SPNEGO TAI custom properties configuration (deprecated)
The Simple and Protected GSS-API Negotiation Mechanism (SPNEGO) trust association interceptor (TAI) custom configuration properties control different operational aspects of the SPNEGO TAI. We can specify different property values for each application server.
Deprecated feature:
In WebSphere Application Server v6.1, a trust association interceptor (TAI) that uses the SPNEGO to securely negotiate and authenticate HTTP requests for secured resources was introduced. In WAS 7.0, this function is now deprecated. SPNEGO web authentication has taken its place to provide dynamic reload of the SPNEGO filters and to enable fallback to the application login method.
depfeatEach of the properties defined in the following table is specified in the Custom Properties panel for the SPNEGO TAI using the administrative console facility. For convenience, we can optionally place these properties in a properties file. In this case, the SPNEGO TAI loads the configuration properties from the file instead of the Custom Properties panel definition. Refer to com.ibm.ws.security.spnego.propertyReloadFile property as defined in SPNEGO TAI JVM configuration custom properties (deprecated).
To assign unique property names that identify each possible SPN, an SPN<id> is embedded in the property name and used to group the properties associated with each SPN. The SPN<id>s are numbered sequentially for each property group.
| Property Name | Required | Default Value |
|---|---|---|
| com.ibm.ws.security.spnego.SPN<id>.enableCredDelegate | No | false |
| com.ibm.ws.security.spnego.SPN<id>.filter | No | See the description that follows. |
| com.ibm.ws.security.spnego.SPN<id>.filterClass | No | See the description that follows. |
| com.ibm.ws.security.spnego.SPN<id>.hostName | Yes | None |
| com.ibm.ws.security.spnego.SPN<id>.NTLMTokenReceivedPage | No | See the description that follows. |
| com.ibm.ws.security.spnego.SPN<id>.spnegoNotSupportedPage | No | See the description that follows. |
| com.ibm.ws.security.spnego.SPN<id>.trimUserName | No | true |
The following commands tasks can be used to operate on these SPNEGO TAI properties:
- Add SPNEGO TAI properties using the wsadmin utility (deprecated)
- Deleting SPNEGO TAI properties using the wsadmin utility (deprecated)
- Modifying SPNEGO TAI properties using the wsadmin utility (deprecated)
- Displaying SPNEGO TAI properties using the wsadmin utility (deprecated)
com.ibm.ws.security.spnego.SPN<id>.enableCredDelegate
This property is optional. It indicates whether or not the Kerberos delegated credentials are stored by the SPNEGO TAI. This property enables the capability for an application to retrieve the stored credentials and propagate them to other applications downstream for additional SPNEGO authentication.
This property requires use of the advanced Kerberos credential delegation feature and requires development of custom logic by the application developer. The developer must interact directly with the Kerberos Ticket Granting Service (TGS) to obtain a Ticket Granting Ticket (TGT) using the delegated Kerberos credentials on behalf of the end-user who originated the request. The developer must also construct the appropriate Kerberos SPNEGO token and include it in the HTTP request to continue the downstream SPNEGO authentication process, including handling additional SPNEGO challenge-response exchange, if necessary.
com.ibm.ws.security.spnego.SPN<id>.filter
This property is optional. It defines the filtering criteria used by the specified class with the com.ibm.ws.security.spnego.SPN<id>.filterClass property. It defines arbitrary criteria that is meaningful to the implementation class used.
The com.ibm.ws.security.spnego.HTTPHeaderFilter default implementation class uses this property to define a list of selection rules that represent conditions that are matched against the HTTP request headers to determine whether or not the HTTP request is selected for SPNEGO authentication.
Each condition is specified with a key-value pair, separated from each other by a semicolon. The conditions are evaluated from left to right, as they display in the specified property. If all conditions are met, the HTTP request is selected for SPNEGO authentication.
The key and value in the key-value pair are separated by an operator that defines which condition is checked. The key identifies an HTTP request header to extract from the request and its value is compared with the value specified in the key-value pair according to the operator specification. If the header that is identified by the key is not present in the HTTP request, the condition is treated as not being met.
Any of the standard HTTP request headers can be used as the key in the key-value pairs. Refer to the HTTP specification for the list of valid headers. In addition, two keys are defined to extract information from the request, also useful as a selection criterion, which is not available through standard HTTP request headers. The remote-address key is used as a pseudo header to retrieve the remote TCP/IP address of the client application that sent the HTTP request. The request-URL key is used as a pseudo header to retrieve the URL used by the client application to make the request. The interceptor uses the result of the getRequestURL operation in the javax.servlet.http.HttpServletRequest interface to construct the web address. If a query string is present, the result of the getQueryString operation in the same interface is also used. In this case, the complete URL is constructed as follows:
String url = request.getRequestURL() + ‘?' + request.getQueryString();
The following operators and conditions are defined:
| Condition | Operator | Example |
|---|---|---|
| Match exactly | = =
Arguments are compared as equal. | host=host.my.company.com |
| Match partially (includes) | %=
Arguments are compared with a partial match being valid. | user-agent%=IE 6 |
| Match partially (includes one of many) | ^=
Arguments are compared with a partial match being valid for one of many arguments specified. | request-url^=webApp1|webApp2|webApp3 |
| Does not match | !=
Arguments are compared as not equal. | request-url!=noSPNEGO |
| Greater than | >
Arguments are compared lexogaphically as greater than. | remote-address>192.168.255.130 |
| Less than | <
Arguments are compared lexographically as less than. | remote-address<192.168.255.135 |
com.ibm.ws.security.spnego.SPN<id>.filterClass
This property is optional. Name of the Java class used by the SPNEGO TAI to select which HTTP requests are subject to SPNEGO authentication.
If no class is specified, the default com.ibm.ws.security.spnego.HTTPHeaderFilter implementation class is used. The Java class specified must implement the com.ibm.wsspi.security.spnego.SpnegoFilter interface. A default implementation of this interface is provided. Specify the com.ibm.ws.security.spnego.HTTPHeaderFilter class to use the default implementation. This class uses the selection rules specified with the com.ibm.ws.security.spnego.SPN<id>.filter property.
com.ibm.ws.security.spnego.SPN<id>.hostName
This property is required. Specifies the hostname in the SPN used by the SPNEGO TAI to establish a Kerberos secure context. It has no default value.
The hostname is the long form of hostname. For example, myHostName.austin.ibm.com. The Kerberos SPN is a string of the form HTTP/hostname@realm. The complete SPN is used with the Java Generic Security Service (JGSS) by the SPNEGO provider to obtain the security credential and security context used in the authentication process.
com.ibm.ws.security.spnego.SPN<id>.NTLMTokenReceivedPage
This property is optional. Specifies the web address of a resource containing the content that the SPNEGO TAI includes in the HTTP response that the (browser) client application displays when the SPNEGO token is received by the interceptor when the challenge-response handshake contains a NT LAN Manager (NTLM) token instead of the expected SPNEGO token.
It can specify a web (http://) or a file (file://) resource. If not specified or the interceptor cannot find the specified resource, the following content is used:
<html><head><title>An NTLM Token was received.</title></head> <body>Your browser configuration is correct, but we have not logged into a supported icrosoft(R) Windows(R) Domain. <p>Please login to the application using the normal login page.</html>
com.ibm.ws.security.spnego.SPN<id>.spnegoNotSupportedPage
This property is optional. Specifies the web address of a resource containing the content that the SPNEGO TAI includes in the HTTP response that the (browser) client application displays if it does not support SPNEGO authentication. It can specify a Web (http://) or a file (file://) resource.
If not specified or the interceptor cannot find the specified resource, the following content is used:
<html><head><title>SPNEGO authentication is not supported</title></head> <body>SPNEGO authentication is not supported on this client</body></html>;
com.ibm.ws.security.spnego.SPN<id>.trimUserName
This property is optional. It specifies whether (true) or not (false) the SPNEGO TAI is to remove the suffix of the principal user name, starting from the "@" that precedes the Kerberos realm name.
If set to true, the suffix of the principal user name is removed. If set to false, the suffix of the principal name is retained. The default value used is true. For example,
When com.ibm.ws.security.spnego.SPN<id>.trimUserName = true
bobsmith@myKerberosRealm becomes bobsmith
When com.ibm.ws.security.spnego.SPN<id>.trimUserName = false
bobsmith@myKerberosRealm remains bobsmith@myKerberosRealm
Related: