License	BSD-style
Maintainer	palkovsky.ondrej@gmail.com
Stability	experimental
Portability	portable
Safe Haskell	None
Language	Haskell2010

Network.Wai.Middleware.SpnegoAuth

Description

WAI Middleware for SPNEGO authentication with failback to Basic authentication, where the username/password is checked using Kerberos library (i.e. kinit user@EXAMPLE.COM).

Synopsis

spnegoAuth :: SpnegoAuthSettings -> Middleware
data SpnegoAuthSettings = SpnegoAuthSettings {
- spnegoRealm :: Maybe ByteString
- spnegoService :: Maybe ByteString
- spnegoUserFull :: Bool
- spnegoBasicFailback :: Bool
- spnegoForceRealm :: Bool
- spnegoOnAuthError :: SpnegoAuthSettings -> Maybe (Either KrbException GssException) -> Application
- spnegoFakeBasicAuth :: Bool
}
defaultSpnegoSettings :: SpnegoAuthSettings
spnegoAuthKey :: Key ByteString
defaultAuthResponse :: SpnegoAuthSettings -> Request -> (Response -> IO ResponseReceived) -> IO ResponseReceived
defaultAuthError :: (String -> IO ()) -> SpnegoAuthSettings -> Maybe (Either KrbException GssException) -> Application

Documentation

spnegoAuth :: SpnegoAuthSettings -> Middleware Source #

Middleware that provides SSO capabilites

data SpnegoAuthSettings Source #

Configuration structure for spnegoAuth middleware

Constructors

SpnegoAuthSettings

Fields

spnegoRealm :: Maybe ByteString
Realm to use with both kerberos and spnego authentication.
spnegoService :: Maybe ByteString
If set, use 'spnegoService@spnegoRealm' credentials from the keytab. May contain the whole principal, in such case spnegoRealm is used only for kerberos user/password authentication.
spnegoUserFull :: Bool
Always return full user principal; normally, if the user realm is equal to spnegoRealm, the realm is stripped
spnegoBasicFailback :: Bool
Allow failback to basic auth (username/password with kerberos api)
spnegoForceRealm :: Bool
Force use of spnegoRealm or default system realm in basic auth failback
spnegoOnAuthError :: SpnegoAuthSettings -> Maybe (Either KrbException GssException) -> Application
Called upon GSSAPI/Kerberos error. It is supposed to return 401 return code with 'Authorize: Negotiate' and possibly 'Authorize: Basic realm=...' headers
You MUST flush the request body in this method, otherwise POSTPUTetc. requests mysteriously fail.
spnegoFakeBasicAuth :: Bool
Fake 'Authorization: ' basic header for applications relying on Basic auth

defaultSpnegoSettings :: SpnegoAuthSettings Source #

Default settings for spnegoAuth middleware

spnegoAuthKey :: Key ByteString Source #

Key that is used to access the username in WAI vault

defaultAuthResponse :: SpnegoAuthSettings -> Request -> (Response -> IO ResponseReceived) -> IO ResponseReceived Source #

Genereate HTTP response that asks client to do appropriate authentication

defaultAuthError :: (String -> IO ()) -> SpnegoAuthSettings -> Maybe (Either KrbException GssException) -> Application Source #

Default authentication for filling in spnegoOnAuthError