Tomcat authentication using SPNEGO/Kerberos and delegation

apache tomcat kerberos spnego
Tony Lee picture Tony Lee · Dec 4, 2008 · Viewed 16.9k times · Source

Is there an apache module that implements Kerberos authentication for use by Tomcat and also supports Kerberos delegation?

I've already looked at mod_spnego and it throws away the SSPI context it creates only keeping the principal name. Instead, I'm looking for a module that would allow for the delegation of the ticket sent to Tomcat - that is, taking the service ticket sent for authentication and using it server side to access another service on behalf of the user.

EDIT: To clarify, I need to impersonate under Win32 using the GSS/SSPI context so when legacy code connects to another server, the delegated credentials are used.

Answer

Nico picture Nico · Jan 20, 2011

WAFFLE (Windows Authentication Functional Framework) now provides that feature starting from v1.4beta.

It provides a ServletFilter that uses native Windows APIs to authenticate the user, either using Basic or Negotiate authentication. The user then can be impersonated, and native APIs calls will be performed with the access token of the impersonated user.

Related questions

Difference between the Apache HTTP Server and Apache Tomcat?

What is the difference in terms of functionality between the Apache HTTP Server and Apache Tomcat? I know that Tomcat is written in Java and the HTTP Server is in C, but other than that I do not really know …

Read More
How to Detect cause of 503 Service Temporarily Unavailable error and handle it?

i am getting the error 503 Service Temporarily Unavailable many times in my application and i want to detect why this error occurs, how ? if there's a log file or something like that, since i am not familiar with apache. second …

Read More
Error during SSL Handshake with remote server

I have Apache2 (listening on 443) and a web app running on Tomcat7 (listening on 8443) on Ubuntu. I set apache2 as reverse proxy so that I access the web app through port 443 instead of 8443. Besides, I need to have SSL communication …

Read More