Configuring Spring Boot 3.x for Windows Integrated Authentication

Before Getting Started

Be sure that you have read and successfully performed ALL of the steps in the pre-flight documentation before proceeding any further.

In addition, you will want to have read through the install for Tomcat guide before attempting Spring Boot 3.x. Even though the configuration between the two are similar, SPNEGO for Spring Boot 3.x, in contrast to Tomcat, is quite different.

  • web.xml configurations are different (application.properties in Spring Boot)
  • Servlet Filter Definition/Registration is specified in your Java code (and not in web.xml)
  • krb5.conf configurations are exactly the same
  • login.conf configurations are exactly the same

The main differences are 1) Spring Boot relies on your Java code instantiating a FilterRegistrationBean when defining/registering a servlet filter whereas in Tomcat the servlet filter is defined in the web.xml file and 2) servlet filter init parameters are specified in the web.xml file whereas in Spring Boot it is provided after your Java code instantiates Spring Boot's FilterRegistrationBean class.

Spring Boot 3.x Install Guide Overview:

  • Download the spnego-jakarta-2.0.jar
  • Add/Install spnego-jakarta-2.0.jar to Maven Artifact Repository
  • Download spring-boot-3.x-example.zip
  • Copy krb5.conf and login.conf files to working directory
  • Modify Spring Boot's application.properties file
  • Use Maven to build a Spring Boot executable jar
  • Start the example application from the command line
  • Test authentication using the example hello_spnego REST call

Download the spnego-jakarta-2.0.jar

https://sourceforge.net/projects/spnego/files/spnego-jakarta-2.0.jar/download

Spring Boot version 3.x only works with the spnego-jakarta-2.0.jar and will NOT work with the spnego-r9.jar.

If you wish to use Spring Boot 2.x instead, then you MUST use the spnego-r9.jar. Also, Spring Boot 2.x has it's own Spring Boot 2.x install guide. Please have a look at that guide instead if you prefer Spring Boot version 2.x.

Spring Boot 2.x and Spring Boot 3.x are very different in terms of the Servlet API package location(s). Whereas previously the Servlet API was located in import javax.servlet.*, with Spring Boot 3.x, the Servlet API is now located in import jakarta.servlet.*.

Hence, the SPNEGO library's import statements in it's Java source-code had to be changed to reflect the new package name(s) in Spring Boot 3.x.

Spring Boot 2.x only works with spnego-r9.jar and Spring Boot 3.x only works with spnego-jakarta-2.0.jar.

Add/Install spnego-jakarta-2.0.jar to Maven Artifact Repository

https://maven.apache.org/guides/mini/guide-3rd-party-jars-local.html

The spnego-jakarta-2.0.jar is not available in any public maven artifact repository. If your organization has a private artifact repository, please ask your Operations Team to upload the spnego-jakarta-2.0.jar file to your organization's private artifact repository.

The recommended pom.xml coordiates are:

<groupId>net.sourceforge.spnego</groupId>
<artifactId>spnego-jakarta</artifactId>
<version>2.0</version>
<type>jar</type>

If your organization does not have a private artifact repository, you must install spnego-jakarta-2.0.jar to your local repository (machine where you will be building the Spring Boot app). To install spnego-jakarta-2.0.jar to your local directory/repository, perform the following steps:

  • copy spnego-jakarta-2.0.jar to your project/working directory
  • open a command prompt to your project/working directory
  • execute the mvn command to install spnego-jakarta-2.0.jar to your local artifact repository

Note: this guide used Java version 17 and Maven version 3.8. However, any Java version greater than 17 and any Maven version greater than 3.8 will work.

 

1) Copy spnego-jakarta-2.0.jar to working directory:

For this example, our project/working directory is arbitrarily specified to be:

C:\Temp\spring-boot-3.x\

 

2) Open command prompt to the same working directory:

Copy/Pate the following command to the command prompt:

mvn org.apache.maven.plugins:maven-install-plugin:3.1.1:install-file -Dfile=spnego-jakarta-2.0.jar

Notice that the word-wrapping gives the appearance that the command is on two lines. However, it is one long command and should be entered as one command and not two separate commands.

 

3) Execute mvn command to begin installation to local repository:

Once the command in step 2 from above is executed, look in the output for a statement that reads "BUILD SUCCESS".

Also, notice that a couple of lines above the "BUILD SUCCESS" statement is the directory path within your local repository where the spnego-jakarta-2.0.jar was placed.

 

4) Confirm spnego-jakarta-2.0.jar was installed:

Traverse your local repository and confirm that the spnego-jakarta-2.0.jar was placed in the correct location.

