Package edu.internet2.middleware.grouper.ws.security

package edu.internet2.middleware.grouper.ws.security
  • Class
    Description
    GrouperWsKerberosHandler
    Pass in This can be used by a JAAS application to instantiate a CallbackHandler
    WsCustomAuthentication
    implement this interface and provide the class to the classpath and grouper-ws.properties to override the default of httpServletRequest.getUserPrincipal(); for non-Rampart authentication if user is not found, throw a runtime exception.
    WsGrouperDefaultAuthentication
    default authentication for grouper if a custom one isnt specified in grouper-ws.properties for non-rampart requests
    WsGrouperKerberosAuthentication
    basic kerberos authentication for grouper, settings are specified in grouper-ws.properties note: this can be used for rest and soap, though it is not a bastion of security: 1. for soap, ws-security would be better since a ticket is passed instead of user/pass 2. for rest, Im not sure there is another option 3. the user/pass is transmitted in basic auth, so make sure SSL is on 4. passing the user/pass is not how kerberos should work since kerberos passes tickets and not passes 5. the user is authenticated to the kdc, but an ssl service is not invoked, which would be the next level of verification since it might be possible for the kdc to be spoofed to the grouper-ws
    WsGrouperLdapAuthentication
    ldap bind authentication for grouper, settings are specified in grouper-ws.properties, and the grouper-loader.properties note: this can be used for rest and soap, though it is not a bastion of security: 1. for soap, ws-security would be better since a ticket is passed instead of user/pass 2. for rest, Im not sure there is another option 3. the user/pass is transmitted in basic auth, so make sure SSL is on 4. if using proxied web services, the password goes to the middle component
    WsGrouperOauthAuthentication