<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<body link="#355491" alink="#4262a1" vlink="#355491" style="background: #e2e2e2; margin: 0; padding: 20px;">
<div>
<table cellpadding="0" bgcolor="#FFFFFF" border="0" cellspacing="0" style="border: 1px solid #dadada; margin-bottom: 30px; width: 100%; -moz-border-radius: 6px; -webkit-border-radius: 6px;">
<tbody>
<tr>
<td>
<table border="0" cellpadding="0" cellspacing="0" bgcolor="#FFFFFF" style="border: solid 2px #ccc; background: #dadada; width: 100%; -moz-border-radius: 6px; -webkit-border-radius: 6px;">
<tbody>
<tr>
<td bgcolor="#000000" valign="middle" height="58px" style="border-bottom: 1px solid #ccc; padding: 20px; -moz-border-radius-topleft: 3px; -moz-border-radius-topright: 3px; -webkit-border-top-right-radius: 5px; -webkit-border-top-left-radius: 5px;">
<h1 style="color: #333333; font: bold 22px Arial, Helvetica, sans-serif; margin: 0; display: block !important;">
<!-- To have a header image/logo replace the name below with your img tag -->
<!-- Email clients will render the images when the message is read so any image -->
<!-- must be made available on a public server, so that all recipients can load the image. -->
<a href="http://community.jboss.org/index.jspa" style="text-decoration: none; color: #E1E1E1">JBoss Community</a></h1>
</td>
</tr>
<tr>
<td bgcolor="#FFFFFF" style="font: normal 12px Arial, Helvetica, sans-serif; color:#333333; padding: 20px; -moz-border-radius-bottomleft: 4px; -moz-border-radius-bottomright: 4px; -webkit-border-bottom-right-radius: 5px; -webkit-border-bottom-left-radius: 5px;"><h3 style="margin: 10px 0 5px; font-size: 17px; font-weight: normal;">
[DRAFT] Using JBoss Negotiation on AS7
</h3>
<span style="margin-bottom: 10px;">
modified by <a href="http://community.jboss.org/people/dlofthouse">Darran Lofthouse</a> in <i>JBoss AS7 Development</i> - <a href="http://community.jboss.org/docs/DOC-16876">View the full document</a>
</span>
<hr style="margin: 20px 0; border: none; background-color: #dadada; height: 1px;">
<div class="jive-rendered-content"><p>Once <a class="jive-link-external-small" href="https://issues.jboss.org/browse/AS7-770">AS7-770</a> is resolved it will be possible to start using JBoss Negotiation with web applications deployed to JBoss AS7.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>JBoss Negotiation is still JBoss Negotiation so the majority of the configuration is still the same as on previous JBoss AS releases, this article just highlights some of the differences.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><h2>Security Domains</h2><p>As before two security domains are still required, one to represent the identity of the server and one to secure the web application - in JBoss AS7 these are defined in the domain model e.g.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><blockquote class="jive-quote"><p>  <security-domains></p><p>    <security-domain name="host" cache-type="default">
                  </p><p>      <authentication>
                    </p><p>        <login-module code="Kerberos" flag="required">
                      </p><p>          <module-option name="storeKey" value="true"/>
                      </p><p>          <module-option name="useKeyTab" value="true"/>
                      </p><p>          <module-option name="principal" value="host/testserver@MY_REALM"/>
                      </p><p>          <module-option name="keyTab" value="/home/username/service.keytab"/>
                      </p><p>          <module-option name="doNotPrompt" value="true"/>
                      </p><p>          <module-option name="debug" value="false"/>
                    </p><p>        </login-module>
                  </p><p>       </authentication>
                </p><p>     </security-domain>
                </p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>     <security-domain name="SPNEGO" cache-type="default">
                  </p><p>       <authentication>
                    </p><p>         <login-module code="SPNEGO"  flag="requisite">
                      </p><p>           <module-option name="password-stacking" value="useFirstPass"/>
                      </p><p>           <module-option name="serverSecurityDomain" value="host"/>
                    </p><p>         </login-module>
                    </p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>         <!-- Login Module For Roles Search -->
                </p><p>       </security-domain>
