nuxeo/nuxeo-platform-login — pull request #2 by schambon (2012-12-17 09:54:33+00:00)
Title: Kerberos authenticator for Nuxeo 5.6

Hi,

This is the first version of a Kerberos authenticator for Nuxeo. It uses JCifs and JCifs-ext to handle SPNEGO tokens, and the platform's JAAS configuration to actually perform Kerberos authentication.

In the future this should be merged with the NTLM authenticator to provide a one-shop-stop SPNEGO authentication mechanism for Windows platforms. However right now this is sufficient for my needs.

Using Kerberos for integrated Windows authentication (IWA) rather than NTLM has several justifications:
- it's a more secure protocol, the use of which Microsoft promote (NTLM is officially deprecated since Windows 2000). As a result NTLM deployment "in the wild" is often patchy and often does not work
- Kerberos is more flexible as it supports weird configurations (multiple domains, multiple forests with forest-level or domain-level, one-way or two-way approbations…) typically used in larger organizations (e.g. holdings that acquire new subsidiaries simply create domain- or forest-level approbation relationships at AD level without further IT resource integration)
- Kerberos is fully multi-platform as all three of client, server and key distribution center can be either Windows or any flavour of UNIX

Up until now using Kerberos in Nuxeo was through CAS, therefore making the architecture more complex than it really needed to.

The implementation is heavily inspired of CAS Server's SPNEGO handler. The main drawback of this implementation is its reliance on JCifs-ext, which while it works perfectly is obsolete and not properly Mavenized. One way to address this is to use the more recent jcifs-krb5 library, but while it is still actively developed it is not supported by the JCifs team (as it is an external contribution) and it is not present in Maven Central either. Possibly, one could write (or generate) some custom code to handle SPNEGO Kerberos token decoding, but that smacks of reinventing the wheel.

Also note that I have written and tested this code against Nuxeo 5.6.0. It compiles against master (see the master branch of https://github.com/schambon/nuxeo-platform-login), but I didn't go to the trouble of setting up a 5.7-SNAPSHOT Nuxeo instance to test it thouroughly.

Setting up Kerberos can be disorienting the first time around. The README in the repo should be sufficient (if the contribution is accepted I'll write more detailed instructions that can go up in the Documentation Center, I promise) but if not do not hesitate to get in touch.

Cheers,
Sylvain.