Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

EDIT: SOLVED! See my answer below.

Greetings, I am looking for a way to do a single sign on to an intranet in the following manner:

  1. A Linux user logs on via a graphical frontend (for example, GNOME).
  2. He automatically requests a TGT for his username from the MIT Kerberos KDC.
  3. Via some way or another, the Apache server (which we'll assume is on the same server as the KDC), is informed that this user has logged in.
  4. When the user accesses the intranet, he is automatically granted access to his web applications.

I don't think I've seen this kind of functionality while searching the net. I know the following possibilities exist:

  • Using an authentication module such as mod_auth_kerb, a user is presented with a login prompt to enter his username and password, which are then authenticated against the MIT Kerberos server. (I would like this to be automatic.)
  • IIS supports integrated Windows logon via ASP.Net when the user is part of an Active Directory. (I'm looking for the Linux / Apache equivalent.)

Any suggestions, criticism and ideas are highly appreciated. This is for a school project to show a proof-of-concept, so every handy piece of information is more than welcome. :)

share|improve this question
    
It's not necessary to add "[SOLVED]" to the title of your question. Forty-eight hours after you post an answer to your own question you can come back and mark it as accepted by clicking on the check mark next to the answer. –  Dennis Williamson May 16 '10 at 13:14
    
Ah, thank you :) –  Beerdude26 May 16 '10 at 13:29

1 Answer 1

up vote 1 down vote accepted

I found it!

I followed the instructions on https://help.ubuntu.com/community/SingleSignOn (See: "Application Installation") to configure the Apache webserver.

Here is my httpd.conf [IMAGE]:

ServerName www.eindwerk.lan

< Directory /var/www/ > Options Indexes FollowSymLinks MultiViews

   AllowOverride None
   Order allow,deny
   allow from all

  AuthType Kerberos

KrbMethodNegotiate on

KrbMethodK5Passwd on

  AuthName "Kerberos Login"
  KrbAuthRealm EINDWERK.LAN
  Krb5Keytab /etc/apache2/auth/apache2.keytab
  require valid-user

< /Directory >

  1. Then, I configured Mozilla Firefox to trust my internal site (www.eindwerk.lan) [IMAGE]:

    network.negotiate-auth.delegation-uris : eindwerk.lan

    network.negotiate-auth.trusted-uris: eindwerk.lan

  2. Do a kinit in a terminal. [IMAGE]

  3. Browse to the internal site: You are now automatically logged in!

    How does this work?

    • Mozilla Firefox does a regular HTTP/GET request.
    • Apache replies with HTTP/401 Authorization Required.
    • Mozilla Firefox replies with the Kerberos token we just got with kinit. [IMAGE OF WIRESHARK CAPTURE]
    • Kerberos authentication occurs, and Apache replies with HTTP/200 OK.
  4. Do a klist in a terminal. You should see the ticket for the webserver! [IMAGE]

  5. Do a kdestroy in a terminal. [IMAGE]

  6. Hard refresh (CTRL+F5) the internal site. You are now presented with a login prompt! [IMAGE]

share|improve this answer
    
Thanks for taking the time to post an answer... Saved me a lot of time –  Basic Feb 18 '13 at 11:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.