{"type":"doc","content":[{"type":"heading","attrs":{"level":2},"content":[{"text":"Prerekvizity pre implementáciu","type":"text"}]},{"type":"paragraph","content":[{"text":"Údaje potrebné na implementáciu a konfiguráciu aplikácie:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Názov domény ","type":"text","marks":[{"type":"strong"}]},{"text":"v ktorej bude aplikácia registrovaná (napr. domena.sk)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Service Principal Name ","type":"text","marks":[{"type":"strong"}]},{"text":"napr. HTTP/test.domena.sk@DOMENA.SK","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Keytab súbor ","type":"text","marks":[{"type":"strong"}]},{"text":"vytvorený pre Service principal (obsahuje ticket-granting ticket pre service principal)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Adresa AD ","type":"text","marks":[{"type":"strong"}]},{"text":"na dopytovanie sa ohľadom používateľských dát po autentifikácii, prístup cez LDAP protokol","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"LDAP Search base ","type":"text","marks":[{"type":"strong"}]},{"text":"-","type":"text"},{"text":" ","type":"text","marks":[{"type":"strong"}]},{"text":"adresár v štruktúre AD od ktorého budú kladené dopyty","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"AD skupina ","type":"text","marks":[{"type":"strong"}]},{"text":"ak je potrebné odfiltrovať používateľov len na konkrétnu skupinu ","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Na frontend aplikácie sa musí pristupovať pod doménou v názve principal-a (HTTP/","type":"text"},{"text":"test.domena.sk","type":"text","marks":[{"type":"strong"}]},{"text":"@DOMENA.SK), inak SSO nebude fungovať.","type":"text"}]},{"type":"paragraph","content":[{"text":"Aby SSO bolo funkčné, musí mať service principal používateľ v AD povolené dostatočné typy šifrovania (šifrovanie DES zo skúsenosti nie je dostatočné). ","type":"text"}]},{"type":"paragraph","content":[{"text":"Ďalšou podmienkou pre fungovanie SSO je to, že DNS záznam musí byť typu A.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Nástroje na testovanie","type":"text"}]},{"type":"paragraph","content":[{"text":"Na prostredí, z ktorého sa je možné dopytovať na AD (resp. aplikačný server) je užitočné nainštalovať nasledovné packages:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Cyrus-sasl-gssapi","type":"text","marks":[{"type":"em"}]},{"text":" – pripojenie na AD použitím protokolu Kerberos z Linux servera","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"krb5-workstation","type":"text","marks":[{"type":"em"}]},{"text":" – pre test pripojenia","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"openldap-clients","type":"text","marks":[{"type":"em"}]},{"text":" – pre test pripojenia a vyhľadávanie používateľov","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Po inštalácii ","type":"text"},{"text":"krb5-workstation ","type":"text","marks":[{"type":"em"}]},{"text":"je potrebné nakonfigurovať súbor ","type":"text"},{"text":"/etc/krb5.conf (","type":"text","marks":[{"type":"em"}]},{"type":"inlineCard","attrs":{"url":"https://web.mit.edu/kerberos/krb5-1.12/doc/admin/conf_files/krb5_conf.html"}},{"text":" ","type":"text"},{"text":"). ","type":"text","marks":[{"type":"em"}]}]},{"type":"mediaGroup","content":[{"type":"media","attrs":{"id":"2c02e4ab-013c-43a7-a76c-8568a63f9ec9","collection":"contentId-1748795408","type":"file"}}]},{"type":"paragraph","content":[{"text":"Následne je možné keytab a pripojenie možné otestovať:","type":"text"}]},{"type":"paragraph","content":[{"text":"klist -k {keytab súbor}","type":"text","marks":[{"type":"code"}]},{"text":" - zobrazí meno