SSPIs and SPNEGO

Question

Robert,
In a previous post you said,
"I've said this elsewhere on this forum, but in case you missed it, in certain
cases you might be forced to implement a servlet filter rather than use the SSPIs.
My case was using identity assertion with SPNEGO where you need to send back a
response to the browser which in turn sends back a token to the server."
Could you please explain how do we do SSPI for SPNEGO? I have a requirement where
we need to pass the credentials from WL portal to IIS server to access content
on IIS. Right now, as a temporary solution, we are doing https://uid:[email protected]
I am new to security and JAAS. If you could please give me pointers to accomplish
this in a cleaner way, I would really appreciate it.
Thanks,
Adam

Answer 1

Robert,
Thats really awesome. Can we get this discussion offline from here? Could you
please e-mail me at [email protected]?
Thanks,
Adam
Robert Greig <[email protected]> wrote:
Adam Gilchrist wrote:
Robert,
In a previous post you said,
"I've said this elsewhere on this forum, but in case you missed it,in certain
cases you might be forced to implement a servlet filter rather thanuse the SSPIs.
My case was using identity assertion with SPNEGO where you need tosend back a
response to the browser which in turn sends back a token to the server."
Could you please explain how do we do SSPI for SPNEGO? I have a requirementwhere
we need to pass the credentials from WL portal to IIS server to accesscontent
on IIS. Right now, as a temporary solution, we are doing https://uid:[email protected]@mydomain.com.
First, here's how to do it in the "standard" web browser case (IE client
talking to WLS).
1) Don't use the WLS SSPIs. You don't have access to the http response
therefore it is not easy (perhaps not possible although maybe there are
evil hacks that I haven't come up with!).
2) Download the SPNEGO RFC. You'll need an ASN parser (unless you want
to do the encoding manually - I don't recommend that unless you're
familiar with ASN). Create an SPNEGO grammar your parser can understand
and generate java code from the grammar. I used the cryptix parser (open
source) but note that it had some bugs I had to fix first.
3) Write a servlet filter. It should send back 403 responses in order
to
get the base 64 encoded SPNEGO token (see the RFC for details). When
you
have a token, get the GSS initial context token from it and use the
GSSAPI to validate it. Then send back the appropriate response, having
put the appropriate details into the session so you don't have to
perform this for every request!
Second - I plan on open sourcing what I have done and writing an article
on it. Maybe I'm just sad and lonely but I certainly found it
interesting to do (having never done anything in this area before) and
I
found that it was not an area that is either mature or well documented.
This might be of some use to you. I am currently trying to get
permission from my employer to do this (I work for an investment bank
hence this is not entirely straightforward but I do now have agreement
in principle).
Third - to cover your case. You need to create an SPNEGO initial context
token (see the spec for details). This should be quite easy once you
have the ASN parser (just use the GSSAPI to get the underlying context
token). You will have to implement SPNEGO from a client-side perspective
however that should be easy (expect a 403 response from the server, then
put in the base 64 encoded SPNEGO token into a particular request header).
I am new to security and JAAS. If you could please give me pointersto accomplish
this in a cleaner way, I would really appreciate it.Do you need to use SPNEGO here? If you can write an ASP page to service
all requests then so long as you are happy using HTTPS you could put
the
username into a POST parameter. Or must you directly access the content
without going through an intermediary page? If direct username isn't
possible then you could even just ignore SPNEGO and put in the base 64
intial context token (which you can process using the Windows SSPI APIs).
I hope this is of some use to you.
Robert