</p></blockquote><p>Here the security domain options are exactly the same as in previous JBoss AS releases, the only noteable difference is that the 'Code' attribute for each login-module can now use a simple name instead of the fully qualified class name used previously.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>The following tables shows the name mapping used when working with JBoss Negotiation: -</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><table border="1" cellpadding="3" cellspacing="0" class="jiveBorder" style="width: 100%; border: 1px solid #000000;"><tbody><tr><th align="center" style="border:1px solid black;border: 1px solid #000000;background-color: #6690bc;" valign="middle"><span style="color: #ffffff;"><strong>Simple Name</strong></span></th><th align="center" style="border:1px solid black;border: 1px solid #000000;background-color: #6690bc;" valign="middle"><span style="color: #ffffff;"><strong>Class Name</strong></span></th></tr><tr><td style="border:1px solid black;border: 1px solid #000000;">Kerberos</td><td style="border:1px solid black;border: 1px solid #000000;">com.sun.security.auth.module.Krb5LoginModule</td></tr><tr><td style="border:1px solid black;border: 1px solid #000000;">SPNEGO</td><td style="border:1px solid black;border: 1px solid #000000;">org.jboss.security.negotiation.spnego.SPNEGOLoginModule</td></tr><tr><td style="border:1px solid black;border: 1px solid #000000;">AdvancedLdap</td><td style="border:1px solid black;border: 1px solid #000000;">org.jboss.security.negotiation.AdvancedLdapLoginModule</td></tr><tr><td style="border:1px solid black;border: 1px solid #000000;">AdvancedAdLdap</td><td style="border:1px solid black;border: 1px solid #000000;">org.jboss.security.negotiation.AdvancedADLoginModule</td></tr></tbody></table><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><h2>System Properties</h2><p>Instead of a seperate deployment the system properties (if required) can now also be set in the domain model.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>e.g.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><blockquote class="jive-quote"><p>    <system-properties>
        </p><p>      <property name="java.security.krb5.kdc" value="mykdc.mydomain"/>
        </p><p>      <property name="java.security.krb5.realm" value="MY_REALM"/>
    </p><p>    </system-properties>
</p></blockquote><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><h2>Web Application</h2><p>Within JBoss AS7 it is not possible to override the authenticators as before, however it is possible to just add the NegotiationAuthenticator as a valve to your jboss-web.xml descriptor to achieve the same effect.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>e.g.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><blockquote class="jive-quote"><p><span>  <!DOCTYPE jboss-web PUBLIC
  "-//JBoss//DTD Web Application 2.4//EN"
  "</span><a class="jive-link-external-small" href="http://www.jboss.org/j2ee/dtd/jboss-web_4_0.dtd" target="_blank">http://www.jboss.org/j2ee/dtd/jboss-web_4_0.dtd</a><span>">   
</span></p><p>  <jboss-web>
  </p><p>    <security-domain>java:/jaas/SPNEGO</security-domain>
   </p><p>    <valve>
        </p><p>      <class-name>org.jboss.security.negotiation.NegotiationAuthenticator</class-name>
    </p><p>    </valve>
</p><p>  </jboss-web>
</p></blockquote><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>Note - the valve still requirs the security-constraint and login-config to be defined in the web.xml as this is still used to decide which resources are secured - however the chosen auth-method will be overriden by this authenticator.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>Finally the web application requires a dependency defining in META-INF/MANIFEST.MF so that the JBoss Negotiation classes can be located.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><blockquote class="jive-quote"><p>Manifest-Version: 1.0 </p><p>Build-Jdk: 1.6.0_24 </p><p>Dependencies: org.jboss.security.negotiation </p></blockquote><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><h2>JBoss Negotiation Toolkit</h2><p>Attached to this article is a version of the JBoss Negotiation Toolkit for use with JBoss AS7 to allow you as before to test the different aspects of SPNEGO before introducing your own application.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>Note - As the toolkit is intended for debugging if you look at the dependencies in the MANIFEST.MF you will see some additional dependencies defined, these are needed for the debugging features of the toolkit and are not normally needed for your own web application.</p></div>
<div style="background-color: #f4f4f4; padding: 10px; margin-top: 20px;">
<p style="margin: 0;">Comment by <a href="http://community.jboss.org/docs/DOC-16876">going to Community</a></p>
<p style="margin: 0;">Create a new document in JBoss AS7 Development at <a href="http://community.jboss.org/choose-container!input.jspa?contentType=102&containerType=14&container=2225">Community</a></p>
</div></td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</div>
</body>
</html>