Return-Path: X-Original-To: apmail-cxf-issues-archive@www.apache.org Delivered-To: apmail-cxf-issues-archive@www.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id 7A251104BF for ; Mon, 15 Jul 2013 10:46:50 +0000 (UTC) Received: (qmail 48327 invoked by uid 500); 15 Jul 2013 10:46:50 -0000 Delivered-To: apmail-cxf-issues-archive@cxf.apache.org Received: (qmail 48202 invoked by uid 500); 15 Jul 2013 10:46:50 -0000 Mailing-List: contact issues-help@cxf.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: dev@cxf.apache.org Delivered-To: mailing list issues@cxf.apache.org Received: (qmail 48182 invoked by uid 99); 15 Jul 2013 10:46:49 -0000 Received: from arcas.apache.org (HELO arcas.apache.org) (140.211.11.28) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 15 Jul 2013 10:46:49 +0000 Date: Mon, 15 Jul 2013 10:46:49 +0000 (UTC) From: "Andrei Shakirin (JIRA)" To: issues@cxf.apache.org Message-ID: In-Reply-To: References: Subject: [jira] [Updated] (CXF-5126) Creation of SecurityContext from JAAS Subject causes incorrect Principal for Kerberos authentication MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-JIRA-FingerPrint: 30527f35849b9dde25b450d4833f0394 [ https://issues.apache.org/jira/browse/CXF-5126?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Andrei Shakirin updated CXF-5126: --------------------------------- Component/s: WS-* Components JAX-RS Security > Creation of SecurityContext from JAAS Subject causes incorrect Principal for Kerberos authentication > ---------------------------------------------------------------------------------------------------- > > Key: CXF-5126 > URL: https://issues.apache.org/jira/browse/CXF-5126 > Project: CXF > Issue Type: Bug > Components: JAX-RS Security, WS-* Components > Reporter: Andrei Shakirin > Assignee: Andrei Shakirin > > CXF-4931 introduced functionality to create SecurityContext from JAAS Subject if it is available. > The problem is that in case of Kerberos authentication, STS validates client Kerberos ticket using own Kerberos account. In this case JAAS Subject will contain Principal from STS Kerberos account and ws-security Principal is client Kerberos Principal. SecurityContext must be initialized using client Kerberos Principal and not STS one. > Moreover, sometimes JAAS Subject contains more than one Principal and it is very difficult to decide in CXF which one should be selected. > Propose: > 1. Check for Kerberos Principal and use ws-security Principal instead of JAAS Subject in this case. > 2. Introduce property to switch-off using JAAS Subject Principal for SecurityContext. > Regards, > Andrei. -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira