I’ve added a Tomcat Negotiate (Kerberos + NTLM) authenticator to Waffle 1.3 for Tomcat 6. Here’s how to use it.

Download

Download Waffle 1.3. The zip contains Waffle.chm that has the latest version of this tutorial.

Configure Tomcat

Copy Files

I started with a default installation of Tomcat 6. Checked that I could start the server and navigate to http://localhost:8080. Copy the following files into tomcat’s lib directory.

• jna.jar: Java Native Access
• platform.jar: JNA platform-specific API
• waffle-jna.jar: Tomcat Negotiate Authenticator

Authenticator Valve

Add a valve and a realm to the application context in your context.xml (for an application) or in server.xml (for the entire Tomcat installation).

1. <Context>
2.   <Valve className="waffle.apache.NegotiateAuthenticator" principalFormat="fqn" roleFormat="both" />
3.   <Realm className="waffle.apache.WindowsRealm" />
4. </Context>

Security Roles

Configure security roles in your application’s web.xml. The Waffle authenticator adds all user's security groups (including nested and domain groups) as roles during authentication.

1. <security-role>
2.   <role-name>Everyone</role-name>
3. </security-role>

Restrict Access

Restrict access to website resources. For example, to restrict the entire website to locally authenticated users add the following in web.xml.

1. <security-constraint>
2.   <display-name>Waffle Security Constraint</display-name>
3.   <web-resource-collection>
4.     <web-resource-name>Protected Area</web-resource-name>
5.     <url-pattern>/*</url-pattern>
6.   </web-resource-collection>
7.   <auth-constraint>
8.     <role-name>Everyone</role-name>
9.   </auth-constraint>
10. </security-constraint>

Test

Restart Tomcat and navigate to http://localhost:8080/.

You should be prompted for a logon with a popup. This is because by default localhost is not in the Intranet Zone and the server returned a 401 Unauthorized. Internet servers with a fully qualified named are detected automatically.

Internet Explorer

Ensure that Integrated Windows Authentication is enabled.

1. Choose the Tools, Internet Options menu.
2. Click the Advanced tab.
3. Scroll down to Security
4. Check Enable Integrated Windows Authentication.
5. Restart the browser.

The target website must be in the Intranet Zone.

1. Navigate to the website.
2. Choose the Tools, Internet Options menu.
3. Click the Local Intranet icon.
4. Click the Sites button.
5. Check Autmatically detect intranet network.
6. For localhost, click Advanced.
7. Add http://localhost to the list.

Firefox

1. Type about:config in the address bar and hit enter.
2. Type network.negotiate-auth.trusted-uris in the Filter box.
3. Put your server name as the value. If you have more than one server, you can enter them all as a comma separated list.
4. Close the tab.

Navigate to http://localhost:8080 after adding it to the Intranet Zone.

You should no longer be prompted and automatically authenticated.

Logs

In the logs you will see the following output for a successful logon.

My laptop is not a member of an Active Directory domain, but you would see domain groups, including nested ones here. There’s nothing special to do for Active Directory. The authenticator also automatically handles all aspects of the Negotiate protocol, chooses Kerberos vs. NTLM and supports NTLM POST. It basically has the same effect in Tomcat as choosing Integrated Windows authentication options in IIS.

Links

• Tomcat Negotiate Authenticator Source Code

Related Projects

• Tomcat SPNEGO by Dominique Guerrin: this is a very good prototype of a filter. It uses JNI and not JNA, doesn’t support NTLM POST and the code is pretty thick.
• SPNEGO Sourceforge: it’s a nightmare to configure, doesn’t work without an Active Directory domain and requires an SPN
• JCIFS NTLM: no longer supported and they recommend using Jespa
• Jespa: a commercial implementation that claims to do the same thing as Waffle, but uses the Netlogon service instead of the native Windows API