Alias /students /var/www/students <Location /students> KrbServiceName HTTP KrbMethodNegotiate On KrbMethodK5Passwd On KrbSaveCredentials off KrbAuthRealms DOMAIN.LOCAL Krb5KeyTab /etc/httpd/keytab KrbAuthoritative off AuthType Kerberos AuthName "Please Login" AuthBasicProvider ldap AuthzLDAPAuthoritative on AuthLDAPURL "ldap://dc.domain.local:389/OU=Domain Users,DC=domain,DC=local?userPrincipalName?sub?(objectClass=*)" AuthLDAPBindDN "CN=ldapsearchuser,CN=Users,DC=domain,DC=local" AuthLDAPBindPassword ldapsearchuserpass require ldap-group CN=Students,CN=Users,DC=domain,DC=local require ldap-group CN=Staff,CN=Users,DC=domain,DC=local </Location>
This allows all users who are members of either the Students/Staff AD groups access to pages behind http://intranetsite/students without needing to specify login credentials provided their IE/Firefox are configured properly.
The userPrincipalName was used instead of sAMAccountName because the kerberos module was passing the username@REALM to the ldap module.
Now I have the problem where if someone isn't authorized they are presented with:
Authorization Required This server could not verify that you are authorized to access the document requested. Either you supplied the wrong credentials (e.g., bad password), or your browser doesn't understand how to supply the credentials required.
Does anyone know how to have it pop up a username/password dialog box so they could try alternate credentials? After unsuccessfully gaining authorization, the only way I can get it to ask for credentials is to clear out my cache. If I am logged in to the PC as an authenticated user but one that isn't authorized to this resource I have no way of suppying alternate credentials (which may be a good thing).