Integrating Spring Security with NTLM + Crowd

For the purpose of implementing a SSO (Single Sign On) system into our application, I investigated the use of spring-security and successfully implemented it using NTLM and Crowd.

Download Sample Project

Technologies
As most of our users are using Internet Explorer, NTLM seems to be the best solution. By the way, as developer we are using Firefox and fortunately Firefox can provide too NTLM credentials (see this to enableNTLM inside Firefox).
NTLM is used for authentication only (giving windows credentials to the web application) then Crowd is used to store and retrieve user's authorizations.
Atlassian Crowd provide full spring-security integration, and a bunch of connector to communicate with most of directory services available.
I first configured Crowd to use an internal directory to avoid being disrupted by communication with external directories. Then I added connection to our Microsoft Active Directory... but this go beyond the scope of this blog entry.

Prerequisites

• Add spring-security and spring-security-ntlm and theirs dependency in your project
• Add crowd-integration-client and his dependency in your project 
• Integrate Crowd integration client by following this documentation from step 1 to 3.0 

Integration
First of all, create a new spring application context (applicationContext-security.xml) with the following content :
<?xml version="1.0" encoding="UTF-8"?><br /> <beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:context="http://www.springframework.org/schema/context" xmlns:sec="http://www.springframework.org/schema/security" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.2.xsd"><br /> <br /> <sec:authentication-manager alias="authenticationManager"/><br /> <br /> <!-- Custom authentication provider --><br /> <bean id="daoAuthenticationProvider" class="com.mycompany.security.UserDetailsAuthenticationProvider"><br /> <sec:custom-authentication-provider/><br /> <property name="userDetailsService"><br /> <ref local="crowdUserDetailsService" /><br /> </property><br /> </bean><br /> <br /> <!-- Crowd UserDetailsService --><br /> <bean id="crowdUserDetailsService" class="com.atlassian.crowd.integration.springsecurity.user.CrowdUserDetailsServiceImpl"><br /> <property name="authenticationManager" ref="crowdAuthenticationManager" /><br /> <property name="groupMembershipManager" ref="crowdGroupMembershipManager" /><br /> <property name="userManager" ref="crowdUserManager" /><br /> <property name="authorityPrefix" value="ROLE_" /><br /> </bean><br /> <br /> <br /> <!-- NTLM Filter --><br /> <bean id="ntlmFilter" class="org.springframework.security.ui.ntlm.NtlmProcessingFilter"><br /> <sec:custom-filter position="NTLM_FILTER" /><br /> <property name="stripDomain" value="true" /><br /> <property name="defaultDomain" value="PMINTL.NET" /><br /> <property name="domainController" value="pmichneugc01.pmintl.net" /><br /> <property name="authenticationManager" ref="authenticationManager" /><br /> </bean><br /> <bean id="ntlmEntryPoint" class="org.springframework.security.ui.ntlm.NtlmProcessingFilterEntryPoint"><br /> <property name="authenticationFailureUrl" value="/denied.jsp" /><br /> </bean><br /> <bean id="exceptionTranslationFilter" class="org.springframework.security.ui.ExceptionTranslationFilter"><br /> <property name="authenticationEntryPoint" ref="ntlmEntryPoint" /><br /> </bean><br /> <br /> <br /> <!-- HTTP configuration --><br /> <sec:http auto-config="true" entry-point-ref="ntlmEntryPoint" servlet-api-provision="false"><br /> <sec:intercept-url pattern="/secure.jsp" access="ROLE_myapp-users" /><br /> <sec:intercept-url pattern="/admin.jsp" access="ROLE_myapp-administrators" /><br /> <sec:intercept-url pattern="/**" filters="none" /><br /> </sec:http><br /> </beans>
Then add it in your web application descriptor (web.xml) with the spring security filter, you must end with something like this :
<!DOCTYPE web-app PUBLIC<br /> "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"<br /> "http://java.sun.com/dtd/web-app_2_3.dtd" ><br /> <br /> <web-app><br /> <display-name>Archetype Created Web Application</display-name><br /> <br /> <context-param><br /> <param-name>contextConfigLocation</param-name><br /> <param-value><br /> /WEB-INF/applicationContext-CrowdClient.xml,<br /> /WEB-INF/applicationContext-security.xml<br /> </param-value><br /> </context-param><br /> <br /> <filter><br /> <filter-name>springSecurityFilterChain</filter-name><br /> <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class><br /> <br /> </filter><br /> <filter-mapping><br /> <filter-name>springSecurityFilterChain</filter-name><br /> <url-pattern>/*</url-pattern><br /> </filter-mapping><br /> <br /> <listener><br /> <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class><br /> </listener><br /> </web-app>
And finally, create the custom UserDetailsAuthenticationProvider (unfortunally I was suprised to didn't find a provider that suit my needs...):
package com.mycompany.security;<br /> <br /> import org.springframework.dao.DataAccessException;<br /> import org.springframework.security.AuthenticationException;<br /> import org.springframework.security.AuthenticationServiceException;<br /> import org.springframework.security.providers.UsernamePasswordAuthenticationToken;<br /> import org.springframework.security.providers.dao.AbstractUserDetailsAuthenticationProvider;<br /> import org.springframework.security.userdetails.UserDetails;<br /> import org.springframework.security.userdetails.UserDetailsService;<br /> <br /> public class UserDetailsAuthenticationProvider extends AbstractUserDetailsAuthenticationProvider {<br /> <br /> private UserDetailsService userDetailsService;<br /> <br /> @Override<br /> protected void additionalAuthenticationChecks(final UserDetails userDetails, final UsernamePasswordAuthenticationToken authentication)<br /> throws AuthenticationException {<br /> // TODO Auto-generated method stub<br /> <br /> }<br /> <br /> public UserDetailsService getUserDetailsService() {<br /> return userDetailsService;<br /> }<br /> <br /> @Override<br /> protected UserDetails retrieveUser(final String username, final UsernamePasswordAuthenticationToken authentication)<br /> throws AuthenticationException {<br /> UserDetails loadedUser;<br /> try {<br /> loadedUser = this.getUserDetailsService().loadUserByUsername(username);<br /> } catch (final DataAccessException repositoryProblem) {<br /> throw new AuthenticationServiceException(repositoryProblem.getMessage(), repositoryProblem);<br /> }<br /> if (loadedUser == null)<br /> throw new AuthenticationServiceException("User cannot be null");<br /> return loadedUser;<br /> }<br /> <br /> public void setUserDetailsService(final UserDetailsService userDetailsService) {<br /> this.userDetailsService = userDetailsService;<br /> }<br /> }
You're done !

Creating test pages
As you may have notified, the file applicationContext-security.xml defining three different level of security:

• Anonymous access authorized by default to all page
  <sec:intercept-url pattern="/**" filters="none" />
• Standard users can access the 'secure.jsp' page
  <sec:intercept-url pattern="/secure.jsp" access="ROLE_myapp-users" />
• Administrators can access the 'admin.jsp' page
  <sec:intercept-url pattern="/admin.jsp" access="ROLE_myapp-administrators" />

So create the pages index.jsp, secure.jsp and admin.jsp with the content you want or change the security context to suit your needs.

Crowd configuration
Open the Crowd administrator console, and create user corresponding to your Active Directory account name, add it to the application you created when you integrated Crowd (more informations).
Create two groups (myapp-user and myapp-administrators, you can name it differently but you must then update your spring security context correspondingly) and add them to the user created before.
Don't hesitate to read the Crowd documentation for further information. Specially if you want add a connector for your directory, but I strongly recommend you to first test your application using a Crowd integrated directory.

Conclusion
Integrating spring-security into an existing web-application is relatively straight-forward, specially if you already using spring. Some specific configuration is needed to enable NTLM and Crowd support but documentation can be easily find online.
And best of all, if you want to change for Kerberos in future you can do it simply and without changing the way your application works... thanks to Spring IoC :-D
And thanks to Crowd you can change connection to different directory services without loosing user authorizations (of course user-name must be the same...).

References

• http://blog.mediasoft.be/ntlm-with-spring-security-20/
• http://blog.anorakgirl.co.uk/?p=68
• http://confluence.atlassian.com/display/CROWD/Integrating+Crowd+with+Spring+Security
• http://static.springsource.org/spring-security/site/start-here.html
• http://confluence.atlassian.com/display/CROWD/Crowd+Documentation