GSSAPI/Negotiate implementation for Tomcat

[leifj]

I wrote a GSSAPI/Negotiate implementation based on the GSSAPI implementation in Java 1.5. It has been tested in JBoss 4.x. Since Negotiate doesn't follow the same pattern of authentication as other mechs (BASIC, DIGEST, etc) Negotiate can't be implemented in the standard JBoss authentication framework. I have tried to implement credentials-forwarding using my understanding of the Subject usage pattern but I would like feedback on this!

Mor info and downloads at:
http://devel.it.su.se/pub/jsp/polopoly.jsp?d=1047&a=3780

[starksm64]

This really fits in the design discussions occuring here:

http://www.jboss.com/index.html?module=bb&op=viewforum&f=171

For example:

http://www.jboss.com/index.html?module=bb&op=viewtopic&t=73020
http://www.jboss.com/index.html?module=bb&op=viewtopic&t=72264
http://www.jboss.com/index.html?module=bb&op=viewtopic&t=73024

[anil.saldhana]

I see a lot of overlap between GSS and JSR-196 [Java SPI for authentication]. (Does GSS mandate kerberos support? ).

We need to see how the usecases for GSS you are talking about for Tomcat , aligns with the discussion happening in the security design forums.

Please visit the links, Scott posted and post a detailed usecase using gss/negotiate protocol for Tomcat. Provide as much detail as possible. This will help us see the intersection points to our current thoughts/plans.

[leifj]

I see a lot of overlap between GSS and JSR-196 [Java SPI for authentication]. (Does GSS mandate kerberos support? ).

No GSSAPI is a generic security framework. Right now there are two major implementations of GSSAPI - Kerberos5 and GSI, the GRID security infrastructure. GSI is the security framework used in all GRID middleware including the Globus toolkit.

[anil.saldhana]

What I meant was the notion of Context and Config used in both GSS and JSR-196. These can be generalized in JBoss to an higher level...