1. A bridge between two worlds:
Spring Security & Kerberos
Claudiu Stancu

3. •Me & the other me
•Security concepts
•Kerberos
•All together
•Code time
Agenda
3

4. IN YOUR ZONE
About me…
4
Development Discipline Lead at Endava

5. IN YOUR ZONE
The other me…
5

6. IN YOUR ZONE
Security concepts – Data types
6
PUBLIC PRIVATE
CONFIDENTIAL SECRET

7. IN YOUR ZONE
Authentication
7
“The process of verifying that the users of our application
are who they say they are”

8. IN YOUR ZONE
Authentication
8
Credentials Based

9. IN YOUR ZONE
Authentication
9
Biometrics Authentication

10. IN YOUR ZONE
Authentication
10
Two factor authentication

11. IN YOUR ZONE
Authentication
11
• Browser certificates
• Single Sing On
• Hardware authentication

12. IN YOUR ZONE
Authorization
12
Assign authenticated Principals to one or more Roles
Assign the Principal’s Role(s) to secured resources

13. IN YOUR ZONE
Spring Security
13
Servlet Filters
Delegation

14. IN YOUR ZONE
Spring Security – Filters
14
o.s.s.web.context.SecurityContextPersistenceFilter
o.s.s.web.authentication.logout.LogoutFilter
o.s.s.web.authentication.UsernamePasswordAuthentication
o.s.s.web.session.SessionManagementFilter
Secured Resource
Request Response

15. IN YOUR ZONE
Spring Security – Fundamentals
15
Security Interceptor
Authentication
Manager
Access Decision
Manager
Run-As
Manager
After-Invocation
Manager

16. IN YOUR ZONE
Spring Security – Authentication Manager
16
Authentication
Manager
Provider
Manager
LDAP
Authentication
Provider
CAS
Authentication
Provider
Kerberos
Authentication
Provider
DAO
Authentication
Provider
Remember Me
Authentication
Provider

17. IN YOUR ZONE
Spring Security – Access Decision Manager
17
Affirmative Based
Abstract
Decision Voter
Access Decision
Manager
Abstract Access
Decision
Manager
Consensus Based Unanimous Based Role Voter
Access Decision Manager Grant / Deny access?
Affirmative based At least one voter grant access
Consensus based Majority grant access
Unanimous based If all voters grant access

18. IN YOUR ZONE
Kerberos
18

19. IN YOUR ZONE
Kerberos
19
{cstancu, 192.168.1.2}
SessionKey1
TGT
TGT
SessionKey1

20. IN YOUR ZONE
Kerberos
20
{SessionKey1}
Authenticator TGT
{SessionKey2}
Authenticator
Mail Ticket
{SessionKey2}
ok
TGT
SessionKey1
Mail Ticket
{SessionKey1}
SessionKey2
Mail Ticket
SessionKey2

21. IN YOUR ZONE
All together
21
(1)HTTP GET resource.html

22. IN YOUR ZONE
All together
22
(3) Kerberos TGS_REQ

23. IN YOUR ZONE
All together
23
(5)HTTPGETAuthorization
Negotiate w/SPNEGO Token
(6) HTTP 200 – OK
resource.html

24. IN YOUR ZONE
Code time…
24

25. IN YOUR ZONE 25

26. IN YOUR ZONE 26
Claudiu Stancu | Development Discipline Lead