I have a spring security kerberos setup with keytab file. I get a connection reset error when a file upload operation is done. It happens only if file size is greater than 2MB. When spring security is turned off, I can upload files greater than 2MB.
My understanding of SPNEGO based authentcation is as below.
- Ajax request is sent from broweser
- Servers checks for token in header and if not found, send 401 negotiate
- Client resends the request with kerberos token
- Server decrypts token using keytab and gladly allows further communication
A typical request will have the kerberos auth token sent in the header after negotiation redirect. These failed request don't have the token in the header, which means negotiation phase didn't start.
Is there any additional headers to be set or removed for file uploads? Where is the 2mb limit set? I see Jboss has a max-post parameter but then uploads work fine when security is removed.
Environment: Jboss EAP 6.4.16(10 servers stateless), JVM 1.7, RHEL 6. No web server in front.
Header on failed requests -
Provisional headers are shown
Accept:application/json, text/javascript, */*; q=0.01
Content-Type:multipart/form-data; boundary=----WebKitFormBoundaryeb4P029q02XzceLA
Origin:xxxxx
Referer:http://xxxxxxxxxxxxxxx.html?xxxxxxxxxxxx
User-Agent:Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like
Gecko) Chrome/43.0.2357.130 Safari/537.36
X-Requested-With:XMLHttpRequest
------WebKitFormBoundaryeb4P029q02XzceLA
Content-Disposition: form-data; name="entry"; filename="test.pdf"
Content-Type: application/pdf
------WebKitFormBoundaryeb4P029q02XzceLA--
Code Partial:
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
@Value("${auth.keytab.url}")
private Resource keyTabLocation;
private static final String SECURITY_ACCESS_ROLE = "isFullyAuthenticated() and hasRole('SOME_ROLE')";
@Override
protected void configure(HttpSecurity http) throws Exception {
// Please dont format this section
// Some eclipse version may not support below formatter off.
// @formatter:off
HttpSecurity httpSecurity =
//default response headers disabled to aid xframe
http.headers().disable().csrf().disable()
// csrf disabled to facilitate non-browser calls
.httpBasic().authenticationEntryPoint(spnegoEntryPoint())
.and()
.sessionManagement()
.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
.and()
.authorizeRequests().antMatchers("/**")
.access(SECURITY_ACCESS_ROLE).anyRequest().authenticated()
.and();
httpSecurity
.addFilterBefore(
spnegoAuthenticationProcessingFilter(authenticationManagerBean()),
BasicAuthenticationFilter.class);
// @formatter:on
// Please dont format this section
}
@Override
public void configure(WebSecurity web) throws Exception {
web.ignoring().antMatchers(ignoreSecurity.split(","));
}
@Override
protected void configure(AuthenticationManagerBuilder auth)
throws Exception {
auth.authenticationProvider(kerberosServiceAuthenticationProvider());
}
@Bean(name = "authenticationManager")
@Override
public AuthenticationManager authenticationManagerBean() throws Exception {
return super.authenticationManagerBean();
}
@Bean
@Scope("prototype")
public SunJaasKerberosTicketValidator sunJaasKerberosTicketValidator() {
SunJaasKerberosTicketValidator ticketValidator = new SunJaasKerberosTicketValidator();
ticketValidator.setServicePrincipal(servicePrincipal);
ticketValidator.setKeyTabLocation(keyTabLocation);
ticketValidator.setDebug(true);
return ticketValidator;
}
@Bean
@Scope("prototype")
public KerberosServiceAuthenticationProvider kerberosServiceAuthenticationProvider() {
KerberosServiceAuthenticationProvider provider = new KerberosServiceAuthenticationProvider();
provider.setTicketValidator(ticketValidator);
provider.setUserDetailsService(kerberosUserDetailsService());
return provider;
}
@Bean
public UserDetailsService kerberosUserDetailsService() {
return new KerberosUserDetailsService();
}
@Bean
public UserDetailsByNameServiceWrapper<PreAuthenticatedAuthenticationToken> userDetailsByNameServiceWrapper() {
UserDetailsService userDetailsService = cookieUserDetailsService();
return new UserDetailsByNameServiceWrapper<PreAuthenticatedAuthenticationToken>(userDetailsService);
}
@Bean
public SpnegoAuthenticationProcessingFilter spnegoAuthenticationProcessingFilter(
AuthenticationManager authenticationManager) {
SpnegoAuthenticationProcessingFilter filter = new SpnegoAuthenticationProcessingFilter();
filter.setAuthenticationManager(authenticationManager);
return filter;
}
@Bean
public SpnegoEntryPoint spnegoEntryPoint() {
return new SpnegoEntryPoint();
}
}