Username in HTTP Header for SSO

Question

I am looking to add single sign on (SSO) to one of my web applications. I don't want anything heavy at the moment, I just want to know the userId of the logged in user, without the need for them to enter a username.

The web app is an internal application, so I can guarantee they are coming from a Windows PC etc.

I have looked at jCIFS, but this doesn't seem to be supported any more, and recommends a commercial product.

I have also looked at WAFFLE, but I am building SSO for a playframework application, which does not use a Servlet stack, so I can't make use of the SecurityFilter. I have tried to make sense of the WindowsLoginModule, but couldn't really understand what I had to do to implement it.

Is it possible to just get the username from the HTTP header, or does it require some negotiation first before it will post the header?

Answer 1

You want the windows user to automagically login to your intranet webapp. So the user accounts would sit in an active directory and the usual microsoft way would be to use a protocol like NTML oder Kerberos. Applications are generally advised not to use NTLM, although there are enterprises still using NTML (and jCIFS) for SSO.

A quick search on Kerberos and Java showed this article. It seems to depend on the Java EE stack (JAAS).

For a more stripped down approach: Usually, you cannot sent the username in a http request in a portable way. With ActivX you could do:

var wshshell=new ActiveXObject("wscript.shell");
var username=wshshell.ExpandEnvironmentStrings("%username%");

On the server side, you can parse the http header and extract the username with your technology of choice.

Well, security doesn't matter in your playframework application? Why don't you use long-living cookies?

Hope it helps!

Answer 2

In an intranet context with ActiveDirectory and workstations registered in the domain, the HTTP SPNEGO Negotiation support is the best option. But it requires specific skills around ActiveDirectory and Java Kerberos implementation.

Spring Security provides implementation and documentation to set it up. But Secure.Security is not designed to support token-based authentication like HTTP Negotiation. So using Spring Security will require a specific integration module.

Other options are OpenID and shibboleth but both requires a dedicated server, which can be configured to do SPNEGO itself. Thanks to available Play modules, integration in your application will be easier.

The only way to get the username in an HTTP header without client-side complex and unsecure/unreliable tweaks is to use an authentication proxy between browsers and your application server. Most of these proxies also support Kerberos SPNEGO as authentication mean.