Jetty 12.0.x SPNEGO: Set the Service Name, Not the Full Principal

Separate the proxy URI, JAAS user and GSS service component when configuring Jetty 12 authentication.

There are three names in a Jetty SPNEGO configuration: the URI used to match authentication, the user logging in through JAAS and the service for which a ticket is requested. They serve different purposes.

For the Jetty 12.0.x implementation, an authentication-object fragment is:

var auth = new org.eclipse.jetty.client.SPNEGOAuthentication(
    java.net.URI.create("http://proxy.example:8080"));
auth.setServiceName("HTTP");

This fragment illustrates the service component, not a complete proxy-authentication recipe. JAAS login, proxy routing and the request’s authentication exchange remain separate.

In this implementation, Jetty builds the GSS host-based name by combining getServiceName(), an @ character and the host for the authentication exchange. Supplying [email protected] as the service component would append another host. Read this setter’s contract rather than assuming it accepts a complete Kerberos principal.

The resulting GSS name has the conceptual form HTTP@hostname. The KDC’s corresponding service principal is commonly represented as HTTP/hostname. The selected proxy name must match the service actually registered for that account; an IP address or alias can select another ticket target.

Inspect the 407 path too

In Jetty 12.0.x, authenticate() gets the GSS hostname from request.getHost() and constructs a result using the default Authorization header. Matching an authentication object by proxy URI does not by itself change those choices to the proxy’s hostname and Proxy-Authorization.

A proxy integration therefore needs the correct request host and proxy-scoped result for that exchange. An HTTPS CONNECT request and an ordinary origin request can have different host values. Confirm the installed implementation’s behavior rather than assuming the service-name setter supplies the complete 407 flow.

For a 407, inspect the proxy authentication exchange and host used by that request. A 401 belongs to origin authentication. A valid user ticket alone does not establish that Jetty requested the correct service ticket or that the intermediary accepted it.

Allakkat attuumassuteqartut