~\.m2\repository\net\sourceforge\spnego\spnego-jakarta\2.0\

Notice that your path will be slightly different since the path to your local repository may contain your username.

 

Download spring-boot-3.x-example.zip

The example application contains four (4) files:

  • net.sf.spnego.example.HelloApplication.java (Spring Boot's entry point - public static void main)
  • net.sf.spnego.example.HelloController.java (/hello_spnego REST service implementation)
  • application.properties file (servlet filter init params)
  • pom.xml file

Download the spring-boot-3.x-example.zip file, unzip and copy the contents so that the directory structure appears similar to the screenshot below.

Notice that the spnego-jakarta-2.0.jar was placed in the working directory from an earlier/prior step and was not one of the contents in the spring-boot-3.x-example.zip file.

 

Copy krb5.conf and login.conf files to working directory

In the pre-flight guide, you created two files specific to your environment: krb5.conf and login.conf.

A successfull completion of the pre-flight guide ensures both the krb5.conf and the login.conf files are configured correctly.

Copy the two .conf files to your working directory.

Notice from the screenshot below that the spnego-jakarta-2.0.jar was removed from the working directory. It is ok to delete the spnego-jakarta-2.0.jar file from the working directory since it was installed in a Maven artifact repository in a prior/previous step.

 

Modify Spring Boot's application.properties file

The spring-boot-3.x-example.zip contains the example Spring Boot 3.x application.

After unzipping the example application to the working directory, a pre-auth username/password must be specified in the example application's application.properties file.

~\src\main\resources\application.properties

Open the application.properties file in a text editor and look for the section specifying the pre-auth username/password.

 

In the install for Tomcat guide, a pre-auth username/password was needed and specified in Tomcat's web.xml file. This same username/password must be specified in the application.properties file.

 

The pre-auth username/password property in the application.properties file must be provided.

 

As you know, the application.properties file should not be part of the source-code compiled archive/build nor should it be checked-in into an SCM with its username/password properties populated.

Separately, given that in the steps to come we will be launching the example application from the working directory, if you prefer, you can move the application.properties file from the resources directory to the root of the working directory:

move .\src\main\resources\application.properties .\application.properties

 

Use Maven to build a Spring Boot executable jar

We are now ready to build/compile the example Spring Boot 3.x application.

Execute the following command in the command prompt:

mvn clean install

Notice that we are executing the command from the root of the project/working directory which contains the folder named src and three files named krb5.conf, login.conf and pom.xml.

 

After the command executes and finishes, look in the output for a statement that reads "BUILD SUCCESS".

 

Start the example application from the command line

We are now ready to start the application.

But before we do, double-check that the compiled/built example Spring Boot 3.x application jar is in the

~\target\spnego-jkarata-example-1.0-SNAPSHOT-spring-boot.jar directory.

If so, execute the following command from the same project/working directory we've been working in:

java -jar target\spnego-jkarata-example-1.0-SNAPSHOT-spring-boot.jar

spring-boot-3.x-example-app.png

 

Test authentication using the example hello_spnego REST call

Open a web browser and visit the hello_spnego REST service.

http://localhost:8080/hello_spnego

Notice that this a REST service call and is not a call to a .jsp page.

Next, take a look at the source-code of the REST service (HelloController.java) and find that there are two (2) additional REST services in that REST controller.

Finally, notice that the application.properties file contains the following entry:

# comma delimited,no spaces
spnego.exclude.dirs=/public/hello_public

The spnego.exclude.dirs property is the mechanism by which to skip authentication for a given path(s).

By providing one or more paths that should be skipped, the SPNEGO library will exclude resources that match the start of the specified path(s).

Troubleshooting the hello_spnego REST service

The best way to get the Spring Boot 3.x example working is to first read through and perform the steps in the pre-flight guide as well as the installing Tomcat guide.

If after successfully performing all of the steps in both of those guides, and you were able to successfully get the SPNEGO library working in Tomcat, but for some reason not able to get it working with Spring Boot 3.x, please post your questions in the Forum.

Links:
pre-flight checklist
install guide - tomcat
install guide - jboss
install guide - glassfish
install guide - spring boot 2.x
install guide - spring boot 3.x
enable authZ with LDAP
get user group info from LDAP
reference docs
api docs
download

Troubleshooting:
HelloKDC.java
hello_spnego.jsp
HelloKeytab.java
hello_delegate.jsp
SpnegoHelloClient.java
ExampleSpnegoAuthenticatorValve.java

Examples:
create keytab for client
create keytab for app server
credential delegation
protected SOAP Web Service
tomcat authenticator valve
jboss authenticator valve
authZ for standalone apps
protecting edit button on page

Licensing:
GNU LGPL


© 2009 Darwin V. Felix. All rights reserved.