Jaspic ServerAuthModule delegating to JAAS Krb5LoginModule
<p>I have to write a custom Jaspic ServerAuthModule (which needs to add a proprietary Authentication Cookie to the HTTP Response AND HTTP Request to be propagated to the applications running on the App Server). The Authentication must be done using Kerberos, SPNEGO.</p>

<p>The Application Server to be used is JBOSS EAP 6.4.x</p>

<p>I managed to get the Authentication using the JAAS Krb5LoginModule working.</p>

<p>The JBOSS EAP <em>Standone.xml</em> I use:</p>

<pre><code>  &lt;security-domain name="host" cache-type="default"&gt;
    &lt;authentication&gt;
      &lt;login-module code="com.sun.security.auth.module.Krb5LoginModule" flag="required"&gt;
          &lt;module-option name="debug" value="true"/&gt;
          &lt;module-option name="principal" value="HTTP/macbookAirRCH@EXAMPLE.COM"/&gt;
          &lt;module-option name="storeKey" value="true"/&gt;
          &lt;module-option name="useKeyTab" value="true"/&gt;
          &lt;module-option name="doNotPrompt" value="true"/&gt;
          &lt;module-option name="keyTab" value="/Users/jet/Downloads/kerberos/macbookAirRCH.keytab"/&gt;
      &lt;/login-module&gt;
    &lt;/authentication&gt;
  &lt;/security-domain&gt;
  &lt;security-domain name="SPNEGO" cache-type="default"&gt;
    &lt;authentication&gt;
      &lt;login-module code="SPNEGO" flag="required"&gt;
          &lt;module-option name="serverSecurityDomain" value="host"/&gt;
      &lt;/login-module&gt;
    &lt;/authentication&gt;
    &lt;mapping&gt;
      &lt;mapping-module code="SimpleRoles" type="role"&gt;
          &lt;module-option name="user@EXAMPLE.COM" value="User,Admin"/&gt;
      &lt;/mapping-module&gt;
    &lt;/mapping&gt;
  &lt;/security-domain&gt;
</code></pre>

<p><em>jboss-web.xml</em>:</p>

<pre><code> &lt;jboss-web&gt;
   &lt;security-domain&gt;SPNEGO&lt;/security-domain&gt;
   &lt;valve&gt;
       &lt;class-name&gt;org.jboss.security.negotiation.NegotiationAuthenticator&lt;/class-name&gt;
   &lt;/valve&gt;
   &lt;context-root&gt;kerberosREST&lt;/context-root&gt;
 &lt;/jboss-web&gt;
</code></pre>

<p>I also managed to get a customized JASPI Module working (<code>extends org.jboss.as.web.security.jaspi.modules.WebServerAuthModule</code>) using the following configuration:</p>

<pre><code>&lt;security-domain name="testDomain" cache-type="default"&gt;
   &lt;authentication-jaspi&gt;
      &lt;login-module-stack name="lm-stack"&gt;
         &lt;login-module code="SPNEGO" flag="required"&gt;
            &lt;module-option name="serverSecurityDomain" value="host"/&gt;
         &lt;/login-module&gt;
      &lt;/login-module-stack&gt;
      &lt;auth-module code="ch.test.jaspic.CustomServerAuthModule" flag="required" login-module-stack-ref="lm-stack"/&gt;
    &lt;/authentication-jaspi&gt;
       &lt;mapping&gt;
          &lt;mapping-module code="SimpleRoles" type="role"&gt;
             &lt;module-option name="user@EXAMPLE.COM" value="User,Admin"/&gt;
             &lt;/mapping-module&gt;
          &lt;/mapping&gt;
 &lt;/security-domain&gt;
</code></pre>

<p><em>jboss-web.xml</em>:</p>

<pre><code>&lt;jboss-web&gt;
   &lt;security-domain&gt;testDomain&lt;/security-domain&gt;
   &lt;valve&gt;
       &lt;class-name&gt;org.jboss.as.web.security.jaspi.WebJASPIAuthenticator&lt;/class-name&gt;
   &lt;/valve&gt;
   &lt;context-root&gt;kerberosREST&lt;/context-root&gt;
&lt;/jboss-web&gt;
</code></pre>

<p>How can I use the default JAAS Krb5LoginModule?</p>

<p>Should I include the two valves in the jboss-web.xml? (the order is important)</p>

<p><em>jboss-web.xml</em>:</p>

<pre><code>&lt;jboss-web&gt;
   &lt;security-domain&gt;testDomain&lt;/security-domain&gt;
   &lt;valve&gt;
       &lt;class-name&gt;org.jboss.security.negotiation.NegotiationAuthenticator&lt;/class-name&gt;
   &lt;/valve&gt;
   &lt;valve&gt;
       &lt;class-name&gt;org.jboss.as.web.security.jaspi.WebJASPIAuthenticator&lt;/class-name&gt;
   &lt;/valve&gt;
   &lt;context-root&gt;kerberosREST&lt;/context-root&gt;
&lt;/jboss-web&gt;
</code></pre>

<p>Many thanks in advance</p>