Transferring SPENGO token via a web service call or a servlet

Hi,

In the examples I have seen, a SPENGO token is transferred from client to server via sockets. Once the token is obtained,

GSS-APi calls like the following can be called to extract the userId

from the SPENGO token. In the code below,

innerContextToken would be obtained after some socket based conversation.

GSSManager manager = GSSManager.getInstance();

GSSName serverName = manager.createName(serverPrincipalName, null);

GSSContext context = manager.createContext(serverName, krb5MechanismOid, null, GSSContext.DEFAULT_LIFETIME);

byte[] neg_token_targ = context.acceptSecContext(innerContextToken, 0, innerContextToken.length);

userPrincipalName = context.getSrcName();

Can innerContextToken be passed from client to server via a web service call ? Or could someone point me to a sample on how the

socket based communication for token transfer could be replaced with a HTTP via a servlet or if its possible to do so with a web service call ?

Thanks

Raman

[1044 byte] By [SecurityTyroa] at [2007-11-26 16:07:18]
# 1
GSS is token based, which means you're free to transfer the token in any means. A token is simply a binary byte block, make sure you properly encode it (possibly BASE64) before you send it out.
wangwja at 2007-7-8 22:29:33 > top of Java-index,Security,Kerberos & Java GSS (JGSS)...
# 2

WangWj,

Thanks for your reply.

When sockets are used for communication, the client & server go back & forth before a context gets established- SPNEGO is a negotiation mechanism after all - back & forth is to be expected in a handshaking protocol.

Bouncing bytes back and forth between the client & server is OK with sockets but it doesnt work with a web service. Are you saying that a single shot transfer of the SPNEGO token is all that is needed ?

Thanks in advance,

Raman

SecurityTyroa at 2007-7-8 22:29:33 > top of Java-index,Security,Kerberos & Java GSS (JGSS)...
# 3

> server is OK with sockets but it doesnt work with a

> web service. Are you saying that a single shot

> transfer of the SPNEGO token is all that is needed ?

I remember so, at least for one-way authentication SPNEGO based on Kerberos 5. You may check it by viewing the HTTP headers sending across a Windows Integrated Security IE vs IIS session.

wangwja at 2007-7-8 22:29:33 > top of Java-index,Security,Kerberos & Java GSS (JGSS)...