+ protected void postAdd(AbstractUserDirectory userDirectory) {
+ // JTA
+ WorkControl tm = tmTracker != null ? tmTracker.getService() : null;
+ if (tm == null)
+ throw new IllegalStateException("A JTA transaction manager must be available.");
+ userDirectory.setTransactionControl(tm);
+// if (tmTracker.getService() instanceof BitronixTransactionManager)
+// EhCacheXAResourceProducer.registerXAResource(cacheName, userDirectory.getXaResource());
+
+ Object realm = userDirectory.getProperties().get(UserAdminConf.realm.name());
+ if (realm != null) {
+ if (Files.exists(nodeKeyTab)) {
+ String servicePrincipal = getKerberosServicePrincipal(realm.toString());
+ if (servicePrincipal != null) {
+ CallbackHandler callbackHandler = new CallbackHandler() {
+ @Override
+ public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
+ for (Callback callback : callbacks)
+ if (callback instanceof NameCallback)
+ ((NameCallback) callback).setName(servicePrincipal);
+
+ }
+ };
+ try {
+ LoginContext nodeLc = new LoginContext(CmsAuth.LOGIN_CONTEXT_NODE, callbackHandler);
+ nodeLc.login();
+ acceptorCredentials = logInAsAcceptor(nodeLc.getSubject(), servicePrincipal);
+ } catch (LoginException e) {
+ throw new IllegalStateException("Cannot log in kernel", e);
+ }
+ }
+ }
+
+ // Register client-side SPNEGO auth scheme
+ AuthPolicy.registerAuthScheme(SpnegoAuthScheme.NAME, SpnegoAuthScheme.class);
+ HttpParams params = DefaultHttpParams.getDefaultParams();
+ ArrayList<String> schemes = new ArrayList<>();
+ schemes.add(SpnegoAuthScheme.NAME);// SPNEGO preferred
+ // schemes.add(AuthPolicy.BASIC);// incompatible with Basic
+ params.setParameter(AuthPolicy.AUTH_SCHEME_PRIORITY, schemes);
+ params.setParameter(CredentialsProvider.PROVIDER, new HttpCredentialProvider());
+ params.setParameter(HttpMethodParams.COOKIE_POLICY, KernelConstants.COOKIE_POLICY_BROWSER_COMPATIBILITY);
+ // params.setCookiePolicy(CookiePolicy.BROWSER_COMPATIBILITY);