IdStory Identity Manager

Hi Honza,
could you please translate your private comment and made it public to see some progress in ticket?
We have whole request available in application, so new authentication filter can be implemented.

• Tomcat can be kerberized on windows, steps in this guide https://dzone.com/articles/do-not-publish-configuring-tomcat-single-sign-on-w led to kerberos authentication into tomcat container.
• Authentication didn't work for me when Firefox was used (although I configured network.negotiate-auth.delegation-uris a network.negotiate-auth.trusted-uris parameters)
• Authentication worked with Internet Explorer configured as stated at https://wiki.czechidm.com/tutorial/adm/sso_ad_domain

Tests were carried out in virtual machines "klon Patrik - GFR simulace testovani SSO HONZA" (172.31.255.169) and 172.31.255.181 (Windows DC).

Domain username can be gained in kerberized tomcat e.g. by this JSP code:

<%= new String("Hello!") %>
<br>
<%= request.getRemoteUser() %>
<br>
<%= request.getUserPrincipal() %>
<br> 

Output:

Hello!
 honza
 GenericPrincipal[honza(CN=idmusers,CN=Users,DC=lopaticka,DC=piskoviste,DC=bcv,idmusers,)]

Is it possible to adjust application to use username from methods getRemoteUser() or getUserPrincipal() instead of the login form ?

The similar feature already exists when the username is in HTTP header.
It can be activated by these configuration parameters:

idm.sec.core.authentication-filter.core-sso-authentication-filter.enabled=true
idm.sec.core.authentication-filter.core-sso-authentication-filter.header-name=REMOTE_USER
idm.sec.core.authentication-filter.core-sso-authentication-filter.uid-suffixes=@COMPANY.CZ

In case that kerberos server is not working, we need a fallback method to login to IdM app. Unfortunatelly tomcat doesn't allow to specify more than one <login-config><auth-method> per one webapp.

Neither setting 2 different tcp ports with different authorization schemas is possible.

sources:
http://tomcat.10.x6.nabble.com/How-to-configure-SPNEGO-authentication-with-fallback-to-FORM-auth-td5052243.html
https://stackoverflow.com/questions/6150443/multiple-login-config-for-java-webapp
https://stackoverflow.com/questions/34142746/is-tomcat-capable-of-using-mixed-authentication-on-one-app-basic-and-client-cer
https://stackoverflow.com/questions/17673634/tomcat-multiple-authentication-schemes-for-a-single-web-application

According to this documentation, jboss supports fallback method, but I didn't test it:
https://access.redhat.com/documentation/en-us/jboss_enterprise_application_platform/6.3/html/security_guide/configure_spnego_fall_back_to_form_authentication

Hi Radek,
could you please provide me with the WAR file ? Thank you.

Yes, I can, but it's one command in maven :)
https://github.com/bcvsolutions/CzechIdMng/tree/develop/Realization/backend#build-and-deploy
War (snapshot) is here:
https://nexus.bcvsolutions.eu/#browse/browse:maven-snapshots:eu%2Fbcvsolutions%2Fidm%2Fidm-app%2F9.7.13-SNAPSHOT%2F9.7.13-20191202.091422-1%2Fidm-app-9.7.13-20191202.091422-1.war

I don't know why, but when I tried to download the above mentioned app-9.7.13-20191202.091422-1.war file from Nexus I got the error: "Filter undefined (maven-snapshots) not found".

But after couple tries and attemtps I succeeded to build the war file. I tested idm app with these additional settings:

idm.sec.core.authentication-filter.core-remote-user-authentication-filter.enabled=true
idm.sec.core.authentication-filter.core-remote-user-authentication-filter.uid-suffixes=@LOPATICKA.PISKOVISTE.BCV
#idm.sec.core.authentication-filter.core-remote-user-authentication-filter.forbid

I confirm that login into application works based on the username in serverlet.

Login into nexus is needed to read snapshots. But it's great, if you was able to build it.

Can we do a code review and close this ticket?

Yes, I consider this feature completed, thanks. Please perform the code review and close the ticket.

I did review. Looks simple and great. Thanks for that.