Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a working Kerberos SSO setup, I use apache and jboss with mod_jk. Apache is protecting (by kerberos) the auto-login.htm page with the following configuration:

<Location /auto-login.htm>  
AuthType           Kerberos  
AuthName           "Kerberos Active Directory Login"  
KrbMethodNegotiate on  
KrbMethodK5Passwd  on  
KrbAuthRealms      KRB.SOMEDOMAIN.COM  
KrbServiceName     HTTP/  
Krb5Keytab         /etc/krb/krb5.keytab  
KrbVerifyKDC       on  
KrbAuthoritative   on  
require            valid-user  
#ErrorDocument 401  /login.htm  

This works 100% and I am able to login with Kerberos/SSO and read the remote_user variable in my java application.

Now the problem is that I want to redirect to a unprotected login.htm if the user was unable to log in via Kerberos/SSO. The solution I had in mind was to set a 401 ErrorDocument, however when I set this up by uncommenting the #ErrorDocument 401 in the code above it always redirects to login.htm as returning a 401 to request user credentials is inherently part of the Kerberos/SSO authentication process. Thus the result is users always end up at login.htm and never completes the Kerberos/SSO login process.

Any help or alternative solution will be appreciated.

Thanks in advance

share|improve this question
up vote 4 down vote accepted

In order not to interrupt the Kerberos/SSO authentication process, use the following:

ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=/login.htm\"></html>"

This will cause a redirect to occur only when the user clicks cancel on the browser dialog box.

share|improve this answer

I believe you want ErrorDocument 403. 401 is returned when the server asks for authentication, 403 is returned when the client fails to provide authentication. This is at least true when setting up x.509 authentication.

share|improve this answer
This is also the behavior that I expected, however with Kerberos SSO the final page a user is shown is a 401. – Pierre Pretorius Jan 11 '10 at 12:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.