I've been considering deploying
mod_auth_kerb on our internal web servers to enable SSO. The one obvious problem I can see is that it's an all-or-nothing approach, either all your domain users can access a site or not.
Is it possible to combine
mod_auth_kerb with something like
mod_authnz_ldap to check for group membership in a particular group in LDAP? I'm guessing the
KrbAuthoritative option would have something to do with this?
Also, as I understand it, the module sets the username to be
username@REALM after authentication, but of course in the directory the users are stored as the username only. Furthermore, some internal sites we run such as trac already have a user profile linked to each username. Is there a way to resolve this, perhaps by stripping off the realm bit after authentication somehow?