我无法将我的Ubuntu虚拟机配置为在Spnego下单一登录我的Spring Security web应用程序。我做错了什么还是错过了什么？
我已经在Windows7虚拟机上使用了SSO，所以我相信它是特定于Linux的。
我的配置详细如下。
红外
我有四台机器在两种不同的硬件中运行：
WIN-SRV2008.company.local：运行Windows Server 2008的VM KDC(硬件A(TOMCAT.company.local：运行Tomcat 7web应用程序(硬件A(W7-CLIENT.company.local:SSO工作的VM Windows 7客户端(硬件B(U-CLIENT.company.local:VM Ubuntu 17.10.1客户端，SSO不工作(硬件B(
SPN
我的SPN、krb5.ini和login.conf基于此线程的描述。
Spnego
除了删除表单登录之外，我基本上遵循了SpringSecurityKerberos参考文档，结果是：
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Value("${kerberos.service-principal}")
private String servicePrincipal;
@Value("${kerberos.keytab-location}")
private String keytabLocation;
@Override
protected void configure(HttpSecurity http) throws Exception {
AffirmativeBased affirmativeBased = new AffirmativeBased(Arrays.asList(new RoleVoter(),new WebExpressionVoter()));
http
.authorizeRequests().accessDecisionManager(affirmativeBased)
.anyRequest().authenticated()
.and()
.httpBasic()
.authenticationEntryPoint(entryPoint())
.and()
.logout()
.logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
.and()
.addFilterBefore(
spnegoAuthenticationProcessingFilter(authenticationManagerBean()),
BasicAuthenticationFilter.class)
.sessionManagement()
.invalidSessionUrl("/login")
.maximumSessions(1)
.maxSessionsPreventsLogin(true)
.sessionRegistry(sessionRegistry());
}
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth
.authenticationProvider(kerberosAuthenticationProvider())
.authenticationProvider(kerberosServiceAuthenticationProvider());
}
@Bean
public SpnegoEntryPoint entryPoint() {
return new SpnegoEntryPoint();
}
@Bean
public KerberosAuthenticationProvider kerberosAuthenticationProvider() {
LoginKerberosAuthentication provider = new LoginKerberosAuthentication();
SunJaasKerberosClient client = new SunJaasKerberosClient();
client.setDebug(true);
provider.setKerberosClient(client);
provider.setUserDetailsService(usuarioDetailsService());
return provider;
}
@Bean
public SpnegoAuthenticationProcessingFilter spnegoAuthenticationProcessingFilter(
AuthenticationManager authenticationManager) {
SpnegoAuthenticationProcessingFilter filter = new SpnegoAuthenticationProcessingFilter();
filter.setAuthenticationManager(authenticationManager);
return filter;
}
@Bean
public KerberosServiceAuthenticationProvider kerberosServiceAuthenticationProvider() {
KerberosServiceAuthenticationProvider provider = new KerberosServiceAuthenticationProvider();
provider.setTicketValidator(sunJaasKerberosTicketValidator());
provider.setUserDetailsService(usuarioDetailsService());
return provider;
}
@Bean
public SunJaasKerberosTicketValidator sunJaasKerberosTicketValidator() {
SunJaasKerberosTicketValidator ticketValidator = new SunJaasKerberosTicketValidator();
ticketValidator.setServicePrincipal(servicePrincipal);
ticketValidator.setKeyTabLocation(new FileSystemResource(keytabLocation));
ticketValidator.setDebug(true);
return ticketValidator;
}
@Bean
@Override
public AuthenticationManager authenticationManagerBean() throws Exception {
return super.authenticationManagerBean();
}
@Bean
public UsuarioDetailsService usuarioDetailsService() {
return new UsuarioDetailsService();
}
Ubuntu客户端
为了加入域，我遵循了以下步骤：
sudo apt-get install realmd krb5-user software-properties-common python-software-properties packagekit
sudo realm join COMPANY.local -U 'administrator@COMPANY.LOCAL' -v
直到我用生成kerberos票证
kinit my_ubuntu_user@COMPANY.local
实际上，我用klist检查了缓存，它输出：
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: my_ubuntu_user@COMPANY.local
Valid starting Expires Service principal
30/10/2018 17:25:47 31/10/2018 03:25:47 krbtgt/COMPANY.local@COMPANY.local
renew until 31/10/2018 17:25:43
最后，我使用成功地进行了身份验证
sudo su my_ubuntu_user@COMPANY.local
SSO-问题
当我尝试使用Firefox(带有可信站点配置(访问我的应用程序主页时，就像我使用Windows 7客户端一样，我只得到401协商标头，不会发送响应令牌。这意味着，当我向SpnegoEntryPoint构造函数输入一个实际的url时，我会被重定向到这个回退。
提前感谢
多亏了Samson的评论，我才得以成功。
我确实通过执行sudo su my_ubuntu_user@COMPANY.local切换到了一个空缓存，这使得我的应用程序登录响应401。