Package net.shibboleth.idp.authn.spnego.impl

# Class SPNEGOAuthnController

java.lang.Object
net.shibboleth.idp.authn.spnego.impl.SPNEGOAuthnController

@Controller @RequestMapping("%{idp.authn.spnego.externalAuthnPath:/Authn/SPNEGO}") public class SPNEGOAuthnController extends Object
MVC controller for managing the SPNEGO exchanges implemented as an `ExternalAuthentication` mechanism.

The handler methods either return contents back to the browser by returning an appropriate ResponseEntity<String> object, or they return back to the flow by calling `ExternalAuthentication.finishExternalAuthentication(String, HttpServletRequest, HttpServletResponse)` and returning null. On unrecoverable errors, an exception is thrown.

## Field Summary

Fields
Modifier and Type
Field
Description
`private StringDigester`
`cspDigester`
CSP digest computation bean.
`private IdentifierGenerationStrategy`
`cspNonceGenerator`
CSP nonce generator bean.
`private final org.slf4j.Logger`
`log`
Class logger.
`static final String`
`NTLM_UNSUPPORTED`
Event ID indicating that NTLM was attempted by the client.
`static final String`
`SPNEGO_NOT_AVAILABLE`
Event ID indicating that SPNEGO is not supported by the client or is not available for other reasons.

## Constructor Summary

Constructors
Constructor
Description
`SPNEGOAuthnController()`

## Method Summary

Modifier and Type
Method
Description
`ModelAndView`
`continueSPNEGO(String conversationKey, String authorizationHeader, HttpServletRequest httpRequest, HttpServletResponse httpResponse)`
Process an input GSS token from the client and attempt to complete the context establishment process.
`protected GSSContextAcceptor`
`createGSSContextAcceptor(SPNEGOContext spnegoCtx)`
Create a new `GSSContextAcceptor` object.
`private ModelAndView`
`createModelAndView(ProfileRequestContext profileRequestContext, HttpServletRequest httpRequest, HttpServletResponse httpResponse)`
Create a `ModelAndView` object to return.
`private void`
`finishWithError(String key, HttpServletRequest httpRequest, HttpServletResponse httpResponse, String error)`
Finish the authentication process with an error.
`private void`
`finishWithException(String key, HttpServletRequest httpRequest, HttpServletResponse httpResponse, Exception ex)`
Finish the authentication process with an exception.
`private void`
`finishWithSuccess(String key, HttpServletRequest httpRequest, HttpServletResponse httpResponse, KerberosPrincipal kerberosPrincipal)`
Finish the authentication process successfully.
`private SPNEGOContext`
`getSPNEGOContext(ProfileRequestContext prc)`
Navigate to the `SPNEGOContext` in the context tree.
`void`
`handleError(String conversationKey, HttpServletRequest httpRequest, HttpServletResponse httpResponse)`
Respond to a user signaling that an error occurred.
`private boolean`
`isNTLMMechanism(byte[] token)`
Check if the GSS-API data represents an NTLM mechanism request.
`private ModelAndView`
`replyUnauthorizedNegotiate(ProfileRequestContext profileRequestContext, HttpServletRequest httpRequest, HttpServletResponse httpResponse)`
Send back an empty Negotiate challenge.
`private ModelAndView`
`replyUnauthorizedNegotiate(ProfileRequestContext profileRequestContext, HttpServletRequest httpRequest, HttpServletResponse httpResponse, String base64Token)`
Send back a Negotiate challenge token.
`void`
`setCSPDigester(StringDigester digester)`
Sets a `StringDigester` to use in computing CSP digests in views.
`void`
`setCSPNonceGenerator(IdentifierGenerationStrategy strategy)`
Sets an `IdentifierGenerationStrategy` to use in computing CSP nonces in views.
`ModelAndView`
`startSPNEGO(String conversationKey, HttpServletRequest httpRequest, HttpServletResponse httpResponse)`
Handle initial request that starts SPNEGO.

