Project Description
Tomcat is an servlets container. With tomcatspnego, users working on a Windows client OS and IE or Firefox, can be silently authenticated ( SSO ) to a Tomcat running on a Windows or Unix server, via Spnego, and so via NTLM or Kerberos.
You can define autorizations to tomcat's applications with domain's groups.
There are now three versions, one with JNI and a DLL, another with JNA (it is more easier to read the code), and another with a Windows service and TCP. So Tomcat can be on a Windows server, but also on an Unix server. (Linux is an Unix)
The versions with JNI and JNA works only on Windows.
The three versions run on x86 and x64.
The version with JNI fixes a bug. Now, it works well on x64.
With the versions 15062010 tcp and jna, it is possible to find the groups of the users via a Realm : JDBCRealm , JNDIRealm or UserDatabaseRealm(tomcat-users.xml)
The versions jna and tcp 14062010 have a bug but only when we use the parameter nogroupsinad.
The configuration of IE is in the documentation. You have remarks on this configuration on the discussion.
Version 21112010
a)The version (21112010) add the possibility to use tomcat 7. Some methods of the classes GenericPrinipal and AuthenticatorBase of tomcat have been modified. So the java code of the valve SSPAutenticator has also been modified.
b)The jna version use now the version 2.3.7of the project Java Native Access. This project has been refactored. So the code of the jna version has been modified.
c)There is a new parameter with the tcp and jna versions: usernamewithoutdomainasprefix.
With the version 21112010:
-If the user is not authenticated, tomcatspnego send 403 and not 401 with the version 7 of tomcat.
-You cannot use the methods login, logout and authenticate of thge HttpServletRequest defined in the 3.0 Java Servlet Specification and so in tomcat 7.
-The guest user can be authenticated. This user is member of the group EveryOne but not of the "Authenticated Users". So, if you do not want to authenticate a guest , do not use the group Everyone in web.xml.
With the version 15032011
these problems are resolved with the version of tomcatspnego.
The last version is 0212012 (January, 2 2012)
Download the trunk-0212012
Maciej Matecki (mmatecki) sent the file Tomcat TomcatSpnegoSpringSecuritySample. With Spring Security 3.0 see Alberto Aceveido (albertoaceiveido) in http://tomcatspnego.codeplex.com/workitem/5025
Before to write these three versions with sspi, I wrote a first version with gssapi and only java code. You can find it (trunk-gssapi)
Dominique Guerin