apache 使用 SPNEGO/Kerberos 和委托的 Tomcat 身份验证
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/339101/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Tomcat authentication using SPNEGO/Kerberos and delegation
提问by Tony Lee
Is there an apache module that implements Kerberos authentication for use by Tomcat and also supports Kerberos delegation?
是否有实现 Kerberos 身份验证以供 Tomcat 使用并支持 Kerberos 委派的 apache 模块？
I've already looked at mod_spnego and it throws away the SSPI context it creates only keeping the principal name. Instead, I'm looking for a module that would allow for the delegation of the ticket sent to Tomcat - that is, taking the service ticket sent for authentication and using it server side to access another service on behalf of the user.
我已经看过 mod_spnego，它丢弃了它创建的 SSPI 上下文，只保留主体名称。相反，我正在寻找一个模块，该模块允许委托发送到 Tomcat 的票证 - 也就是说，获取发送用于身份验证的服务票证并使用它的服务器端代表用户访问另一个服务。
EDIT: To clarify, I need to impersonate under Win32 using the GSS/SSPI context so when legacy code connects to another server, the delegated credentials are used.
编辑：为了澄清，我需要使用 GSS/SSPI 上下文在 Win32 下模拟，以便当遗留代码连接到另一台服务器时，使用委托凭据。
采纳答案by Nico
WAFFLE(Windows Authentication Functional Framework) now provides that feature starting from v1.4beta.
WAFFLE（Windows 身份验证功能框架）现在从 v1.4beta 开始提供该功能。
It provides a ServletFilter that uses native Windows APIs to authenticate the user, either using Basic or Negotiate authentication. The user then can be impersonated, and native APIs calls will be performed with the access token of the impersonated user.
它提供了一个 ServletFilter，它使用本机 Windows API 来验证用户，使用基本或协商身份验证。然后可以模拟用户，并且将使用模拟用户的访问令牌执行本机 API 调用。
回答by Suppressingfire
How about using the JAAS realm and using the kerberos 5 JAAS module?
如何使用 JAAS 领域和使用 kerberos 5 JAAS 模块？
http://tomcat.apache.org/tomcat-6.0-doc/realm-howto.html#JAASRealm
http://tomcat.apache.org/tomcat-6.0-doc/realm-howto.html#JAASRealm
http://java.sun.com/j2se/1.4.2/docs/guide/security/jaas/spec/com/sun/security/auth/module/Krb5LoginModule.html
http://java.sun.com/j2se/1.4.2/docs/guide/security/jaas/spec/com/sun/security/auth/module/Krb5LoginModule.html
Looks like it might require a little coding, but the pieces should be there.
看起来它可能需要一点编码，但碎片应该在那里。
回答by Pat Gonzalez
Here's a http://spnego.sourceforge.net/credential_delegation.htmltutorial. It implements Kerberos/SPNEGO as an HTTP Servlet Filter and supports credential delegation.
这是一个http://spnego.sourceforge.net/credential_delegation.html教程。它将 Kerberos/SPNEGO 实现为 HTTP Servlet 过滤器并支持凭证委托。
