2

I have a website running on a Linux computer using Apache. I've employed mod_auth_kerb for single-sign-on Kerberos authentication against a Windows Active Directory server.

In order for Kerberos to work correctly, I've created a service account in Active Directory called dummy.

I've generated a keytab for the Linux web server using ktpass.exe on the Windows AD server using this command:

ktpass /out C:\krb5.keytab /princ HTTP/[email protected] /mapuser [email protected] /crypto RC4-HMAC-NT /ptype KRB5_NT_PRINCIPAL /pass xxxxxxxxx

I can successfully get a ticket from the Linux web server using this command:

kinit -k -t /path/to/keytab HTTP/[email protected]

... and view the ticket with klist.

I have also configured my web server with these Kerberos properties:

<Directory />
    AuthType                Kerberos
    AuthName                "Example.com Kerberos domain"
    KrbMethodK5Passwd       Off
    KrbAuthRealms           EXAMPLE.COM
    KrbServiceName          HTTP/[email protected]
    Krb5KeyTab              /path/to/keytab
    Require                 valid-user
    SSLRequireSSL
    <Files wsgi.py>
            Order deny,allow
            Allow from all
    </Files>
</Directory>

However, when I attempt to log in to the website (from another Desktop with username 'Jeff') my Kerberos credentials are not automatically accepted by the web server. It should grant me access immediately after that, but it does not. The only information I get from the mod_auth_kerb logs is:

kerb_authenticate_user entered with user (NULL) and auth_type Kerberos

However, more information is revealed when I change the mod_auth_kerb setting KrbMethodK5Passwd to On:

[Fri Oct 18 17:26:44 2013] [debug] src/mod_auth_kerb.c(1939): [client xxx.xxx.xxx.xxx] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos
[Fri Oct 18 17:26:44 2013] [debug] src/mod_auth_kerb.c(1031): [client xxx.xxx.xxx.xxx] Using HTTP/[email protected] as server principal for password verification
[Fri Oct 18 17:26:44 2013] [debug] src/mod_auth_kerb.c(735): [client xxx.xxx.xxx.xxx] Trying to get TGT for user [email protected]
[Fri Oct 18 17:26:44 2013] [debug] src/mod_auth_kerb.c(645): [client xxx.xxx.xxx.xxx] Trying to verify authenticity of KDC using principal HTTP/[email protected]
[Fri Oct 18 17:26:44 2013] [debug] src/mod_auth_kerb.c(1110): [client xxx.xxx.xxx.xxx] kerb_authenticate_user_krb5pwd ret=0 [email protected] authtype=Basic

What am I missing? I've studied a lot of online tutorials and cannot find a reason why the Kerberos credentials are not allowing access.

1 Answer 1

3

After digging through a lot more log information I was able to discover that the client machine was not responding properly to the server's ticket. The way you can tell something is wrong on the client machine is that you will see the Apache server's error message "failed to verify krb5 credentials: Server not found in Kerberos database". In the /etc/krb5.conf file on the client machine you have to make sure the web domain name maps to the proper Kerberos realm:

[domain_realm]
    example.com = REALM.EXAMPLE.COM
    .example.com = REALM.EXAMPLE.COM

Without this the client will reject the server because Kerberos tickets may only come from explicitly permitted realms.

I hope this information helps others out there!

1
  • [domain_realm] mapping can/should also be done via dns e.g. _kerberos.example.com IN TXT "EXAMPLE.COM".
    – 84104
    Aug 14, 2014 at 21:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .