Jetty 12.0.x SPNEGO: saita sunan sabis, ba cikakken principal ba

A cikin tsarin Jetty SPNEGO akwai sunaye uku: URI da ake amfani da shi don daidaita tabbatarwa, mai amfani da ke shiga ta JAAS da sabis ɗin da ake neman tikiti dominsa. Kowane yana da manufa daban.

Don aiwatarwar Jetty 12.0.x, guntun abin tabbatarwa shi ne:

var auth = new org.eclipse.jetty.client.SPNEGOAuthentication(
    java.net.URI.create("http://proxy.example:8080"));
auth.setServiceName("HTTP");

Wannan guntun yana nuna ɓangaren sabis, ba cikakken tsarin tabbatarwa ta proxy ba. Shiga JAAS, tafiyar da proxy da musayar tabbatarwar buƙatar sun kasance daban.

A cikin wannan aiwatarwa Jetty yana gina sunan GSS na tushen masauki ta hanyar haɗa getServiceName(), alamar @ da masaukin musayar tabbatarwa. Idan an ba da [email protected] a matsayin ɓangaren sabis, za a ƙara wani masauki. Karanta yarjejeniyar wannan setter maimakon ɗauka cewa yana karɓar cikakken principal na Kerberos.

Sunan GSS da aka samu yana da siffar ra'ayi HTTP@hostname. Ana wakiltar principal ɗin sabis mai dacewa na KDC galibi a matsayin HTTP/hostname. sunan proxy da aka zaɓa dole ya dace da sabis ɗin da aka yi rajista a zahiri don wannan asusu; adireshin IP ko laƙabi na iya zaɓar wata manufar tikiti.

Bincika hanyar 407 ma

A cikin Jetty 12.0.x authenticate() yana samun sunan masaukin GSS daga request.getHost() kuma yana gina sakamako da tsohon kanun Authorization. Daidaita abin tabbatarwa da proxy URI ba ya canza waɗannan zaɓuɓɓuka da kansa zuwa sunan masaukin proxy da Proxy-Authorization.

Don haka haɗin proxy yana buƙatar masaukin buƙata daidai da sakamako mai iyaka ga proxy don wannan musayar. Buƙatar HTTPS CONNECT da buƙatar asali ta yau da kullum na iya samun daban-daban darajar masauki. Tabbatar da halin aiwatarwar da aka shigar maimakon ɗauka cewa setter ɗin sunan sabis yana ba da cikakken tafiyar 407.

Don 407, bincika musayar tabbatarwar proxy da masaukin da wannan buƙatar ta yi amfani da shi. 401 na tabbatarwar asali ne. Tikitin mai amfani mai inganci shi kaɗai ba ya tabbatar da cewa Jetty ya nemi tikitin sabis ɗin daidai ko mai shiga tsakani ya karɓe shi.