auth_to_local support in Spnego authentication
@lachlan-roberts is already working on this.
Since Aug 3, 2023.
- Dominant language
- Java
- Stars
- 4.1k
- Forks
- 2k
- Avg merge
- 3d 56m
- Merged PRs (30d)
- 48
Description
**10.x, 11.x, 12.x**
**auth_to_local support in Spnego authentication**
Currently [ConfigurableSpnegoLoginService.toUserName](https://github.com/eclipse/jetty.project/blob/30ed83f3d082fc914330de2d5bbde4d0f4b91371/jetty-security/src/main/java/org/eclipse/jetty/security/ConfigurableSpnegoLoginService.java#L243C28-L243C28) just strips the realm part of the principal. Complex systems may require mapping principals to local users with MIT Kerberos's [auth_to_local](https://web.mit.edu/kerberos/krb5-current/doc/admin/conf_files/krb5_conf.html#realms) rules which is currently impossible to do in Jetty and that prevents us from a few use cases where Jetty hosted APIs are used by other processes.
However this configuration can be easily configured in krb5.conf, users may use other Kerberos implementations that may or may not implement a similar feature yet would want to use this mapping. Therefore some other projects like Hadoop has implemented it ([here](https://hadoop.apache.org/docs/stable/hadoop-project-dist/hadoop-common/SecureMode.html)), so I think it'd make sense for Jetty as well to implement this.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.