Example usage for org.apache.http.client.config AuthSchemes SPNEGO

List of usage examples for org.apache.http.client.config AuthSchemes SPNEGO

  1. HOME
  2. Java
  3. org.apache.http
  4. org.apache.http.client.config.*
  5. AuthSchemes
  6. SPNEGO

Introduction

In this page you can find the example usage for org.apache.http.client.config AuthSchemes SPNEGO.

Prototype

String SPNEGO

To view the source code for org.apache.http.client.config AuthSchemes SPNEGO.

Click Source Link

Document

SPNEGO Authentication scheme.

Usage

From source file:org.elasticsearch.xpack.security.authc.kerberos.SpnegoHttpClientConfigCallbackHandler.java

private void setupSpnegoAuthSchemeSupport(HttpAsyncClientBuilder httpClientBuilder) {
    final Lookup<AuthSchemeProvider> authSchemeRegistry = RegistryBuilder.<AuthSchemeProvider>create()
            .register(AuthSchemes.SPNEGO, new SPNegoSchemeFactory()).build();

    final GSSManager gssManager = GSSManager.getInstance();
    try {//from  w  w  w  . java2s.c  om
        final GSSName gssUserPrincipalName = gssManager.createName(userPrincipalName, GSSName.NT_USER_NAME);
        login();
        final AccessControlContext acc = AccessController.getContext();
        final GSSCredential credential = doAsPrivilegedWrapper(loginContext.getSubject(),
                (PrivilegedExceptionAction<GSSCredential>) () -> gssManager.createCredential(
                        gssUserPrincipalName, GSSCredential.DEFAULT_LIFETIME, SPNEGO_OID,
                        GSSCredential.INITIATE_ONLY),
                acc);

        final KerberosCredentialsProvider credentialsProvider = new KerberosCredentialsProvider();
        credentialsProvider.setCredentials(
                new AuthScope(AuthScope.ANY_HOST, AuthScope.ANY_PORT, AuthScope.ANY_REALM, AuthSchemes.SPNEGO),
                new KerberosCredentials(credential));
        httpClientBuilder.setDefaultCredentialsProvider(credentialsProvider);
    } catch (GSSException e) {
        throw new RuntimeException(e);
    } catch (PrivilegedActionException e) {
        throw new RuntimeException(e.getCause());
    }
    httpClientBuilder.setDefaultAuthSchemeRegistry(authSchemeRegistry);
}

From source file:io.cloudslang.content.httpclient.build.auth.AuthSchemeProviderLookupBuilder.java

public Lookup<AuthSchemeProvider> buildAuthSchemeProviderLookup() {
    RegistryBuilder<AuthSchemeProvider> registryBuilder = RegistryBuilder.create();

    for (String type : authTypes) {
        switch (type.trim()) {
        case "NTLM":
            registryBuilder.register(AuthSchemes.NTLM, new AuthSchemeProvider() {
                @Override/*www . ja  v  a2  s .  co  m*/
                public AuthScheme create(HttpContext httpContext) {
                    return new NTLMScheme(new JCIFSEngine());
                }
            });
            break;
        case "BASIC":
            registryBuilder.register(AuthSchemes.BASIC,
                    new BasicSchemeFactory(Charset.forName(Utils.DEFAULT_CHARACTER_SET)));
            String value = username + ":" + password;
            byte[] encodedValue = Base64.encodeBase64(value.getBytes(StandardCharsets.UTF_8));
            headers.add(new BasicHeader("Authorization", "Basic " + new String(encodedValue)));
            break;
        case "DIGEST":
            registryBuilder.register(AuthSchemes.DIGEST, new DigestSchemeFactory());
            break;
        case "KERBEROS":
            if (kerberosConfigFile != null) {
                System.setProperty("java.security.krb5.conf", kerberosConfigFile);
            } else {
                File krb5Config;
                String domain = host.replaceAll(".*\\.(?=.*\\.)", "");
                try {
                    krb5Config = createKrb5Configuration(domain);
                } catch (IOException e) {
                    throw new RuntimeException("could not create the krb5 config file" + e.getMessage(), e);
                }
                System.setProperty("java.security.krb5.conf", krb5Config.toURI().toString());
            }

            if (kerberosLoginConfigFile != null) {
                System.setProperty("java.security.auth.login.config", kerberosLoginConfigFile);
            } else {
                File loginConfig;
                try {
                    loginConfig = createLoginConfig();
                } catch (IOException e) {
                    throw new RuntimeException(
                            "could not create the kerberos login config file" + e.getMessage(), e);
                }
                System.setProperty("java.security.auth.login.config", loginConfig.toURI().toString());
            }

            if (password != null) {
                System.setProperty(KrbHttpLoginModule.PAS, password);
            }
            if (username != null) {
                System.setProperty(KrbHttpLoginModule.USR, username);
            }

            System.setProperty("javax.security.auth.useSubjectCredsOnly", "false");

            boolean skipPort = Boolean.parseBoolean(skipPortAtKerberosDatabaseLookup);
            registryBuilder.register(AuthSchemes.KERBEROS, new KerberosSchemeFactory(skipPort));
            registryBuilder.register(AuthSchemes.SPNEGO, new SPNegoSchemeFactory(skipPort));
            break;
        case AuthTypes.ANONYMOUS:
            break;
        default:
            throw new IllegalStateException(
                    "Unsupported '" + HttpClientInputs.AUTH_TYPE + "'authentication scheme: " + type);
        }
    }
    return registryBuilder.build();
}

From source file:org.openscore.content.httpclient.build.auth.AuthSchemeProviderLookupBuilder.java

public Lookup<AuthSchemeProvider> buildAuthSchemeProviderLookup() {
    RegistryBuilder<AuthSchemeProvider> registryBuilder = RegistryBuilder.create();

    for (String type : authTypes) {
        switch (type.trim()) {
        case "NTLM":
            registryBuilder.register(AuthSchemes.NTLM, new AuthSchemeProvider() {
                @Override//from  w w  w.  jav a  2s.co  m
                public AuthScheme create(HttpContext httpContext) {
                    return new NTLMScheme(new JCIFSEngine());
                }
            });
            break;
        case "BASIC":
            registryBuilder.register(AuthSchemes.BASIC, new BasicSchemeFactory(Charset.forName("UTF-8")));
            String value = username + ":" + password;
            byte[] encodedValue = Base64.encodeBase64(value.getBytes(StandardCharsets.UTF_8));
            headers.add(new BasicHeader("Authorization", "Basic " + new String(encodedValue)));
            break;
        case "DIGEST":
            registryBuilder.register(AuthSchemes.DIGEST, new DigestSchemeFactory());
            break;
        case "KERBEROS":
            if (getSettingsKey().equals(System.getProperty("oohttpclient.krb.last.settings"))) {
                break;
            }
            if (kerberosConfigFile != null) {
                System.setProperty("java.security.krb5.conf", kerberosConfigFile);
            } else {
                File krb5Config;
                String domain = host.replaceAll(".*\\.(?=.*\\.)", "");
                try {
                    krb5Config = createKrb5Configuration(domain);
                } catch (IOException e) {
                    throw new RuntimeException("could not create the krb5 config file" + e.getMessage(), e);
                }
                System.setProperty("java.security.krb5.conf", krb5Config.toURI().toString());
            }

            if (kerberosLoginConfigFile != null) {
                System.setProperty("java.security.auth.login.config", kerberosLoginConfigFile);
            } else {
                File loginConfig;
                try {
                    loginConfig = createLoginConfig();
                } catch (IOException e) {
                    throw new RuntimeException(
                            "could not create the kerberos login config file" + e.getMessage(), e);
                }
                System.setProperty("java.security.auth.login.config", loginConfig.toURI().toString());
            }

            //todo fix security issue
            if (password != null) {
                System.setProperty(KrbHttpLoginModule.PAS, password);
            }
            if (username != null) {
                System.setProperty(KrbHttpLoginModule.USR, username);
            }

            System.setProperty("javax.security.auth.useSubjectCredsOnly", "false");

            boolean skipPort = Boolean.parseBoolean(skipPortAtKerberosDatabaseLookup);
            registryBuilder.register(AuthSchemes.KERBEROS, new KerberosSchemeFactory(skipPort));
            registryBuilder.register(AuthSchemes.SPNEGO, new SPNegoSchemeFactory(skipPort));
            System.setProperty("oohttpclient.krb.last.settings", getSettingsKey());
            break;
        default:
            throw new IllegalStateException(
                    "Unsupported '" + HttpClientInputs.AUTH_TYPE + "'authentication scheme: " + type);
        }
    }
    return registryBuilder.build();
}

From source file:org.springframework.security.kerberos.client.KerberosRestTemplate.java

/**
 * Builds the default instance of {@link HttpClient} having kerberos
 * support./*www.j  av  a 2s.co  m*/
 *
 * @return the http client with spneno auth scheme
 */
private static HttpClient buildHttpClient() {
    HttpClientBuilder builder = HttpClientBuilder.create();
    Lookup<AuthSchemeProvider> authSchemeRegistry = RegistryBuilder.<AuthSchemeProvider>create()
            .register(AuthSchemes.SPNEGO, new SPNegoSchemeFactory(true)).build();
    builder.setDefaultAuthSchemeRegistry(authSchemeRegistry);
    BasicCredentialsProvider credentialsProvider = new BasicCredentialsProvider();
    credentialsProvider.setCredentials(new AuthScope(null, -1, null), credentials);
    builder.setDefaultCredentialsProvider(credentialsProvider);
    CloseableHttpClient httpClient = builder.build();
    return httpClient;
}

From source file:org.jboss.as.test.integration.security.picketlink.SAML2AttributeMappingTestCase.java

/**
 * Tests IDP attribute mapping when passUserPrincipalToAttributeManager is set to "true". Automatic handling of redirections
 * is enabled for HTTP client used.//from ww  w.  jav a2  s.  c  o m
 *
 * @throws Exception
 */
@Test
public void testPassUserPrincipalToAttributeManager() throws Exception {
    Registry<AuthSchemeProvider> authSchemeRegistry = RegistryBuilder.<AuthSchemeProvider>create()
            .register(AuthSchemes.SPNEGO, new JBossNegotiateSchemeFactory(true)).build();
    CredentialsProvider credentialsProvider = new BasicCredentialsProvider();
    credentialsProvider.setCredentials(new AuthScope(null, -1, null), new NullHCCredentials());

    try (final CloseableHttpClient httpClient = HttpClientBuilder.create()
            .setDefaultAuthSchemeRegistry(authSchemeRegistry).setDefaultCredentialsProvider(credentialsProvider)
            .setRedirectStrategy(Utils.REDIRECT_STRATEGY).build()) {

        String response = PicketLinkTestBase.makeCallWithKerberosAuthn(spUrl.toURI(), httpClient, "jduke",
                "theduke", 200);
        assertEquals("SP index page was not reached", SP_RESPONSE_BODY, response);
        response = PicketLinkTestBase.makeCall(
                new URL(spUrl.toString() + PrintAttributeServlet.SERVLET_PATH.substring(1)), httpClient, 200);
        assertEquals("cn attribute not stored", "Java Duke", response);
    }
}

From source file:org.apache.hadoop.hbase.http.TestSpnegoHttpServer.java

@Test
public void testAllowedClient() throws Exception {
    // Create the subject for the client
    final Subject clientSubject = JaasKrbUtil.loginUsingKeytab(CLIENT_PRINCIPAL, clientKeytab);
    final Set<Principal> clientPrincipals = clientSubject.getPrincipals();
    // Make sure the subject has a principal
    assertFalse(clientPrincipals.isEmpty());

    // Get a TGT for the subject (might have many, different encryption types). The first should
    // be the default encryption type.
    Set<KerberosTicket> privateCredentials = clientSubject.getPrivateCredentials(KerberosTicket.class);
    assertFalse(privateCredentials.isEmpty());
    KerberosTicket tgt = privateCredentials.iterator().next();
    assertNotNull(tgt);//from w w  w. j a v a2s.  c  om

    // The name of the principal
    final String principalName = clientPrincipals.iterator().next().getName();

    // Run this code, logged in as the subject (the client)
    HttpResponse resp = Subject.doAs(clientSubject, new PrivilegedExceptionAction<HttpResponse>() {
        @Override
        public HttpResponse run() throws Exception {
            // Logs in with Kerberos via GSS
            GSSManager gssManager = GSSManager.getInstance();
            // jGSS Kerberos login constant
            Oid oid = new Oid("1.2.840.113554.1.2.2");
            GSSName gssClient = gssManager.createName(principalName, GSSName.NT_USER_NAME);
            GSSCredential credential = gssManager.createCredential(gssClient, GSSCredential.DEFAULT_LIFETIME,
                    oid, GSSCredential.INITIATE_ONLY);

            HttpClientContext context = HttpClientContext.create();
            Lookup<AuthSchemeProvider> authRegistry = RegistryBuilder.<AuthSchemeProvider>create()
                    .register(AuthSchemes.SPNEGO, new SPNegoSchemeFactory(true, true)).build();

            HttpClient client = HttpClients.custom().setDefaultAuthSchemeRegistry(authRegistry).build();
            BasicCredentialsProvider credentialsProvider = new BasicCredentialsProvider();
            credentialsProvider.setCredentials(AuthScope.ANY, new KerberosCredentials(credential));

            URL url = new URL(getServerURL(server), "/echo?a=b");
            context.setTargetHost(new HttpHost(url.getHost(), url.getPort()));
            context.setCredentialsProvider(credentialsProvider);
            context.setAuthSchemeRegistry(authRegistry);

            HttpGet get = new HttpGet(url.toURI());
            return client.execute(get, context);
        }
    });

    assertNotNull(resp);
    assertEquals(HttpURLConnection.HTTP_OK, resp.getStatusLine().getStatusCode());
    assertEquals("a:b", EntityUtils.toString(resp.getEntity()).trim());
}

