Spring Security Kerberos 1.0.1.RELEASE is built and tested with JDK 7, Spring Security 3.2.7.RELEASE and Spring Framework 4.1.6.RELEASE.

Provider configuration using JavaConfig.

@Configuration
@EnableWebMvcSecurity
public class AuthProviderConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .antMatchers("/", "/home").permitAll()
                .anyRequest().authenticated()
                .and()
            .formLogin()
                .loginPage("/login").permitAll()
                .and()
            .logout()
                .permitAll();
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth
            .authenticationProvider(kerberosAuthenticationProvider());
    }

    @Bean
    public KerberosAuthenticationProvider kerberosAuthenticationProvider() {
        KerberosAuthenticationProvider provider =
        		new KerberosAuthenticationProvider();
        SunJaasKerberosClient client = new SunJaasKerberosClient();
        client.setDebug(true);
        provider.setKerberosClient(client);
        provider.setUserDetailsService(dummyUserDetailsService());
        return provider;
    }

    @Bean
    public DummyUserDetailsService dummyUserDetailsService() {
        return new DummyUserDetailsService();
    }

}

Provider configuration using xml.

<beans xmlns="http://www.springframework.org/schema/beans"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xmlns:sec="http://www.springframework.org/schema/security"
  xmlns:context="http://www.springframework.org/schema/context"
  xsi:schemaLocation="
    http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.2.xsd
    http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
    http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">

  <sec:http entry-point-ref="spnegoEntryPoint" use-expressions="true">
    <sec:intercept-url pattern="/" access="permitAll" />
    <sec:intercept-url pattern="/home" access="permitAll" />
    <sec:intercept-url pattern="/**" access="authenticated"/>
  </sec:http>

  <sec:authentication-manager alias="authenticationManager">
    <sec:authentication-provider ref="kerberosAuthenticationProvider"/>
  </sec:authentication-manager>

  <bean id="kerberosAuthenticationProvider"
    class="org.springframework.security.kerberos.authentication.KerberosAuthenticationProvider">
    <property name="kerberosClient">
      <bean class="org.springframework.security.kerberos.authentication.sun.SunJaasKerberosClient">
        <property name="debug" value="true"/>
      </bean>
    </property>
    <property name="userDetailsService" ref="dummyUserDetailsService"/>
  </bean>

  <bean
    class="org.springframework.security.kerberos.authentication.sun.GlobalSunJaasKerberosConfig">
    <property name="debug" value="true" />
    <property name="krbConfLocation" value="/path/to/krb5.ini"/>
  </bean>

  <bean id="dummyUserDetailsService"
    class="org.springframework.security.kerberos.docs.DummyUserDetailsService" />

  <bean id="spnegoEntryPoint"
    class="org.springframework.security.kerberos.web.authentication.SpnegoEntryPoint" >
    <constructor-arg value="/login" />
  </bean>

</beans>

Spnego configuration using JavaConfig.

@Configuration
@EnableWebMvcSecurity
public class SpnegoConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .exceptionHandling()
                .authenticationEntryPoint(spnegoEntryPoint())
                .and()
            .authorizeRequests()
                .antMatchers("/", "/home").permitAll()
                .anyRequest().authenticated()
                .and()
            .formLogin()
                .loginPage("/login").permitAll()
                .and()
            .logout()
                .permitAll()
                .and()
            .addFilterBefore(
                    spnegoAuthenticationProcessingFilter(authenticationManagerBean()),
                    BasicAuthenticationFilter.class);
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth)
    		throws Exception {
        auth
            .authenticationProvider(kerberosAuthenticationProvider())
            .authenticationProvider(kerberosServiceAuthenticationProvider());
    }

    @Bean
    public KerberosAuthenticationProvider kerberosAuthenticationProvider() {
        KerberosAuthenticationProvider provider =
        		new KerberosAuthenticationProvider();
        SunJaasKerberosClient client = new SunJaasKerberosClient();
        client.setDebug(true);
        provider.setKerberosClient(client);
        provider.setUserDetailsService(dummyUserDetailsService());
        return provider;
    }

    @Bean
    public SpnegoEntryPoint spnegoEntryPoint() {
        return new SpnegoEntryPoint("/login");
    }

    @Bean
    public SpnegoAuthenticationProcessingFilter spnegoAuthenticationProcessingFilter(
            AuthenticationManager authenticationManager) {
        SpnegoAuthenticationProcessingFilter filter =
        		new SpnegoAuthenticationProcessingFilter();
        filter.setAuthenticationManager(authenticationManager);
        return filter;
    }

    @Bean
    public KerberosServiceAuthenticationProvider kerberosServiceAuthenticationProvider() {
        KerberosServiceAuthenticationProvider provider =
        		new KerberosServiceAuthenticationProvider();
        provider.setTicketValidator(sunJaasKerberosTicketValidator());
        provider.setUserDetailsService(dummyUserDetailsService());
        return provider;
    }

    @Bean
    public SunJaasKerberosTicketValidator sunJaasKerberosTicketValidator() {
        SunJaasKerberosTicketValidator ticketValidator =
        		new SunJaasKerberosTicketValidator();
        ticketValidator.setServicePrincipal("HTTP/[email protected]");
        ticketValidator.setKeyTabLocation(new FileSystemResource("/tmp/service.keytab"));
        ticketValidator.setDebug(true);
        return ticketValidator;
    }

    @Bean
    public DummyUserDetailsService dummyUserDetailsService() {
        return new DummyUserDetailsService();
    }

}

Spnego configuration using xml.