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

## Field Details

### SPNEGO_NOT_AVAILABLE

@Nonnull @NotEmpty public static final String SPNEGO_NOT_AVAILABLE
Event ID indicating that SPNEGO is not supported by the client or is not available for other reasons.

See Also:
  - Constant Field Values

### NTLM_UNSUPPORTED

@Nonnull @NotEmpty public static final String NTLM_UNSUPPORTED
Event ID indicating that NTLM was attempted by the client.

See Also:
  - Constant Field Values

### log

@Nonnull private final org.slf4j.Logger log
Class logger.

### cspDigester

@Nullable private StringDigester cspDigester
CSP digest computation bean.

### cspNonceGenerator

@Nullable private IdentifierGenerationStrategy cspNonceGenerator
CSP nonce generator bean.

## Constructor Details

### SPNEGOAuthnController

public SPNEGOAuthnController()

## Method Details

### setCSPDigester

public void setCSPDigester(@Nullable StringDigester digester)
Sets a `StringDigester` to use in computing CSP digests in views.

Parameters:
  `digester` - digester to set
Since:
  5.1.0

### setCSPNonceGenerator

public void setCSPNonceGenerator(@Nullable IdentifierGenerationStrategy strategy)
Sets an `IdentifierGenerationStrategy` to use in computing CSP nonces in views.

Parameters:
  `strategy` - nonce strategy
Since:
  5.1.0

### startSPNEGO

@RequestMapping(value="/{conversationKey}", method=GET) @Nullable public ModelAndView startSPNEGO(@PathVariable @Nonnull @NotEmpty String conversationKey, @Nonnull HttpServletRequest httpRequest, @Nonnull HttpServletResponse httpResponse) throws ExternalAuthenticationException, IOException
Handle initial request that starts SPNEGO.

Parameters:
  `conversationKey` - the SWF conversation key
  `httpRequest` - the HTTP request
  `httpResponse` - the HTTP response
Returns:
  the response view
Throws:
  `IOException` - ...
  `ExternalAuthenticationException` - ...

### continueSPNEGO

@RequestMapping(value="/{conversationKey}", method=GET, headers="Authorization") @Nullable public ModelAndView continueSPNEGO(@PathVariable @Nonnull @NotEmpty String conversationKey, @RequestHeader("Authorization") @Nonnull @NotEmpty String authorizationHeader, @Nonnull HttpServletRequest httpRequest, @Nonnull HttpServletResponse httpResponse) throws ExternalAuthenticationException, IOException
Process an input GSS token from the client and attempt to complete the context establishment process.

Parameters:
  `conversationKey` - the conversation key
  `authorizationHeader` - the token from the client
  `httpRequest` - the HTTP request
  `httpResponse` - the HTTP response
Returns:
  the response view
Throws:
  `ExternalAuthenticationException` - ...
  `IOException` - ...

### handleError

@RequestMapping(value="/{conversationKey}/error", method=GET) public void handleError(@PathVariable @Nonnull String conversationKey, @Nonnull HttpServletRequest httpRequest, @Nonnull HttpServletResponse httpResponse) throws ExternalAuthenticationException, IOException
Respond to a user signaling that an error occurred.

Parameters:
  `conversationKey` - the conversation key
  `httpRequest` - the HTTP request
  `httpResponse` - the HTTP response
Throws:
  `IOException` - ...
  `ExternalAuthenticationException` - ...

### finishWithSuccess

private void finishWithSuccess(@Nonnull @NotEmpty String key, @Nonnull HttpServletRequest httpRequest, @Nonnull HttpServletResponse httpResponse, @Nonnull KerberosPrincipal kerberosPrincipal) throws ExternalAuthenticationException, IOException
Finish the authentication process successfully.

Sets the attribute `ExternalAuthentication.SUBJECT_KEY`.

Parameters:
  `key` - the conversation key
  `httpRequest` - the HTTP request
  `httpResponse` - the HTTP response
  `kerberosPrincipal` - the Kerberos principal to return
Throws:
  `IOException` - ...
  `ExternalAuthenticationException` - ...

### finishWithError

private void finishWithError(@Nonnull @NotEmpty String key, @Nonnull HttpServletRequest httpRequest, @Nonnull HttpServletResponse httpResponse, @Nonnull @NotEmpty String error) throws ExternalAuthenticationException, IOException
Finish the authentication process with an error.

Sets the attribute `ExternalAuthentication.AUTHENTICATION_ERROR_KEY`.

Parameters:
  `key` - the conversation key
  `httpRequest` - the HTTP request
  `httpResponse` - the HTTP response
  `error` - the error string/event to return
Throws:
  `IOException` - ...
  `ExternalAuthenticationException` - ...

### finishWithException

private void finishWithException(@Nonnull @NotEmpty String key, @Nonnull HttpServletRequest httpRequest, @Nonnull HttpServletResponse httpResponse, @Nonnull Exception ex) throws ExternalAuthenticationException, IOException
Finish the authentication process with an exception.

Sets the attribute `ExternalAuthentication.AUTHENTICATION_EXCEPTION_KEY`.

Parameters:
  `key` - the conversation key
  `httpRequest` - the HTTP request
  `httpResponse` - the HTTP response
  `ex` - the exception that has been thrown
Throws:
  `IOException` - ...
  `ExternalAuthenticationException` - ...

### getSPNEGOContext

@Nullable private SPNEGOContext getSPNEGOContext(@Nonnull ProfileRequestContext prc)
Navigate to the `SPNEGOContext` in the context tree.

Parameters:
  `prc` - profile request context
Returns:
  the child context, or null

### createGSSContextAcceptor

@Nonnull protected GSSContextAcceptor createGSSContextAcceptor(@Nonnull SPNEGOContext spnegoCtx) throws GSSException
Create a new `GSSContextAcceptor` object. (Created in a separate method to support unit testing.)

Parameters:
  `spnegoCtx` - the `SPNEGOContext` conteining the `KerberosSettings`
Returns:
  a new `GSSContextAcceptor`
Throws:
  `GSSException` - if an error occurs while creating the `GSSContextAcceptor`.

### replyUnauthorizedNegotiate

@Nonnull private ModelAndView replyUnauthorizedNegotiate(@Nonnull ProfileRequestContext profileRequestContext, @Nonnull HttpServletRequest httpRequest, @Nonnull HttpServletResponse httpResponse)
Send back an empty Negotiate challenge.

Parameters:
  `profileRequestContext` - profile request context
  `httpRequest` - servlet request
  `httpResponse` - servlet response
Returns:
  a `ModelAndView` wrapping the response

### replyUnauthorizedNegotiate

@Nonnull private ModelAndView replyUnauthorizedNegotiate(@Nonnull ProfileRequestContext profileRequestContext, @Nonnull HttpServletRequest httpRequest, @Nonnull HttpServletResponse httpResponse, @Nonnull String base64Token)
Send back a Negotiate challenge token.

Parameters:
  `profileRequestContext` - profile request context
  `httpRequest` - servlet request
  `httpResponse` - servlet response
  `base64Token` - challenge token to send back
Returns:
  a `ModelAndView` wrapping the response

### createModelAndView

@Nonnull private ModelAndView createModelAndView(@Nonnull ProfileRequestContext profileRequestContext, @Nonnull HttpServletRequest httpRequest, @Nonnull HttpServletResponse httpResponse)
Create a `ModelAndView` object to return.

Parameters:
  `profileRequestContext` - profile request context
  `httpRequest` - the HTTP request
  `httpResponse` - the HTTP response
Returns:
  the ModelAndView object

### isNTLMMechanism

private boolean isNTLMMechanism(@Nonnull byte[] token)
Check if the GSS-API data represents an NTLM mechanism request.

Parameters:
  `token` - token retrieved from the Authorization header.
Returns:
  true iff it represents a NTLM mechanism