From source file:org.keycloak.testsuite.federation.kerberos.AbstractKerberosTest.java

protected void initHttpClient(boolean useSpnego) {
    if (client != null) {
        cleanupApacheHttpClient();//w  w  w . j  a v a  2s .com
    }

    DefaultHttpClient httpClient = (DefaultHttpClient) new HttpClientBuilder().disableCookieCache(false)
            .build();

    httpClient.getAuthSchemes().register(AuthSchemes.SPNEGO, spnegoSchemeFactory);

    if (useSpnego) {
        Credentials fake = new Credentials() {

            @Override
            public String getPassword() {
                return null;
            }

            @Override
            public Principal getUserPrincipal() {
                return null;
            }

        };

        httpClient.getCredentialsProvider().setCredentials(new AuthScope(null, -1, null), fake);
    }
    ApacheHttpClient4Engine engine = new ApacheHttpClient4Engine(httpClient);
    client = new ResteasyClientBuilder().httpEngine(engine).build();
}

From source file:eu.fthevenet.binjr.data.adapters.HttpDataAdapterBase.java

protected CloseableHttpClient httpClientFactory() throws CannotInitializeDataAdapterException {
    try {//  w w  w  .j  av  a  2  s  .c  o m
        SSLConnectionSocketFactory csf = new SSLConnectionSocketFactory(createSslCustomContext(), null, null,
                SSLConnectionSocketFactory.getDefaultHostnameVerifier());
        RegistryBuilder<AuthSchemeProvider> schemeProviderBuilder = RegistryBuilder.create();
        schemeProviderBuilder.register(AuthSchemes.SPNEGO, new SPNegoSchemeFactory());
        CredentialsProvider credsProvider = new BasicCredentialsProvider();
        credsProvider.setCredentials(new AuthScope(null, -1, null), new Credentials() {
            @Override
            public Principal getUserPrincipal() {
                return null;
            }

            @Override
            public String getPassword() {
                return null;
            }
        });

        return HttpClients.custom().setDefaultAuthSchemeRegistry(schemeProviderBuilder.build())
                .setDefaultCredentialsProvider(credsProvider).setSSLSocketFactory(csf).build();
    } catch (Exception e) {
        throw new CannotInitializeDataAdapterException(
                "Could not initialize adapter to source '" + this.getSourceName() + "': " + e.getMessage(), e);
    }
}

From source file:org.apache.hadoop.hbase.thrift.TestThriftSpnegoHttpServer.java

private CloseableHttpClient createHttpClient() throws Exception {
    final Subject clientSubject = JaasKrbUtil.loginUsingKeytab(clientPrincipal, clientKeytab);
    final Set<Principal> clientPrincipals = clientSubject.getPrincipals();
    // Make sure the subject has a principal
    assertFalse(clientPrincipals.isEmpty());

    // Get a TGT for the subject (might have many, different encryption types). The first should
    // be the default encryption type.
    Set<KerberosTicket> privateCredentials = clientSubject.getPrivateCredentials(KerberosTicket.class);
    assertFalse(privateCredentials.isEmpty());
    KerberosTicket tgt = privateCredentials.iterator().next();
    assertNotNull(tgt);//w  w w . j a v  a2  s . c  om

    // The name of the principal
    final String clientPrincipalName = clientPrincipals.iterator().next().getName();

    return Subject.doAs(clientSubject, new PrivilegedExceptionAction<CloseableHttpClient>() {
        @Override
        public CloseableHttpClient run() throws Exception {
            // Logs in with Kerberos via GSS
            GSSManager gssManager = GSSManager.getInstance();
            // jGSS Kerberos login constant
            Oid oid = new Oid("1.2.840.113554.1.2.2");
            GSSName gssClient = gssManager.createName(clientPrincipalName, GSSName.NT_USER_NAME);
            GSSCredential credential = gssManager.createCredential(gssClient, GSSCredential.DEFAULT_LIFETIME,
                    oid, GSSCredential.INITIATE_ONLY);

            Lookup<AuthSchemeProvider> authRegistry = RegistryBuilder.<AuthSchemeProvider>create()
                    .register(AuthSchemes.SPNEGO, new SPNegoSchemeFactory(true, true)).build();

            BasicCredentialsProvider credentialsProvider = new BasicCredentialsProvider();
            credentialsProvider.setCredentials(AuthScope.ANY, new KerberosCredentials(credential));

            return HttpClients.custom().setDefaultAuthSchemeRegistry(authRegistry)
                    .setDefaultCredentialsProvider(credentialsProvider).build();
        }
    });
}