Package org.silverpeas.sso.kerberos.spnego

Class SpnegoHttpURLConnection

  • public final class SpnegoHttpURLConnection
extends Object
    This Class may be used by custom clients as a convenience when connecting to a protected HTTP server.

    This mechanism is an alternative to HTTP Basic Authentication where the HTTP server does not support Basic Auth but instead has SPNEGO support (take a look at KerberosSpnegoFilter).

    A krb5.conf and a login.conf is required when using this class. Take a look at the spnego.sourceforge.net documentation for an example krb5.conf and login.conf file. Also, you must provide a keytab file, or a username and password, or allowtgtsessionkey.

    Example usage (username/password): 

         public static void main(final String[] args) throws Exception {
         System.setProperty("java.security.krb5.conf", "krb5.conf");
         System.setProperty("sun.security.krb5.debug", "true");
         System.setProperty("java.security.auth.login.config", "login.conf");

         SpnegoHttpURLConnection spnego = null;

         try {
             spnego = new SpnegoHttpURLConnection("spnego-client", "dfelix", "myp@s5");
             spnego.connect(new URL("http://medusa:8080/index.jsp"));

             System.out.println(spnego.getResponseCode());

         } finally {
             if (null != spnego) {
                 spnego.disconnect();
             }
         }
     }

    Alternatively, if the server supports HTTP Basic Authentication, this Class is NOT needed and instead you can do something like the following: 

         public static void main(final String[] args) throws Exception {
         final String creds = "dfelix:myp@s5";

         final String token = Base64.encode(creds.getBytes());

         URL url = new URL("http://medusa:8080/index.jsp");

         HttpURLConnection conn = (HttpURLConnection) url.openConnection();

         conn.setRequestProperty(Constants.AUTHZ_HEADER
                 , Constants.BASIC_HEADER + " " + token);

         conn.connect();

         System.out.println("Response Code:" + conn.getResponseCode());
     }

    To see a working example and instructions on how to use a keytab, take a look at the creating a client keytab example.

    Finally, the SpnegoSOAPConnection class is another example of a class that uses this class.

    Author:
    Darwin V. Felix

    • Constructor Detail

      • SpnegoHttpURLConnection

        public SpnegoHttpURLConnection​(String loginModuleName)
                        throws LoginException
        Creates an instance where the LoginContext relies on a keytab file being specified by "java.security.auth.login.config" or where LoginContext relies on tgtsessionkey.
        Parameters:
        loginModuleName - name of the login module
        Throws:
        LoginException - if the authentication fails

      • SpnegoHttpURLConnection

        public SpnegoHttpURLConnection​(GSSCredential creds)
        Create an instance where the GSSCredential is specified by the parameter and where the GSSCredential is automatically disposed after use.
        Parameters:
        creds - credentials to use

      • SpnegoHttpURLConnection

        public SpnegoHttpURLConnection​(GSSCredential creds,
                               boolean dispose)
        Create an instance where the GSSCredential is specified by the parameter and whether the GSSCredential should be disposed after use.
        Parameters:
        creds - credentials to use
        dispose - true if GSSCredential should be diposed after use

      • SpnegoHttpURLConnection

        public SpnegoHttpURLConnection​(String loginModuleName,
                               String username,
                               String password)
                        throws LoginException
        Creates an instance where the LoginContext does not require a keytab file. However, the "java.security.auth.login.config" property must still be set prior to instantiating this object.
        Parameters:
        loginModuleName - the name of the login module
        username - the login id of the user
        password - the password of the user
        Throws:
        LoginException - if the authentication fails.