Is there a way for Apache to fall back to a different authentication method if Kerberos authentication (for some reason) fails? The order of the authentication methods should be:
- Kerberos
- Active Directory
- RSA token
The RSA token authentication is used by external parties who do not have AD accounts.
Let me know if you need more info. Thanks.
My current config is as follows:
<Directory "/path/to/directory">
AuthType Kerberos
AuthName "Please provide credentials to log in"
KrbAuthoritative off
AuthzLDAPAuthoritative off
AuthBasicAuthoritative off
AuthBasicProvider this-sso this-ad this-radius
Require valid-user
SSLRequireSSL
</Directory>
Authentication aliases are below:
<AuthnProviderAlias kerberos this-sso>
KrbAuthRealms THIS.LOCAL
KrbMethodNegotiate on
KrbMethodK5Passwd off
KrbDelegateBasic on
Krb5Keytab /etc/apache2/this.keytab.key
KrbServiceName HTTP
KrbVerifyKDC off
</AuthnProviderAlias>
<AuthnProviderAlias ldap this-ad>
Include /etc/apache2/.ldapbinddn
AuthLDAPURL "ldaps://srv1.this.local srv2.this.local:636/OU=DIR,DC=this,DC=local?sAMAccountName?sub?(objectClass=user)"
</AuthnProviderAlias>
<AuthnProviderAlias xradius this-radius>
AuthXRadiusAddServer "rsasrv1.this.local:1812" "Shared_key_here"
AuthXRadiusTimeout 7
AuthXRadiusRetries 2
AuthXRadiusRejectBlank on
</AuthnProviderAlias>