principal-a v keytab-e. Principal by mal byť case-sensitive zhodný so Service principal name","type":"text"}]},{"type":"paragraph","content":[{"text":"kinit -kt {keytab súbor} {service principal name}","type":"text","marks":[{"type":"code"}]},{"text":" - načíta credentials z keytabu, akcia prebehla korektne ak príkaz do konzoly nič nevypíše","type":"text"}]},{"type":"paragraph","content":[{"text":"klist","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"},{"text":"-","type":"text","marks":[{"type":"em"}]},{"text":" zobrazí credentials cache, po korektnom kinit príkaze sa tu budú nachádzať credentials pre service principal","type":"text"}]},{"type":"paragraph","content":[{"text":"Následne je možné vykonať ","type":"text"},{"text":"ldapsearch","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text","marks":[{"type":"em"}]},{"text":"bez explicitného zadania autorizačných údajov (prečítajú sa z credentials cache) - na toto slúži prepínač -Y GSSAPI.","type":"text"}]},{"type":"paragraph","content":[{"text":"ldapsearch -v -h [AD server] -Y GSSAPI -b \"[search base]\" \"[filter]\"","type":"text","marks":[{"type":"code"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Maven dependencies","type":"text"}]},{"type":"paragraph","content":[{"text":"Maven závislosti potrebné na implementáciu","type":"text"}]},{"type":"codeBlock","content":[{"text":"\n org.springframework.ldap\n spring-ldap-core\n\n\n\n org.springframework.security\n spring-security-ldap\n\n\n\n org.springframework.security.kerberos\n spring-security-kerberos-web\n 1.0.1.RELEASE\n\n\n\n org.springframework.security.kerberos\n spring-security-kerberos-client\n 1.0.1.RELEASE\n","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Konfigurácia na úrovni aplikácie","type":"text"}]},{"type":"paragraph","content":[{"text":"Do aplikácie je potrebné doplniť konfiguráciu pre ","type":"text"},{"text":"GlobalSunJaasKerberosConfig","type":"text","marks":[{"type":"code"}]},{"text":" a vložiť doň cestu ku ","type":"text"},{"text":"krb5.conf","type":"text","marks":[{"type":"em"}]},{"text":" súboru.","type":"text"}]},{"type":"codeBlock","attrs":{"language":"java"},"content":[{"text":"@Configuration\npublic class KerberosGlobalConfig {\n\n public static final Logger log = LoggerFactory.getLogger(KerberosGlobalConfig.class);\n\n @Value(\"${application.specific.kerberos.conf}\")\n private String kerberosGlobalConfPath;\n\n @Value(\"${application.specific.kerberos.debug}\")\n private boolean debug;\n\n @Bean\n public GlobalSunJaasKerberosConfig globalSunJaasKerberosConfig() throws Exception {\n GlobalSunJaasKerberosConfig globalSunJaasKerberosConfig = new GlobalSunJaasKerberosConfig();\n globalSunJaasKerberosConfig.setDebug(this.debug);\n globalSunJaasKerberosConfig.setKrbConfLocation(this.kerberosGlobalConfPath);\n log.info(\"Setting kerberos global config with file \" + kerberosGlobalConfPath + \", file exists: \" + new FileSystemResource(kerberosGlobalConfPath).exists());\n globalSunJaasKerberosConfig.afterPropertiesSet();\n return globalSunJaasKerberosConfig;\n }\n}","type":"text"}]},{"type":"paragraph","content":[{"text":"Ďalej je potrebné override-núť default engine security konfiguráciu a rozšíriť ju o nasledovné nastavenia a Bean deklarácie. Taktiež je potrebné doplniť konfiguračné properties ako ","type":"text"},{"text":"adServer","type":"text","marks":[{"type":"code"}]},{"text":" (adresa AD serveru), ","type":"text"},{"text":"keyTab","type":"text","marks":[{"type":"code"}]},{"text":" (cesta ku keyTab súboru), ","type":"text"},{"text":"servicePrincipal","type":"text","marks":[{"type":"code"}]},{"text":" (meno service principal, pre ktorého keyTab obsahuje ticket), ","type":"text"},{"text":"debug","type":"text","marks":[{"type":"code"}]},{"text":" (pomocné nastavenie - boolean), ","type":"text"},{"text":"ldapSearchBase","type":"text","marks":[{"type":"code"}]},{"text":" (odkiaľ používateľa hľadať - napr. ","type":"text"},{"text":"CN=Users,DC=domena,DC=sk","type":"text","marks":[{"type":"em"}]},{"text":"), ","type":"text"},{"text":"ldapSearchFilter","type":"text","marks":[{"type":"code"}]},{"text":" (filter na dohľadanie konkrétneho používateľa s parametrom), a prípadne properties ako ","type":"text"},{"text":"group","type":"text","marks":[{"type":"code"}]},{"text":" a ","type":"text"},{"text":"onlyGroupMembers","type":"text","marks":[{"type":"code"}]},{"text":" ak je potrebné validovať používateľov podľa príslušnosti k určitej skupine.","type":"text"}]},{"type":"paragraph","content":[{"text":"Viaceré triedy je potrebné doimplementovať, menovite ","type":"text"},{"text":"ApplicationSpecificFilterBasedLdapUserSearch","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"ApplicationSpecificLdapUserDetailsService","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"ApplicationSpecificLdapUserDetailsMapper","type":"text","marks":[{"type":"code"}]},{"text":", viď nižšie. ","type":"text"}]},{"type":"paragraph","content":[{"text":"Override security konfigurácie:","type":"text"}]},{"type":"codeBlock","attrs":{"language":"java"},"content":[{"text":"@Configuration\n@Controller\n@EnableWebSecurity\n@Order(SecurityProperties.DEFAULT_FILTER_ORDER)\n@ConditionalOnExpression(\"${application.specific.kerberos.enabled}\")\npublic class KerberosSecurityConfiguration extends com.netgrif.workflow.configuration.SecurityConfiguration {\n ...\n}","type":"text"}]},{"type":"paragraph","content":[{"text":"Doplnenie potrebných volaní a metód:","type":"text"}]},{"type":"codeBlock","attrs":{"language":"java"},"content":[{"text":" @Override\n protected void configure(HttpSecurity http) throws Exception {\n log.info(\"Configuration with frontend separated\");\n http\n .httpBasic()\n .authenticationEntryPoint(authenticationEntryPoint)\n .and()\n .cors()\n .and()\n .addFilterBefore(createPublicAuthenticationFilter(), BasicAuthenticationFilter.class)\n .authorizeRequests()\n .antMatchers(getPatterns()).permitAll()\n .antMatchers(OPTIONS).permitAll()\n .anyRequest().authenticated()\n .and()\n .logout()\n .logoutUrl(\"/api/auth/logout\")\n .invalidateHttpSession(true)\n .logoutSuccessHandler((new HttpStatusReturningLogoutSuccessHandler(HttpStatus.OK)))\n .and()\n .headers()\n .frameOptions().disable()\n .httpStrictTransportSecurity().includeSubDomains(true).maxAgeInSeconds(31536000)\n .and()\n .addHeaderWriter(new StaticHeadersWriter(\"X-Content-Security-Policy\",\"frame-src: 'none'\"))\n .and()\n .addFilterBefore(\n spnegoAuthenticationProcessingFilter(),\n BasicAuthenticationFilter.class)\n .exceptionHandling()\n .authenticationEntryPoint(spnegoEntryPoint());\n setCsrf(http);\n }\n\n @Override\n public void configure(AuthenticationManagerBuilder auth) throws Exception {\n auth.authenticationProvider(kerberosAuthenticationProvider())\n .authenticationProvider(kerberosServiceAuthenticationProvider());\n }\n\n @Bean\n public SpnegoEntryPoint spnegoEntryPoint() {\n return new SpnegoEntryPoint();\n }\n\n @Bean\n public KerberosAuthenticationProvider kerberosAuthenticationProvider() throws Exception {\n KerberosAuthenticationProvider provider = new KerberosAuthenticationProvider();\n SunJaasKerberosClient client = new SunJaasKerberosClient();\n client.setDebug(this.debug);\n provider.setKerberosClient(client);\n provider.setUserDetailsService(ldapUserDetailsService());\n return provider;\n }\n\n @Bean\n