Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 2 down vote favorite

I've got an Apache2 httpd running in front of a Tomcat, doing authentication via mod_auth_kerb.

When I open the console in Firebug, I see lots of 401's (see screenshot: http://i.stack.imgur.com/5YxZl.png).

Is there a way to avoid this? I guess its causing an additional roundtrip which impacts performance.

share|improve this question

1 Answer

up vote 1 down vote accepted

No; the extra response and request are necessary for the SPNEGO authentication process, see RFC 4559 for details.

I'd recommend only forcing authentication of the sensitive resources. In your screenshot, it looks like only that very first request should be authenticated; you can probably set Satisfy Any on that /res directory.

share|improve this answer
Yeah, excluding those resources might be a solution. I was testing this in Firefox, so there was no IE SSO stuff going on. Credentials were collected via HTTP BASIC style prompt, so I was expecting that the browser would send the "Authorize" header preemptively for all URLs it tried to fetch, just like with traditional HTTP BASIC auth. Do you know why the Kerberos blob is not sent preemptively? – Buddy Casino Nov 22 '11 at 21:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.