Package org.forgerock.openig.assertion.plugin.kerberos

Class KerberosIdentityAssertionPlugin

java.lang.Object

org.forgerock.openig.assertion.plugin.kerberos.KerberosIdentityAssertionPlugin

All Implemented Interfaces:

IdentityAssertionPlugin

public final class KerberosIdentityAssertionPlugin
extends Object
implements IdentityAssertionPlugin

Provides support for validating a user's Kerberos token, works as an IdentityAssertionPlugin for the IdentityAssertionHandler. Loosely based on the AM Kerberos Node code found in openam-auth-trees/auth-nodes/src/main/java/org/forgerock/openam/auth/nodes/KerberosNode.java.

NTLM (NT Lan Manager) tokens are not supported by this plugin.

For more context around the APIs used in this class:

• MIT Kerberos Reference
• Windows Kerberos Authentication
• Java Kerberos Requirements
• Java Kerberos Client Token Validation
• Java Troubleshooting
• Enabling debug logging

 {
      "type": "KerberosIdentityAssertionPlugin",
      "config": {
          "serviceLogin"             : ref to ServiceLogin      [REQUIRED - The {@link ServiceLogin } implementation
                                                                            to use.]
          "trustedRealms"            : expression               [OPTIONAL - Specifies a list of trusted realms for the
                                                                            user Kerberos tickets. If a list of
                                                                            trusted realms are configured, then
                                                                            Kerberos tokens are only accepted if the
                                                                            realm part of the user principal, from the
                                                                            user’s Kerberos token, matches a trusted
                                                                            realm from the list. Defaults to an empty
                                                                            list and all realms being trusted.]
      }
    }
 
 

Example usage:

 {
         "type": "KerberosIdentityAssertionPlugin",
         "config": {
             "serviceLogin": "MyKeytabServiceLogin",
             "trustedKerberosRealms": ["EXAMPLE.COM"]
         }
     }
 
 

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	KerberosIdentityAssertionPlugin.Heaplet	Creates and initializes a KerberosIdentityAssertionPlugin in a heap environment.

Method Summary

Modifier and Type	Method	Description
Filter	preProcessingFilter()	Return a Filter to deal with any pre-processing requirements such as challenging the user for credentials by returning a WWW-Authenticate header.
Promise<IdentityAssertionClaims,IdentityAssertionPluginException>	process(Context context, Request request)	Preform some processing and return a set of claims to be returned in the Identity Assertion JWT.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

preProcessingFilter

public Filter preProcessingFilter()

Description copied from interface: IdentityAssertionPlugin

Return a Filter to deal with any pre-processing requirements such as challenging the user for credentials by returning a WWW-Authenticate header. The default implementation simply calls the next Handler without doing any processing. This filter is only triggered after the Identity Request JWT has been validated.

Specified by:

preProcessingFilter in interface IdentityAssertionPlugin

Returns:

a Filter to deal with any pre-processing requirements.

process

public Promise<IdentityAssertionClaims,IdentityAssertionPluginException> process(Context context,
 Request request)

Description copied from interface: IdentityAssertionPlugin

Preform some processing and return a set of claims to be returned in the Identity Assertion JWT. The processing may include some form of local authentication and/or authorization.

Specified by:

process in interface IdentityAssertionPlugin

Parameters:

context - The context.

request - The request.

Returns:

An IdentityAssertionClaims promise that represents claims to be returned in the Assertion JWT.