Migrating SPNEGO Authentication for JBoss EAP 6.4 Deployed Web Apps to JBoss EAP 8.0
As security systems and technologies continue to evolve, it is essential to keep up with the latest versions to ensure the highest level of security for your web applications. In this article, we will cover the process of migrating SPNEGO authentication for web apps deployed on JBoss EAP 6.4 to JBoss EAP 8.0.
Understanding SPNEGO Authentication
SPNEGO (Simple and Protected GSS-API Negotiation Mechanism) is a protocol used for negotiating security mechanisms between a client and a server. It is commonly used for single sign-on (SSO) in Windows environments, allowing users to authenticate using their Windows credentials.
JBoss EAP supports SPNEGO authentication through the use of the JBoss Negotiate Filter, which is included in the JBoss Web Server (formerly known as Tomcat). This filter allows for the integration of SPNEGO with JBoss EAP, enabling SSO for web applications.
Migrating SPNEGO Authentication to JBoss EAP 8.0
When migrating SPNEGO authentication from JBoss EAP 6.4 to JBoss EAP 8.0, it is important to note that there have been some changes to the security systems in JBoss EAP 8.0. These changes may affect the configuration of SPNEGO authentication in your web applications.
One of the main changes is the deprecation of the JBoss Negotiate Filter in favor of the new Undertow Negotiate Filter. This filter provides similar functionality to the JBoss Negotiate Filter, but is designed to work specifically with the Undertow web server, which is used in JBoss EAP 8.0.
To migrate SPNEGO authentication to JBoss EAP 8.0, you will need to update the configuration of your web application to use the Undertow Negotiate Filter. This can be done by adding the following lines to the web.xml file of your web application:
<filter>
<filter-name>NegotiateFilter</filter-name>
<filter-class>io.undertow.security.impl.NegotiateFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>NegotiateFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
In addition to updating the filter configuration, you will also need to ensure that the SPNEGO authentication mechanism is properly configured in the standalone.xml or domain.xml file of your JBoss EAP 8.0 server. This can be done by adding the following lines to the security-realm section of the configuration file:
<authentication>
<login-module code="Negotiate" flag="required">
<module-option name="realm" value=""/>
<module-option name="jaas-context" value=""/>
</login-module>
</authentication>
Where <your-realm> and <your-jaas-context> should be replaced with the appropriate values for your environment.
Migrating SPNEGO authentication from JBoss EAP 6.4 to JBoss EAP 8.0 involves updating the configuration of your web application to use the Undertow Negotiate Filter and properly configuring the SPNEGO authentication mechanism in the JBoss EAP 8.0 server. By following the steps outlined in this article, you can ensure a smooth migration process and maintain the security of your web applications.
References
- JBoss EAP 8.0 Security Guide: https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/8.0/html/security_guide/index
- JBoss EAP 8.0 Migration Guide: https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/8.0/html/migration_guide/index
- Undertow Negotiate Filter: https://docs.jboss.org/undertow/javadoc/2.0.0.Final/undertow-core/org/xnio/undertow/security/impl/NegotiateFilter.html