I have a running centos6.6 server who authenticates against a windows 2008 AD with realm EXAMPLE.LOCAL. I have successfully configured an apache webserver for authentication through kerberos keytab file. The name of the server is testsrv.example.local .

So far, so good. On my DC, next to example.local, I have a DNS forward lookup zone example.net . The records in example.net are used for internal navigation (like intranet, test sites, ...). I have configured several apache virtual hosts with example.net.

SSO authentication for testsrv.example.local works fine. When I try this for intra.example.net, I get authorization required.

Question: how can I achieve also authorization for example.net with kerberos keytab to domain example.local?

Thank you, Andries


What you are looking for is cross-realm authentication. As you probably know Kerberos uses the concept of realm to provide its services. If whatever service is outside of this realm Kerberos isn't even asked.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.