100 using spnego similarly like in enceladus to negotiate the auth #103
Conversation
TheLydonKing
force-pushed
the
feature/100-using-spnego-similarly-like-in-enceladus-to-negotiate-the-auth
branch
from
0574d72
to
0f11ae1
Compare
|
Excuse the messy code if anyone tries to read this, just trying to find a configuration that works. A lot of code is duplicated or in the wrong folders, this will be cleaned up once we get a working solution. So Far have tried multiple implementations such as those found in Enceladus as well as the official SPNEGO Documentation and Examples The current implementation is being called correctly in the security filterchain if "curl -i --negotiate -u : "http://localhost:9090/token/generate" is being called. The Security filterchain is also successfully skipping this auth process if Basic Auth is stipulated in the http message and then BasicAuth is used. The Current issue that's happening is currently getting a BadCredentials exception when trying to test it using MIT Kerberos on Windows. The Specific Error: Current Hypothesis on the issue:
Is anyone able to see a different error that I perhaps missed? |
api/src/main/scala/za/co/absa/loginsvc/rest/config/auth/ActiveDirectoryLDAPConfig.scala
Outdated
Show resolved
Hide resolved
api/src/main/scala/za/co/absa/loginsvc/rest/provider/kerberos/KerberosLdapUserSearch.scala
Outdated
Show resolved
Hide resolved
| if(KerberosConfig != null) | ||
| { | ||
| if(KerberosConfig.enableKerberos.isDefined) | ||
| { | ||
| val kerberos = new KerberosSPNEGOAuthenticationProvider(KerberosConfig) | ||
| val provider = new RestApiKerberosAuthenticationProvider(KerberosConfig.url, KerberosConfig.searchFilter, KerberosConfig.domain); | ||
| http.addFilterBefore( | ||
| RestApiKerberosAuthentication.spnegoAuthenticationProcessingFilter( | ||
| new ProviderManager(provider, kerberos.kerberosServiceAuthenticationProvider())), | ||
| classOf[BasicAuthenticationFilter]) | ||
| } | ||
| } | ||
|
|
||
| http.build() |
There was a problem hiding this comment.
I am surprised that it is necessary to force the the Kerberos...AuthProvider this way. Isn't this just another AuthenticationProvider just like ConfigUsersAuthenticationProvider and ActiveDirectoryLDAPAuthenticationProvider?
Perhaps it could be provided the same way as those are in AuthManagerConfig.authManager:47?
There was a problem hiding this comment.
So I'm forcing the Authmanager here so that I can try and debug any issues with the kerberos auth specifically. Just trying to make it easier to find the above issue that is being run into.
...src/main/scala/za/co/absa/loginsvc/rest/provider/kerberos/KerberosSPNEGOAuthentication.scala
Outdated
Show resolved
Hide resolved
|
Has anyone been able to test this code or find any glaring issues while I was away? I had a think about this during some time off and I don't understand what else is required to work or how to debug what the issue is, as I stated above there's a lot of different issues that could be present. |
JaCoCo code coverage report - scala:2.12.17
|
| @@ -48,6 +48,7 @@ class ConfigProviderTest extends AnyFlatSpec with Matchers { | |||
| activeDirectoryLDAPConfig.order shouldBe 2 | |||
| activeDirectoryLDAPConfig.serviceAccount.username shouldBe "CN=svc-ldap,OU=Users,OU=CORP Accounts,DC=corp,DC=dsarena,DC=com" | |||
There was a problem hiding this comment.
Let just maybe strip the dsarena.com domain from the tests?
Added Kerberos Auth that can be used:
curl -i --negotiate -u : "http://localhost:9090/token/generate"The Current implementation is kind of working but testing has been difficult to implement. Currently getting a Bad Credentials Exception. Not sure if it's the Ldap search, the Keytab or the kerberos ticket that is currently causing the issue.
closes #100