Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

i implement an intranet CMS (Joomla 2.5) in a multidomain environment, logging them in with kerberos against Windows AD -> SSO. SSO with kerberos works perfect for the integrated domains, also the SSO to CMS. my problem: around 10% of our users aren't in any domain (mostly sale-stuff...), so they fail to authenticate with kerberos against Windows AD. But we want to provide access to intranet to those users also, even if they can't be logged on to CMS. my question: is there a way to redirect those users to the CMS directory as a fallback?

my apache config so far:

<VirtualHost *:80>
    ServerAdmin someone@mydomain.com
    ServerName  intranet.company.local

    DocumentRoot /opt/joomla/jupgrade

    <Directory /opt/joomla/jupgrade>
        Options Indexes FollowSymLinks MultiViews
        AllowOverride All
        Order allow,deny
        allow from all

        AuthType Kerberos
        AuthName "Intranet Login"
        KrbMethodNegotiate On
        KrbMethodK5Passwd Off
        KrbAuthRealms DOMAIN1 DOMAIN2 DOMAIN3 DOMAIN4 DOMAIN5
        KrbServiceName HTTP
        Krb5KeyTab /etc/apache2/kerberos_myserver_combined.keytab
        require valid-user

        #ErrorDocument 401 /noauth/401.hmtl
    </Directory>

ErrorLog ${APACHE_LOG_DIR}/error.log

# Possible values include: debug, info, notice, warn, error, crit,
# alert, emerg.
LogLevel debug

CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

It is not possible to join those users into one of the domains. There is a project running for a one-domain-solution but this will take some time. Ubuntu 12.04 and Apache 2.2 as the webserver environment.

Thanks in advance for any suggest!

share|improve this question
add comment

2 Answers 2

You can use a custom error response to redirect not authorized users to another URL or another directory:

ErrorDocument 401 http://intranet.com/
ErrorDocument 401 /intranet.com/login.html
share|improve this answer
    
thanks for answer. my goal is to keep the url intranet.company.local -> with the ErrorDocument the url will change. –  joka66 Mar 21 at 14:13
    
really important: you can't use fully URL on 401 Errors, only local Files! –  joka66 Mar 23 at 16:13
add comment

after more searching and trail 'n' error i think the best hint for a solution is here: http://stackoverflow.com/questions/1726860/apache-authentication-redirect-on-failure-reliably

it seem's that with higher versions of apache there are more possibilities to catch a 401.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.