public SpnegoAuthenticationProcessingFilter spnegoAuthenticationProcessingFilter() throws Exception {\n SpnegoAuthenticationProcessingFilter filter = new SpnegoAuthenticationProcessingFilter();\n filter.setAuthenticationManager(authenticationManagerBean());\n filter.afterPropertiesSet();\n return filter;\n }\n\n @Bean\n public KerberosServiceAuthenticationProvider kerberosServiceAuthenticationProvider() throws Exception {\n KerberosServiceAuthenticationProvider provider = new KerberosServiceAuthenticationProvider();\n provider.setTicketValidator(sunJaasKerberosTicketValidator());\n provider.setUserDetailsService(ldapUserDetailsService());\n provider.afterPropertiesSet();\n return provider;\n }\n\n @Bean\n public SunJaasKerberosTicketValidator sunJaasKerberosTicketValidator() throws Exception {\n SunJaasKerberosTicketValidator ticketValidator = new SunJaasKerberosTicketValidator();\n ticketValidator.setServicePrincipal(this.servicePrincipal);\n ticketValidator.setKeyTabLocation(new FileSystemResource(this.keyTab));\n ticketValidator.setDebug(this.debug);\n ticketValidator.afterPropertiesSet();\n return ticketValidator;\n }\n\n @Bean\n public KerberosLdapContextSource kerberosLdapContextSource() throws Exception {\n KerberosLdapContextSource contextSource = new KerberosLdapContextSource(this.adServer);\n SunJaasKrb5LoginConfig loginConfig = new SunJaasKrb5LoginConfig();\n FileSystemResource keyTabFile = new FileSystemResource(this.keyTab);\n loginConfig.setKeyTabLocation(keyTabFile);\n loginConfig.setServicePrincipal(this.servicePrincipal);\n log.info(\"KerberosLdapContextSource: service principal: \" + servicePrincipal + \", \" + keyTab + \" - exists: \" + keyTabFile.exists());\n loginConfig.setDebug(this.debug);\n loginConfig.setIsInitiator(true);\n loginConfig.afterPropertiesSet();\n contextSource.setLoginConfig(loginConfig);\n contextSource.afterPropertiesSet();\n return contextSource;\n }\n\n @Bean\n public LdapUserDetailsService ldapUserDetailsService() throws Exception {\n LdapUserSearch userSearch = new ApplicationSpecificFilterBasedLdapUserSearch(this.ldapSearchBase, this.ldapSearchFilter, kerberosLdapContextSource());\n LdapUserDetailsService service = new ApplicationSpecificLdapUserDetailsService(userSearch, this.group, this.onlyGroupMembers);\n service.setUserDetailsMapper(ldapUserDetailsContextMapper());\n return service;\n }\n\n @Bean\n public UserDetailsContextMapper ldapUserDetailsContextMapper() {\n return new ApplicationSpecificLdapUserDetailsMapper();\n }","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Hodnota ","type":"text"},{"text":"this.adServer","type":"text","marks":[{"type":"code"}]},{"text":" musí mať špecifikovaný protokol ","type":"text"},{"text":"ldap://","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"}]}]},{"type":"paragraph","content":[{"text":"V metóde ","type":"text"},{"text":"void configure(HttpSecurity http)","type":"text","marks":[{"type":"code"}]},{"text":" boli oproti bežnej konfigurácii doplnené riadky 27 až 31.","type":"text"}]},{"type":"paragraph","content":[{"text":"Po úspešnom overení používateľa cez Kerberos je Spring-om zavolaná metóda ","type":"text"},{"text":"ApplicationSpecificLdapUserDetailsService::loadUserByUsername","type":"text","marks":[{"type":"code"}]},{"text":". Táto service je zodpovedná za dodanie objektu UserDetails (v NAE štandardne LoggedUser) na základe username používateľa. V tomto prípade to vykonáva použitím ","type":"text"},{"text":"ApplicationSpecificFilterBasedLdapUserSearch","type":"text","marks":[{"type":"code"}]},{"text":" na dohľadanie daného používateľa v AD a ","type":"text"},{"text":"ApplicationSpecificLdapUserDetailsMapper","type":"text","marks":[{"type":"code"}]},{"text":" na