spring-projects/spring-security-kerberos — pull request #5 by jeremystone (2014-04-09 08:14:02+00:00)
Title: WWW-Authenticate response and encrypt/decrypt capability

Have added two extra pieces of functionality that are essential when setting up a servlet to receive pushed WinRM SOAP events from the Microsoft WS-Management implementation:

(1) The WinRM client will refuse to talk to the servlet unless we respond to the Negotiate (or Kerberos) 'Authorization' header with an appropriate WWW-Authenticate response.
To this end have modified the KerberosTicketValidator so that it returns not just the user name but other information including the token returned by acceptSecContext in a new KerberosTicketValidation object.

This KerberosTicketValidation can then be used in a (new) ResponseHeaderSettingKerberosAuthenticationSuccessHandler which performs the setting of the WWW-Authenticate response header using the security context token.

(2) In order to go on to receive events, which the WinRM client sends in an encrypted pseudo MIME request, the ability to decrypt these (using the GSS API unwrap function) is also required. Hence the GSSContext is optionally also kept within the KerberosTicketValidation (default behaviour is to dispose it to provide backward compatibility) along with a couple of decrypt/encrypt methods that use it.

Hope that these can be incorporated into the main code.

Thanks,
Jeremy Stone