使用 SSPI 从运行在 Windows 上的 Java 应用程序获取 SSO
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/3580099/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Using SSPI to get SSO from Java application running on Windows
提问by Max Caceres
I have a Java application running on Windows that needs to authenticate to a webapp using Kerberos/SPNEGO. I'm aware of how to configure JAAS to achieve this, but I find the Java (JDK6 and JDK7beta) Kerberos implementation to be lacking a couple important features I need. For example, support for referrals or using the DNS to figure out the realm of a host (I have a multi-realm environment).
我有一个在 Windows 上运行的 Java 应用程序，它需要使用 Kerberos/SPNEGO 对 web 应用程序进行身份验证。我知道如何配置 JAAS 来实现这一点，但我发现 Java（JDK6 和 JDK7beta）Kerberos 实现缺少一些我需要的重要功能。例如，支持引用或使用 DNS 来确定主机的领域（我有一个多领域环境）。
Is there a third-party module that can implement authentication using the Windows native SSPI? We've already gone through the trouble of configuring our Windows clients to work within our environment, it'd be nice to not have to do it again for Java. I'm aware of Waffleand its WindowsLoginModule, but it doesn't seem to do SSO as it requires users to re-enter their credentials into the application.
是否有第三方模块可以使用 Windows 原生SSPI实现身份验证？我们已经解决了将 Windows 客户端配置为在我们的环境中工作的麻烦，最好不必为 Java 再次执行此操作。我知道Waffle及其 WindowsLoginModule，但它似乎没有执行 SSO，因为它需要用户将其凭据重新输入到应用程序中。
回答by Remo
We've had a similar issue. The main problem for us was that the GSS-API implementation fails when using Windows UAC and we solved it using Waffle.
我们也遇到过类似的问题。我们的主要问题是在使用 Windows UAC 时 GSS-API 实现失败，我们使用 Waffle 解决了它。
Waffleis basically a wrapper for the JNA calls to SSPI. We've managed to implement SSO using Waffle by overriding the class sun.net.www.protocol.http.NegotiatorImpl:
Waffle基本上是 JNA 调用 SSPI 的包装器。我们已经通过覆盖类成功地使用 Waffle 实现了 SSO sun.net.www.protocol.http.NegotiatorImpl：
package sun.net.www.protocol.http;
import java.io.IOException;
import waffle.windows.auth.impl.WindowsSecurityContextImpl;
public class NegotiatorImpl extends Negotiator {
private String serviceName;
public NegotiatorImpl(HttpCallerInfo hci) throws IOException {
this.serviceName = "HTTP/" + hci.host.toLowerCase();
}
@Override
public byte[] firstToken() throws IOException {
return WindowsSecurityContextImpl.getCurrent("Negotiate", serviceName).getToken();
}
@Override
public byte[] nextToken(byte[] in) throws IOException {
return new byte[0];
}
}
Then you can create a JAR with holding only this class and copy it along with the Waffle & JNA JARs to ./jre/lib/endorsedof your JVM. Using the Java Endorsed Standards Override Mechanismof the JVM, this replaces the default Negotiatorimplementation of the JVM.
然后，您可以创建一个仅包含此类的 JAR，并将其与 Waffle 和 JNA JAR 一起复制到您的 JVM 的./jre/lib/endorsed。使用JVM的Java Endorsed Standards Override Mechanism，这取代了 JVM 的默认Negotiator实现。
