0

I am trying out the SPNEGO feature in Websphere 7. I want to allow basic authentication in case of client not supporting SPNEGO.

In my web.xml, I have

<login-config>
    <auth-method>BASIC</auth-method>
    <realm-name>SampleApp Login</realm-name>
</login-config> 

In admin console of Websphere,

under Security -> Global Security -> Web and SIP security -> General settings, I have "Default to basic authentication when certificate authentication for the HTTPS client fails" checked,

and under Security -> Global Security -> Web and SIP security -> SPNEGO Web authentication, I have "Allow fall back to application authentication mechanism" checked.

When I am using client supports SPNEGO (e.g. IE) to access my web app, it seems fine. However, when I switch to clients that do not support SPNEGO (e.g. Firefox), it simply shows a message "SPNEGO authentication is not supported on this client." , without prompting me for basic authentication.

Can anyone give me some hints on what I may have missed? Thanks a lot.

1 Answer 1

1

In short, you need to provide an URL when SPNEGO fails.

This is how you do it:

  1. Prepare a page that you want to show when the SPNEGO negotiation fails and note the address to it
  2. In websphere administrative console, go to Global security > SPNEGO Web authentication
  3. Look in the list of "SPNEGO Filters", click the first item in the list
  4. You should now be in Global security > SPNEGO Web authentication > yourhost.domain.com
  5. Paste the address to the page to show when the SPNEGO negotiation fails in the following field: "SPNEGO not supported error page URL"
  6. Click OK, save changes. If you have not enabled "Dynamically update SPNEGO" you need to restart.

See 8e on the following page for details about that field: Enabling and configuring SPNEGO web authentication using the administrative console

I have used that feature myself for users who are not in active directory or who cant use SPNEGO for some other reason. It has a undesired behavior, and that is that it does not interpret utf-8 pages well. But if you only use the english alphabet you will not notice that (or if you use html enteties, such as &aring;.

You wrote that firefox does not support SPNEGO, but that is not correct, but some small tweeking needs to be done though. See Configuring the client browser to use SPNEGO for more details about that.

2
  • You are right for SPNEGO support for Firefox. I should have said: it is not supported by default. Haven't tried the implementation yet but it seems to me it is actually a feasible solution :) One more question: as I am in fact making a server providing RESTful WS, therefore it seems a bit irrelevant to make a login page coz user is not actually using a web-app. Is there any way to make WAS prompt for authentication detail just as what we normally use BASIC authentication? Thanks Feb 27, 2013 at 3:00
  • Yes, spengo support in FF is good, I use it to test with. I found this link, I have never tried this my self togheter with spnego, but maybe it can help you * enable basic auth in WAS * tweek when spnego should be active My idea is that you could inactivate spnego for clients that are not using it with filters (link 2) and active basic auth (link 1). No guaranties Feb 28, 2013 at 13:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.