|
|
@@ -80,10 +80,11 @@ cl.EnableAutoSessionRenewal()
|
|
|
#### Authenticate to a Service
|
|
|
|
|
|
##### HTTP SPNEGO
|
|
|
-Create the HTTP request object and then call the client's SetSPNEGOHeader method passing the Service Principal Name (SPN)
|
|
|
+Create the HTTP request object and then call the client's SetSPNEGOHeader method passing the Service Principal Name (SPN) or to auto generate the SPN from the request object pass a null string ""
|
|
|
```go
|
|
|
r, _ := http.NewRequest("GET", "http://host.test.gokrb5/index.html", nil)
|
|
|
-cl.SetSPNEGOHeader(r, "")
|
|
|
+spn := ""
|
|
|
+cl.SetSPNEGOHeader(r, spn)
|
|
|
HTTPResp, err := http.DefaultClient.Do(r)
|
|
|
```
|
|
|
|
|
|
@@ -146,15 +147,15 @@ http.Handler("/", service.SPNEGOKRB5Authenticate(h, kt, serivceAccountName, l))
|
|
|
The serviceAccountName needs to be defined when using Active Directory where the SPN is mapped to a user account.
|
|
|
If this is not required it should be set to an empty string "".
|
|
|
If authentication succeeds then the request's context will have the following values added so they can be accessed within the application's handler:
|
|
|
-* "authenticated" - Boolean indicating if the user is authenticated. Use of this value should also handle that this value may not be set and should assume "false" in that case.
|
|
|
-* "credentials" - The authenticated user's credentials.
|
|
|
-If Microsoft Active Directory is used as the KDC then additional ADCredentials are available. For example the SIDs of the users group membership are available and can be used by your application for authorization.
|
|
|
+* service.CTXKey_Authenticated - Boolean indicating if the user is authenticated. Use of this value should also handle that this value may not be set and should assume "false" in that case.
|
|
|
+* service.CTXKey_Credentials - The authenticated user's credentials.
|
|
|
+If Microsoft Active Directory is used as the KDC then additional ADCredentials are available in the credentials.Attributes map under the key credentials.AttributeKey_ADCredentials. For example the SIDs of the users group membership are available and can be used by your application for authorization.
|
|
|
Access the credentials within your application:
|
|
|
```go
|
|
|
ctx := r.Context()
|
|
|
-if validuser, ok := ctx.Value("authenticated").(bool); ok && validuser {
|
|
|
- if creds, ok := ctx.Value("credentials").(credentials.Credentials); ok {
|
|
|
- if ADCreds, ok := creds.Attributes["ADCredentials"].(credentials.ADCredentials); ok {
|
|
|
+if validuser, ok := ctx.Value(service.CTXKey_Authenticated).(bool); ok && validuser {
|
|
|
+ if creds, ok := ctx.Value(service.CTXKey_Credentials).(credentials.Credentials); ok {
|
|
|
+ if ADCreds, ok := creds.Attributes[credentials.AttributeKey_ADCredentials].(credentials.ADCredentials); ok {
|
|
|
// Now access the fields of the ADCredentials struct. For example:
|
|
|
groupSids := ADCreds.GroupMembershipSIDs
|
|
|
}
|
Jonathan Turner