SES-30: SpnegoAuthenticationProcessingFilter silently returns with an internal server error about spring-security-kerberos HOT 2 CLOSED

Mike Wiesner said:

I can't reproduce that. There is a log statement in the catch AuthenticationException block with priority "warn".

In most of the cases this exception has a wrong server side Kerberos configuration as the root cause and therefore is an internal server error. But it can also happen when someone sends malicious input to the server, and therefore it is only logged as "warn" and not as "error".

from spring-security-kerberos.

Harald Radi said:

I only partially agree with you.

First, the proposed sample configuration in the javadoc of the same file doesn't include a failureHandler and hence would be 'a wrong server side Kerberos configuration' as you put it. It took me some time to figure this out although i should have been quite obvious.

Second, the "warn" is ok where it is, but there should additionally be an "error" in the else branch as an SC_INTERNAL_SERVER_ERROR is something fatal and not just a warning (and one might not have "warn" enabled by default).

Using the provided sample configuration one just sees 500 pages when accessing the webapp with a browser that doesn't send the "Negotiate" header. I don't think that this is ok.

from spring-security-kerberos.