<beans xmlns="http://www.springframework.org/schema/beans"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xmlns:sec="http://www.springframework.org/schema/security"
  xmlns:context="http://www.springframework.org/schema/context"
  xsi:schemaLocation="http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd
    http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.1.xsd
    http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.1.xsd">

  <sec:http entry-point-ref="spnegoEntryPoint" use-expressions="true" >
    <sec:intercept-url pattern="/" access="permitAll" />
    <sec:intercept-url pattern="/home" access="permitAll" />
    <sec:intercept-url pattern="/login" access="permitAll" />
    <sec:intercept-url pattern="/**" access="authenticated"/>
    <sec:form-login login-page="/login" />
    <sec:custom-filter ref="spnegoAuthenticationProcessingFilter"
      before="BASIC_AUTH_FILTER" />
  </sec:http>

  <sec:authentication-manager alias="authenticationManager">
    <sec:authentication-provider ref="kerberosAuthenticationProvider" />
    <sec:authentication-provider ref="kerberosServiceAuthenticationProvider" />
  </sec:authentication-manager>

  <bean id="kerberosAuthenticationProvider"
    class="org.springframework.security.kerberos.authentication.KerberosAuthenticationProvider">
    <property name="userDetailsService" ref="dummyUserDetailsService"/>
    <property name="kerberosClient">
      <bean class="org.springframework.security.kerberos.authentication.sun.SunJaasKerberosClient">
        <property name="debug" value="true"/>
      </bean>
    </property>
  </bean>

  <bean id="spnegoEntryPoint"
    class="org.springframework.security.kerberos.web.authentication.SpnegoEntryPoint" >
    <constructor-arg value="/login" />
  </bean>

  <bean id="spnegoAuthenticationProcessingFilter"
    class="org.springframework.security.kerberos.web.authentication.SpnegoAuthenticationProcessingFilter">
    <property name="authenticationManager" ref="authenticationManager" />
  </bean>

  <bean id="kerberosServiceAuthenticationProvider"
    class="org.springframework.security.kerberos.authentication.KerberosServiceAuthenticationProvider">
    <property name="ticketValidator">
      <bean
        class="org.springframework.security.kerberos.authentication.sun.SunJaasKerberosTicketValidator">
        <property name="servicePrincipal" value="${app.service-principal}" />
        <property name="keyTabLocation" value="${app.keytab-location}" />
        <property name="debug" value="true" />
      </bean>
    </property>
    <property name="userDetailsService" ref="dummyUserDetailsService" />
  </bean>

  <bean id="dummyUserDetailsService"
    class="org.springframework.security.kerberos.docs.DummyUserDetailsService" />

</beans>

If there is a need to access Kerberos protected web resources programmatically we have KerberosRestTemplate which extends RestTemplate and does necessary login actions prior to delegating to actual RestTemplate methods. You basically have few options to configure this template.

With ticket cache.

public void doWithTicketCache() {
    KerberosRestTemplate restTemplate =
            new KerberosRestTemplate();
    restTemplate.getForObject("http://neo.example.org:8080/hello", String.class);
}

With keytab file.

public void doWithKeytabFile() {
    KerberosRestTemplate restTemplate =
            new KerberosRestTemplate("/tmp/user2.keytab", "[email protected]");
    restTemplate.getForObject("http://neo.example.org:8080/hello", String.class);
}

With most of your samples we’re using DummyUserDetailsService because there is not necessarily need to query a real user details once kerberos authentication is successful and we can use kerberos principal info to create that dummy user. However there is a way to access kerberized LDAP services in a say way and query user details from there.

KerberosLdapContextSource can be used to bind into LDAP via kerberos which is at least proven to work well with Windows AD services.