namapovanie výsledku na UserDetails objekt a vytvorenie potrebných záznamov na databázovej vrste.","type":"text"}]},{"type":"paragraph","content":[{"text":"Na dohľadanie používateľa je potrebné definovať filter a poskytnúť implementáciu ","type":"text"},{"text":"LdapUserSearch","type":"text","marks":[{"type":"code"}]},{"text":". Filter môže nadobúdať podobu napr. ","type":"text"},{"text":"(userPrincipalName={0})","type":"text","marks":[{"type":"code"}]},{"text":". Za ","type":"text"},{"text":"{0}","type":"text","marks":[{"type":"em"}]},{"text":" Spring dosadí user principal name, ktoré obdrží po autentifikácii. Ak je toto postačujúce, stačí použiť implementáciu ","type":"text"},{"text":"FilterBasedLdapUserSearch","type":"text","marks":[{"type":"code"}]},{"text":" poskytovanú Spring-om. V prípade, že na dohľadanie používateľa je potrebné tento údaj nejakým spôsobom transformovať, je potrebné doplniť vlastnú implementáciu (","type":"text"},{"text":"ApplicationSpecificFilterBasedLdapUserSearch","type":"text","marks":[{"type":"code"}]},{"text":"), viď nižšie. Týmto spôsobom je aj možné do filtra dosadiť viacero hodnôt (nielen ","type":"text"},{"text":"{0}","type":"text","marks":[{"type":"em"}]},{"text":") ak to je potrebné, napr. ","type":"text"},{"text":"(|(sAMAccountName={1})(userPrincipalName={0}))","type":"text","marks":[{"type":"code"}]},{"text":". ","type":"text"}]},{"type":"codeBlock","attrs":{"language":"java"},"content":[{"text":"public class ApplicationSpecificLdapUserDetailsService extends LdapUserDetailsService {\n\n public static final Logger log = LoggerFactory.getLogger(ApplicationSpecificLdapUserDetailsService.class);\n\n private final String group;\n private final boolean onlyGroupMembers;\n private final LdapUserSearch userSearch;\n private UserDetailsContextMapper userDetailsMapper;\n\n public ApplicationSpecificLdapUserDetailsService(LdapUserSearch userSearch, String group, boolean onlyGroupMembers) {\n super(userSearch);\n this.userSearch = userSearch;\n this.group = group;\n this.onlyGroupMembers = onlyGroupMembers;\n }\n\n public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {\n log.info(\"Searching LDAP for user \" + username);\n DirContextOperations userData = this.userSearch.searchForUser(username);\n validateGroupMembership(userData);\n UserDetails userDetails = this.userDetailsMapper.mapUserFromContext(userData, username, Collections.emptyList());\n return userDetails;\n }\n\n private void validateGroupMembership(DirContextOperations userData) throws UsernameNotFoundException {\n if (onlyGroupMembers && group != null) {\n String[] memberOf = userData.getStringAttributes(\"memberOf\");\n if (memberOf != null) {\n List groups = Arrays.asList(memberOf);\n groups.stream().filter(g -> g.equalsIgnoreCase(group)).findFirst().orElseThrow(() -> new UsernameNotFoundException(\"Not member of group \" + group));\n } else {\n throw new UsernameNotFoundException(\"Not member of group \" + group);\n }\n }\n }\n\n public void setUserDetailsMapper(UserDetailsContextMapper userDetailsMapper) {\n Assert.notNull(userDetailsMapper, \"userDetailsMapper must not be null\");\n this.userDetailsMapper = userDetailsMapper;\n super.setUserDetailsMapper(userDetailsMapper);\n }\n}","type":"text"}]},{"type":"paragraph"},{"type":"codeBlock","attrs":{"language":"java"},"content":[{"text":"public class ApplicationSpecificFilterBasedLdapUserSearch implements LdapUserSearch {\n\n public static final Logger log = LoggerFactory.getLogger(ApplicationSpecificFilterBasedLdapUserSearch.class);\n\n private final ContextSource contextSource;\n private final SearchControls searchControls = new SearchControls();\n private String searchBase = \"\";\n private final String searchFilter;\n\n public ApplicationSpecificFilterBasedLdapUserSearch(String searchBase, String searchFilter, BaseLdapPathContextSource contextSource) {\n Assert.notNull(contextSource, \"contextSource must not be null\");\n Assert.notNull(searchFilter, \"searchFilter must not be null.\");\n Assert.notNull(searchBase, \"searchBase must not be null (an empty string is acceptable).\");\n this.searchFilter = searchFilter;\n this.contextSource = contextSource;\n this.searchBase = searchBase;\n this.setSearchSubtree(true);\n if (searchBase.length() == 0) {\n log.info(\"SearchBase not set. Searches will be performed from the root: \" + contextSource.getBaseLdapPath());\n }\n }\n\n public DirContextOperations searchForUser(String username) {\n SpringSecurityLdapTemplate template = new SpringSecurityLdapTemplate(this.contextSource);\n template.setSearchControls(this.searchControls);\n\n // custom dosadenie hodnôt do filtra\n String[] params;\n if (username.contains(\"@\")) {\n String usernameNoDomain = username.split(\"@\")[0];\n params = new String[]{username, usernameNoDomain}; /* {0} = username, {1} = usernameNoDomain */\n } else {\n params = new String[]{username, username};\n }\n\n try {\n return template.searchForSingleEntry(this.searchBase, this.searchFilter, params);\n } catch (IncorrectResultSizeDataAccessException var4) {\n if (var4.getActualSize() == 0) {\n throw new UsernameNotFoundException(\"User \" + username + \" not found in directory.\");\n } else {\n throw var4;\n }\n }\n }\n\n public void setDerefLinkFlag(boolean deref) {\n this.searchControls.setDerefLinkFlag(deref);\n }\n\n public void setSearchSubtree(boolean searchSubtree) {\n this.searchControls.setSearchScope(searchSubtree ? 2 : 1);\n }\n\n public void setSearchTimeLimit(int searchTimeLimit) {\n this.searchControls.setTimeLimit(searchTimeLimit);\n }\n\n public void setReturningAttributes(String[] attrs) {\n this.searchControls.setReturningAttributes(attrs);\n }\n\n}","type":"text"}]},{"type":"paragraph"},{"type":"codeBlock","attrs":{"language":"java"},"content":[{"text":"public class ApplicationSpecificLdapUserDetailsMapper extends LdapUserDetailsMapper {\n\n public static final Logger log = LoggerFactory.getLogger(ApplicationSpecificUserDetailsMapper.class);\n\n @Override\n public UserDetails mapUserFromContext(DirContextOperations ctx, String username, Collection authorities) {\n UserDetails userDetails = super.mapUserFromContext(ctx, username, authorities);\n return makeLoggedUser(ctx, userDetails);\n }\n\n protected LoggedUser makeLoggedUser(DirContextOperations ctx, UserDetails userDetails) {\n // dohladanie pouzivatela v DB\n User user = ...\n if (user == null) {\n user = createNewUser(ctx, userDetails);\n } else {\n user = updateUser(user, ctx);\n }\n return user.transformToLoggedUser();\n }\n\n protected User createNewUser(DirContextOperations ctx, UserDetails userDetails) {\n // vytvorenie noveho pouzivatela v DB\n return user;\n }\n\n protected User updateUser(User user, DirContextOperations ctx) {\n // aktualizacia udajov pouzivatela v DB, ak sa nejake udrziavaju\n return user;\n }\n}\n","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Je odporúčané vhodným spôsobom rozšíriť/nahradiť User objekt tak, aby bolo možné ukladať jednoznačný údaj o tom, ku ktorej osobe v AD daný záznam prislúcha - napr. na základe DN, prípadne ","type":"text"},{"text":"userPrincipalName","type":"text","marks":[{"type":"code"}]},{"text":" alebo ","type":"text"},{"text":"sAMAccountName","type":"text","marks":[{"type":"code"}]},{"text":" - a podľa ktorého sa používateľ po autentifikácii dohľadá v databáze. Rozšírenie User objektu vyžaduje override aj UserService, ktorá sa v NAE bežne používa.","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Čo sa v aplikácii deje na pozadí","type":"text"}]},{"type":"paragraph","content":[{"text":"Kroky Kerberos autentizácie v aplikácii:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Browser používateľa vyžiada resource z API bez Authorization hlavičky","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Aplikačný server požiadavku neakceptuje a vracia odpoveď 401 Unauthorized, no pripojí","type":"text"},{"type":"hardBreak"},{"text":"hlavičku WWW-Authenticate: negotiate (je nakonfigurovaný pomocou spNEGO, aby sa","type":"text"},{"type":"hardBreak"},{"text":"autentifikácia \"vyjednala\")","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Browser reaguje na WWW-Authenticate: negotiate hlavičku a status 401 tak, že si","type":"text"},{"type":"hardBreak"},{"text":"vyžiada service ticket z KDC a ten pošle v ďalšej žiadosti v autorizačnej hlavičke","type":"text"}]}]}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":" Prehliadač používateľa musí byť explicitne nastavený, ","type":"text"}]},{"type":"paragraph","content":[{"text":"napr. pre Firefox je potrebné nastaviť (v about:config) ","type":"text"},{"text":"network.negotiate-auth.trusted-","type":"text","marks":[{"type":"strong"}]},{"type":"hardBreak"},{"text":"uris","type":"text","marks":[{"type":"strong"}]},{"text":" na hodnotu s doménou, cez ktorú sa na aplikáciu pristupuje (test.domena.sk)","type":"text"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Aplikácia si voči KDC (Key distribution centre, napr. AD) Kerberos token od","type":"text"},{"type":"hardBreak"},{"text":"používateľa overí","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Aplikácia si z AD vyžiada dáta o konkrétnom používateľovi (použitím nastaveného filtra)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Aplikácia používateľa autentifikuje (+ vytvorí v DB a pod.)","type":"text"}]}]}]},{"type":"paragraph"},{"type":"paragraph","content":[{"type":"placeholder","attrs":{"text":"The content by label feature displays related articles automatically, based on labels you choose. To edit options for this feature, select the placeholder below and tap the pencil icon."}}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"contentbylabel","parameters":{"macroParams":{"showLabels":{"value":"false"},"max":{"value":"5"},"spaces":{"value":"com.atlassian.confluence.content.render.xhtml.model.resource.identifiers.SpaceResourceIdentifier@12cf2"},"sort":{"value":"modified"},"showSpace":{"value":"false"},"reverse":{"value":"true"},"type":{"value":"page"},"cql":{"value":"label = \"kb-how-to-article\" and type = \"page\" and space = \"NAE\""},"labels":{"value":"kb-how-to-article"}},"macroMetadata":{"macroId":{"value":"d508e0ff-e039-4d8b-9e5f-e4e5e0c61223"},"schemaVersion":{"value":"4"},"title":"Content by Label"}},"localId":"094cba0e-4173-4905-95fb-52297d4db9d1"}},{"type":"bodiedExtension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"details","parameters":{"macroParams":{"hidden":{"value":"true"}},"macroMetadata":{"macroId":{"value":"d95c18d5-a3f4-41ac-9d30-162b378ee7ee"},"schemaVersion":{"value":"1"},"title":"Page Properties"}},"localId":"29c4af85-2123-4e51-8e96-c98e4238664b"},"content":[{"type":"table","attrs":{"layout":"default"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[484.0]},"content":[{"type":"paragraph","content":[{"text":"Related issues","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[242.0]},"content":[{"type":"paragraph"}]}]}]}]}],"version":1}

Browser not supported