In the first post we introduced the use case and talked about the Kerberos authentication part.
In the second post we talked about Role Based Access Control.
In the third post, we described how to propagate the authenticated user through a SAML token and also covered OWSM configuration in OSB and SOA.
In this post we talk about the client, how we actually submit a Kerberos token along with our request to OAG.
In the first post, we said (verbatim):
“Perhaps the most challenging part was the test client. Supporting Kerberos was a must. Our first and natural attempt was OAG’s API Explorer (formerly OEG Service Explorer). After numerous attempts, configuration changes everywhere, we came to the the conclusion that it simply does not support the SPNEGO protocol properly. In summary, it seems that it doesn’t honor the second leg of the protocol, i.e., after receiving a “WWW-Authenticate: Negotiate” HTTP header in the response, it does not resubmit the request along with the Kerberos token. And we also did not find a way to bypass SPNEGO and submit the Kerberos token directly. The free version of SOAP UI also failed.
Fortunately, via Prasad’s blog post, we came to know a .Net-based tool called WCFStorm-lite, dead simple, that just works. However, another requirement for this exercise was to show test automation best practices. So the client tool should ideally have scripts capabilities, allowing for the client integration into an ANT build script, for example. WCFStorm-lite has some scripts capabilities, but we did not go any further in looking at them, because almost at the same time we got to know Apache CXF’s support for Kerberos.
That basically put an end to our research. What could be better than simply writing a piece of java code? At the heart of Apache CXF’s framework are what they call interceptors, which are basically web services handlers. An inbound interceptor is attached to a web service and processes the message before service invocation. An outbound interceptor is attached to a web service proxy and process the message as it leaves the client. An out-of-the-box Kerberos interceptor interfaces with the KDC, gets a Kerberos token and attaches it to the request before sending it out to the web service (in our use case, a web service exposed by OAG).”
Very well, let’s talk about how to configure a Kerberos Outbound Interceptor in Apache CXF.
1. Create a web service proxy using Apache CXF’s wsdl2java utility
> wsdl2java -ant -client –d <path-to-java-classes-to-be-generated> <wsdl>
-ant option will generate a handy build.xml file.
-client option will generate a handy java class with a main method to call the web service.
In our environment, we executed:
> wsdl2java -ant -client –d /home/oracle/workspace/KerberosClient/src http://exa7-vip1.osc.us.oracle.com:7201/placeOrder?wsdl
As the plan was to make our client integrated with JUnit and execute it via ant, we added the Interceptor part to the setup method.
3. Configure JAAS Login Module entries
The Kerberos interceptor uses JAAS (Java Authentication and Authorization Services) Kerberos Login Module. As such, the Login Module configuration is given as part of a configuration file specified via the java.security.auth.login.config system property. Here’s our file called login.config.
Notice that each entry refers to the Krb5LoginModule and some specific parameter, including the actual keytab containing a Krb5 principal. Remember that in post 1 we said a keytab should be generated for each user to be tested.
And the entry name itself is the one to match the value passed to policy.setAuthorization(keyTab) in line 23 in the code snippet above.
4. Externalize your input parameters and add a new task to your generated ant build file
Notice sysproperties java.security.auth.login.config and krb5.keytab in lines 5 and 6. At this point, their meanings are well understood.
And line 7 is your best friend when trying to tame the wild dog. You’ll get plenty of useful information for debugging Kerberos in the client.
May this 4-post journey be helpful and don’t let you stranded in the underworld!