Network.Wai.Middleware.SpnegoAuth

WAI Middleware for SPNEGO authentication with failback to Basic authentication, where the username/password is checked using Kerberos library (i.e. kinit [e-mail]).

Documentation

spnegoAuth :: SpnegoAuthSettings -> Middleware

Middleware that provides SSO capabilites

data SpnegoAuthSettings

Configuration structure for spnegoAuth middleware

Constructors

SpnegoAuthSettings

Fields

• spnegoRealm :: Maybe ByteString

  Realm to use with both kerberos and spnego authentication.

• spnegoService :: Maybe ByteString

  If set, use 'spnegoService@spnegoRealm' credentials from the keytab. May contain the whole principal, in such case spnegoRealm is used only for kerberos user/password authentication.

• spnegoUserFull :: Bool

  Always return full user principal; normally, if the user realm is equal to spnegoRealm, the realm is stripped

• spnegoBasicFailback :: Bool

  Allow failback to basic auth (username/password with kerberos api)

• spnegoForceRealm :: Bool

  Force use of spnegoRealm or default system realm in basic auth failback

• spnegoOnAuthError :: SpnegoAuthSettings -> Maybe (Either KrbException GssException) -> Application

  Called upon GSSAPI/Kerberos error. It is supposed to return 401 return code with 'Authorize: Negotiate' and possibly 'Authorize: Basic realm=...' headers

• spnegoFakeBasicAuth :: Bool

  Fake 'Authorization: ' basic header for applications relying on Basic auth

defaultSpnegoSettings :: SpnegoAuthSettings

Default settings for spnegoAuth middleware

spnegoAuthKey :: Key ByteString

Key that is used to access the username in WAI vault