@Value("${app.ad-server}")
private String adServer;

@Value("${app.service-principal}")
private String servicePrincipal;

@Value("${app.keytab-location}")
private String keytabLocation;

@Value("${app.ldap-search-base}")
private String ldapSearchBase;

@Value("${app.ldap-search-filter}")
private String ldapSearchFilter;

@Bean
public KerberosLdapContextSource kerberosLdapContextSource() {
    KerberosLdapContextSource contextSource = new KerberosLdapContextSource(adServer);
    SunJaasKrb5LoginConfig loginConfig = new SunJaasKrb5LoginConfig();
    loginConfig.setKeyTabLocation(new FileSystemResource(keytabLocation));
    loginConfig.setServicePrincipal(servicePrincipal);
    loginConfig.setDebug(true);
    loginConfig.setIsInitiator(true);
    contextSource.setLoginConfig(loginConfig);
    return contextSource;
}

@Bean
public LdapUserDetailsService ldapUserDetailsService() {
    FilterBasedLdapUserSearch userSearch =
            new FilterBasedLdapUserSearch(ldapSearchBase, ldapSearchFilter, kerberosLdapContextSource());
    LdapUserDetailsService service = new LdapUserDetailsService(userSearch);
    service.setUserDetailsMapper(new LdapUserDetailsMapper());
    return service;
}

	Tip
	Sample Chapter 6, Security Server Windows Auth Sample is currently configured to query user details from AD if authentication happen via kerberos.

Goals of this sample:

server:
    port: 8080
    app:
        ad-domain: EXAMPLE.ORG
        ad-server: ldap://WIN-EKBO0EQ7TS7.example.org/
        service-principal: HTTP/[email protected]
        keytab-location: /tmp/tomcat.keytab
        ldap-search-base: dc=example,dc=org
        ldap-search-filter: "(| (userPrincipalName={0}) (sAMAccountName={0}))"

In above you can see the default configuration for this sample. You can override these settings using a normal Spring Boot tricks like using command-line options or custom application.yml file.

Run a server.

$ java -jar sec-server-win-auth-1.0.1.RELEASE.jar

	Important
	You may need to use custom kerberos config with Linux either by using -Djava.security.krb5.conf=/path/to/krb5.ini or GlobalSunJaasKerberosConfig bean.

	Note
	See Section C.2, “Setup Windows Domain Controller” for more instructions how to work with windows kerberos environment.

Login to Windows 8.1 using domain credentials and access sample

Access sample application from a non windows vm and use domain credentials manually.

This sample demonstrates how server is able to authenticate user against kerberos environment using his credentials passed in via a form login.

Run a server.

$ java -jar sec-server-client-auth-1.0.1.RELEASE.jar

server:
    port: 8080

This sample demonstrates how a server can be configured to accept a Spnego based negotiation from a browser while still being able to fall back to a form based authentication.

Using a user1 principal Section C.1, “Setup MIT Kerberos”, do a kerberos login manually using credentials.

$ kinit user1
Password for [email protected]:

$ klist
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: [email protected]

Valid starting     Expires            Service principal
10/03/15 17:18:45  11/03/15 03:18:45  krbtgt/[email protected]
  renew until 11/03/15 17:18:40

or using a keytab file.

$ kinit -kt user2.keytab user1

$ klist
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: [email protected]

Valid starting     Expires            Service principal
10/03/15 17:25:03  11/03/15 03:25:03  krbtgt/[email protected]
  renew until 11/03/15 17:25:03

Run a server.

$ java -jar sec-server-spnego-form-auth-1.0.1.RELEASE.jar

Now you should be able to open your browser and let it do Spnego authentication with existing ticket.

	Note
	See Appendix E, Configure Browsers for Spnego Negotiation for more instructions for configuring browsers to use Spnego.

server:
    port: 8080
app:
    service-principal: HTTP/[email protected]
    keytab-location: /tmp/tomcat.keytab

This is a same sample than Chapter 8, Security Server Spnego and Form Auth Sample but using xml based configuration instead of JavaConfig.

Run a server.

$ java -jar sec-server-spnego-form-auth-xml-1.0.1.RELEASE.jar

This is a sample using a Spring RestTemplate to access Kerberos protected resource. You can use this together with Chapter 8, Security Server Spnego and Form Auth Sample.

Default application is configured as shown below.

app:
    user-principal: [email protected]
    keytab-location: /tmp/user2.keytab
    access-url: http://neo.example.org:8080/hello

Using a user1 principal Section C.1, “Setup MIT Kerberos”, do a kerberos login manually using credentials.

$ java -jar sec-client-rest-template-1.0.1.RELEASE.jar --app.user-principal --app.keytab-location

	Note
	In above we simply set app.user-principal and app.keytab-location to empty values which disables a use of keytab file.

If operation is succesfull you should see below output with [email protected].

<html xmlns="http://www.w3.org/1999/xhtml"
      xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity3">
  <head>
    <title>Spring Security Kerberos Example</title>
  </head>
  <body>
    <h1>Hello [email protected]!</h1>
  </body>
</html>

Or use a user2 with a keytab file.

$ java -jar sec-client-rest-template-1.0.1.RELEASE.jar

If operation is succesfull you should see below output with [email protected].

<html xmlns="http://www.w3.org/1999/xhtml"
      xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity3">
  <head>
    <title>Spring Security Kerberos Example</title>
  </head>
  <body>
    <h1>Hello [email protected]!</h1>
  </body>
</html>