indicating that SPNEGO is not supported by the client or is not available for other reasons.

See Also:

• Constant Field Values

NTLM_UNSUPPORTED

@Nonnull
@NotEmpty
public static final String NTLM_UNSUPPORTED

Event ID indicating that NTLM was attempted by the client.

See Also:

• Constant Field Values

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

cspDigester

@Nullable
private StringDigester cspDigester

CSP digest computation bean.

cspNonceGenerator

@Nullable
private IdentifierGenerationStrategy cspNonceGenerator

CSP nonce generator bean.

Constructor Details

SPNEGOAuthnController

public SPNEGOAuthnController()

Method Details

setCSPDigester

public void setCSPDigester(@Nullable
 StringDigester digester)

Sets a StringDigester to use in computing CSP digests in views.

Parameters:

digester - digester to set

Since:

5.1.0

setCSPNonceGenerator

public void setCSPNonceGenerator(@Nullable
 IdentifierGenerationStrategy strategy)

Sets an IdentifierGenerationStrategy to use in computing CSP nonces in views.

Parameters:

strategy - nonce strategy

Since:

5.1.0

startSPNEGO

@RequestMapping(value="/{conversationKey}",
                method=GET)
@Nullable
public ModelAndView startSPNEGO(@PathVariable @Nonnull @NotEmpty
 String conversationKey,
 @Nonnull
 HttpServletRequest httpRequest,
 @Nonnull
 HttpServletResponse httpResponse)
                         throws ExternalAuthenticationException,
IOException

Handle initial request that starts SPNEGO.

Parameters:

conversationKey - the SWF conversation key

httpRequest - the HTTP request

httpResponse - the HTTP response

Returns:

the response view

Throws:

IOException - ...

ExternalAuthenticationException - ...

continueSPNEGO

@RequestMapping(value="/{conversationKey}",
                method=GET,
                headers="Authorization")
@Nullable
public ModelAndView continueSPNEGO(@PathVariable @Nonnull @NotEmpty
 String conversationKey,
 @RequestHeader("Authorization") @Nonnull @NotEmpty
 String authorizationHeader,
 @Nonnull
 HttpServletRequest httpRequest,
 @Nonnull
 HttpServletResponse httpResponse)
                            throws ExternalAuthenticationException,
IOException

Process an input GSS token from the client and attempt to complete the context establishment process.

Parameters:

conversationKey - the conversation key

authorizationHeader - the token from the client

httpRequest - the HTTP request

httpResponse - the HTTP response

Returns:

the response view

Throws:

ExternalAuthenticationException - ...

IOException - ...

handleError

@RequestMapping(value="/{conversationKey}/error",
                method=GET)
public void handleError(@PathVariable @Nonnull
 String conversationKey,
 @Nonnull
 HttpServletRequest httpRequest,
 @Nonnull
 HttpServletResponse httpResponse)
                 throws ExternalAuthenticationException,
IOException

Respond to a user signaling that an error occurred.

Parameters:

conversationKey - the conversation key

httpRequest - the HTTP request

httpResponse - the HTTP response

Throws:

IOException - ...

ExternalAuthenticationException - ...

finishWithSuccess

private void finishWithSuccess(@Nonnull @NotEmpty
 String key,
 @Nonnull
 HttpServletRequest httpRequest,
 @Nonnull
 HttpServletResponse httpResponse,
 @Nonnull
 KerberosPrincipal kerberosPrincipal)
                        throws ExternalAuthenticationException,
IOException

Finish the authentication process successfully.

Sets the attribute ExternalAuthentication.SUBJECT_KEY.

Parameters:

key - the conversation key

httpRequest - the HTTP request

httpResponse - the HTTP response

kerberosPrincipal - the Kerberos principal to return

Throws:

IOException - ...

ExternalAuthenticationException - ...

finishWithError

private void finishWithError(@Nonnull @NotEmpty
 String key,
 @Nonnull
 HttpServletRequest httpRequest,
 @Nonnull
 HttpServletResponse httpResponse,
 @Nonnull @NotEmpty
 String error)
                      throws ExternalAuthenticationException,
IOException

Finish the authentication process with an error.

Sets the attribute ExternalAuthentication.AUTHENTICATION_ERROR_KEY.

Parameters:

key - the conversation key

httpRequest - the HTTP request

httpResponse - the HTTP response

error - the error string/event to return

Throws:

IOException - ...

ExternalAuthenticationException - ...

finishWithException

private void finishWithException(@Nonnull @NotEmpty
 String key,
 @Nonnull
 HttpServletRequest httpRequest,
 @Nonnull
 HttpServletResponse httpResponse,
 @Nonnull
 Exception ex)
                          throws ExternalAuthenticationException,
IOException

Finish the authentication process with an exception.

Sets the attribute ExternalAuthentication.AUTHENTICATION_EXCEPTION_KEY.

Parameters:

key - the conversation key

httpRequest - the HTTP request

httpResponse - the HTTP response

ex - the exception that has been thrown

Throws:

IOException - ...

ExternalAuthenticationException - ...

getSPNEGOContext

@Nullable
private SPNEGOContext getSPNEGOContext(@Nonnull
 ProfileRequestContext prc)

Navigate to the SPNEGOContext in the context tree.

Parameters:

prc - profile request context

Returns:

the child context, or null

createGSSContextAcceptor

@Nonnull
protected GSSContextAcceptor createGSSContextAcceptor(@Nonnull
 SPNEGOContext spnegoCtx)
                                               throws GSSException

Create a new GSSContextAcceptor object. (Created in a separate method to support unit testing.)

Parameters:

spnegoCtx - the SPNEGOContext conteining the KerberosSettings

Returns:

a new GSSContextAcceptor

Throws:

GSSException - if an error occurs while creating the GSSContextAcceptor.

replyUnauthorizedNegotiate

@Nonnull
private ModelAndView replyUnauthorizedNegotiate(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 HttpServletRequest httpRequest,
 @Nonnull
 HttpServletResponse httpResponse)

Send back an empty Negotiate challenge.

Parameters:

profileRequestContext - profile request context

httpRequest - servlet request

httpResponse - servlet response

Returns:

a ModelAndView wrapping the response

replyUnauthorizedNegotiate

@Nonnull
private ModelAndView replyUnauthorizedNegotiate(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 HttpServletRequest httpRequest,
 @Nonnull
 HttpServletResponse httpResponse,
 @Nonnull
 String base64Token)

Send back a Negotiate challenge token.

Parameters:

profileRequestContext - profile request context

httpRequest - servlet request

httpResponse - servlet response

base64Token - challenge token to send back

Returns:

a ModelAndView wrapping the response

createModelAndView

@Nonnull
private ModelAndView createModelAndView(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 HttpServletRequest httpRequest,
 @Nonnull
 HttpServletResponse httpResponse)

Create a ModelAndView object to return.

Parameters:

profileRequestContext - profile request context

httpRequest - the HTTP request

httpResponse - the HTTP response

Returns:

the ModelAndView object

isNTLMMechanism

private boolean isNTLMMechanism(@Nonnull
 byte[] token)

Check if the GSS-API data represents an NTLM mechanism request.

Parameters:

token - token retrieved from the Authorization header.

Returns:

true iff it represents a NTLM mechanism