Combining SPNEGO with custom made authentication?

[chausberger]

Hello

we want to integrate SPNEGO via JBoss Negotiation into our software.

Currently our systems works like this:
We set an apache in front of JBoss and use Basic authentication. If the users goes straight to the JBoss Webserver without going over Apache, a login formular is presentet.

To check this, the software checks the HTTP header if Basis authentification was done and if not presents the login formular.
This is all done in a Struts 1.3 action.

We now plan to to the same with SPNEGO. That is, if SPNEGO works, no login formular will be shown. If SPNEGO fails or is not available, the login formular should be shown.

Is there a way to check in the HTTP Header if SPNEGO was successful or done at all?

Another idea that came to my mind is to enable SPNEGO for our application and then try to get the Principal in the above mentioned Struts action. If it's not null, SPNEGO should have been successful. Not sure if this would work.


Claus

[dlofthouse]

I am currently looking at the fall back scenarios when SPNEGO is not available for some reason - at the moment the Beta releases are an all or nothing approach so require SPNEGO to always work.

I am considering the possibility of NTLM authentication which can be the default fallback mechanism selected by the web browser if SPNEGO is unavailable.

I am also considering the options of falling back to other authentication mechanisms such as BASIC or FORM but there may be some issues as to detect a failure in SPNEGO authentication involves sending an error to the client.

[chausberger]

If I understand this correctly, than this means that with the current version, there will always be an error if SPNEGO is configured, but authentication failed.
right?

Currently, we provide our own formular based authentication (not the standard FORM authentication). It would be great if this could be combined with SPNEGO.

Claus

[chausberger]

hi Darran

I just wanted to ask if you had the time to implement the features you wrote about above?

Claus

[rafael_nm]

Hi Darran,

I have a similar requirement. I'm using the GA version and I'd like to have fallback to a username/password module.

How could that be achieved?

Rafael