弹簧安全 spnego ldap jwt

Question

I have a complex situation where I need to implement a security for web app on tomcat 8 that serve both static html and rest services. the app is spring mvc application (no spring boot)

the authntication ( sso ) process will go as follow:

if user jwt not exist in http header then authonticate with ldap, getting user authorities from db and create jwt back to user.

if jwt exist in header, skip ldap filtering , extract the user authorities from token.

I was thinking of first servlet filter that uses spnego library and get the windows domain name (user name to use in ldap) that filter will also check to see if ldap authontication is needed ( if token not provided) and pass it back to spring filter chine through http params..

I'm struggling to implement he ideal. please help.

thanks

Answer 1

As I know, there is support for LDAP in spring security, might be it will help you. Other than that, if you want to write your own filters then you have to add those in spring security filter chain.