NTLM authentication is no longer supported by Spring Security 3.0.x

I am exploring the way to automatically authenticated on Windows platforms on Spring Security. The older way of doing this is by using the NTLM_FILTER which works with Spring Security 2.0.x.

I just realised that the NTLM filter is no longer supported in Spring Security 3.0.x. The preferred way to do authentication is using the Kerberos.

http://blog.springsource.com/2009/09/28/spring-security-kerberos/

I have stumbled upon this Kerberos authentication has since my freshmen year at university back in 1995. It should then be  I remember when using the yellow page tools on SunOS in SPARCstation  boxes; the ypbind, yppasswd, etc (renamed NIS) are Kerberos based. It's been around for years, yet I haven't had much experience in setting the configuration on the server from scratch.

Now that I have to explore this, it's time to go in depth with this Kerberos stuffs.

The Windows NT which formerly has its own authentication system, that time, began to adopting standards such as LDAP, Kerberos, etc. NTLM -- which stands for NT LAN Manager, hum, sounds very very oldies kind of stuff -- has been superseded by Kerberos based authentication. Windows 2000 started providing Kerberos authentication as an alternative. Of course since the introduction of Kerberos based system, the transition has been slow, suggesting the new user to use Kerberos by default, and only supporting NTLM when they need backward compatibility with old systems (such as Windows 98). Nevertheless there are some people is still using the NTLM on their legacy systems.

The Spring Security team has deprecated the NTLM integration and move to Kerberos based authentication (for Windows systems) instead.

LDAP Browser Applications

Recently I have to deal with connection Apache HTTPD (Web) Server to ActiveDirectory. Running authentication against an LDAP-based directory server, sounds trivial, but I found it, not really! There are a lot resources in the Internet, but most of them I still need some adaptation. Even more, because ActiveDirectory is not just a simple directory server, but it has multi-facets, and of course you are required to understand some of the details of Windows based authentication system.
I run my configuration on the latest Apache HTTP 2.2.14, while most of the samples were still using Apache 2.0, or even 1.3.
This task requires me to be able to browser my existing ActiveDirectory server, to see what is actually inside the directory server. My previous experience with ActiveDirectory servers was revolving around setting Windows servers and workstations users and group. Connecting a third party (I mean non-Microsoft) application using non-Microsoft technology (it's not VB6, it's not .NET, it's not COM application) posed some challenges for me.

I realize that in order to be successful, I need to be able to browse the directory server (LDAP server is not a correct term, directory server is the correct term), so I came into conclusion that:

• I need a good client tool to test the connection first
• I need to figure out the correct settings on the ActiveDirectory
• I need to figure out the correct settings on the Apache HTTPD 2.2 configuration file (httpd.conf)

I found a few free and good client tools that works for my requirement:

• JXplorer
• Softerra(R) LDAP Browser 2.6
• Apache Directory Studio

I found out that Softerra's LDAP Browser 2.6 to be lightweight and very useful when you are using Windows system as the client. The cons is, it's a Windows application, means that you can't run it from other platform. I use the older version of this tool -- version 2.5 -- and discovered a lot of things about the ActiveDirectory server, before moving into the latest(version 2.6.

JXplorer download is the smallest! Currently JXplorer has the limitation of only displaying the first 1,000 items, which I found to be very annoying. It throws exception whenever bumping into this limitation (which you would for certain when browsing ActiveDirectory!).

Apache Directory Studio is based on Eclipse platform, and it's a big download (92MB), compared to JXplorer (3.2MB), and LDAP Browser 2.6 (5.6MB). It was built for Apache Directory Server (ApacheDS) project, but should work with any directory servers (at least it claims to be!). The benefit of Eclipse platform of course, we suppose to be able to update components without reinstalling the Eclipse platform. It's OSGi platform under the hood, so in case the provider maintain well the update site, we could update OSGi components as required.