I am trying to move the web layer of our app onto Apache on Centos and use mod_auth_kerb to authenticate AD users and automatically log them in the app. I have successfully joined the domain, and can successfully issue kerberos tickets for AD users.
The problem I have is that the backend app service is running as a local user on a windows server and not as an AD user, so I am not sure how to make the correct keytab to import into apache.
My thought was to create an identical user in the AD, and then add the SPN for HTTP to that user and export the keytab using ktpass. The problem is, that the AD administrators want to avoid creating a new user, as they need to obtain approvals etc...
So, is there a way to make this work without making a new user in the AD?