2

when i configured the apache authentication using the kerberos. it is working fine. It is asking the password and logging into the website. and it is creating a log information like this. /var/log/kerberos/krb5kdc.log

Jul 03 15:30:03 ashokkrishna-Lenovo-B560 krb5kdc[4060](info): AS_REQ (6 etypes {18 17 16 23 25 26}) 192.168.1.224: NEEDED_PREAUTH: [email protected] for krbtgt/[email protected], Additional pre-authentication required
Jul 03 15:30:03 ashokkrishna-Lenovo-B560 krb5kdc[4060](info): AS_REQ (6 etypes {18 17 16 23 25 26}) 192.168.1.224: ISSUE: authtime 1435917603, etypes {rep=18 tkt=18 ses=18}, [email protected] for krbtgt/[email protected]

but when i hit

ashokkrishna@ashokkrishna-Lenovo-B560:~$ klist
klist: No credentials cache found (ticket cache FILE:/tmp/krb5cc_1000)

It is not listing any obtained tickets. why? everytime when i open the firefox the website is asking the password and username again and again, although my ticket expiration time is long enough.

but when i adding the users using

ashokkrishna@ashokkrishna-Lenovo-B560:~$ kinit ashokkrishna
Password for [email protected]: 

ashokkrishna@ashokkrishna-Lenovo-B560:~$ klist
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: [email protected]

Valid starting       Expires              Service principal
2015-07-03T15:56:33  2015-07-04T01:56:33  krbtgt/[email protected]
    renew until 2015-07-04T15:56:30
2015-07-03T15:56:44  2015-07-04T01:56:33  HTTP/[email protected]
    renew until 2015-07-04T15:56:30

its working fine.

why this is happening.

EDIT: /etc/apache2/sites-enabled/sites-enabled. **

<Directory /var/www/html/auth-kerberos>
    AuthType Kerberos
    AuthName "Kerberos Authntication"
    KrbAuthRealms IGROUP.COM
    Krb5Keytab /etc/krb5.keytab
    KrbMethodNegotiate On
    KrbSaveCredentials Off
    KrbVerifyKDC Off
    Require valid-user
</Directory>**

kadmin.local configuration.

kadmin.local: listprincs
HTTP/[email protected]
K/[email protected]
ashokkrishna/[email protected]
[email protected]
host/[email protected]
kadmin/[email protected]
kadmin/[email protected]
kadmin/[email protected]
krbtgt/[email protected]
root/[email protected]

ashokkrishna is the user(client).And one thing i am having kdc,admin-server,apache-server,client all are under single host(pc). I am testing in single system.

2 Answers 2

2

When KrbMethodNegotiate fails because you don't have a valid (in your case any) ticket, Apache fails back to KrbMethodK5Passwd, which is on by default. This is the expected behavior with your configuration.


Side notes

  1. Apache shouldn't be using the system keytab. Configure an application keytab for it.
  2. If you are using the Basic Auth mechanism, the module does not do any special encryption of any sort. The passing of the username and password is done with the same Base64 encoding that Basic Auth uses. This can easily be converted to plain text. To counter this, I would suggest also using mod_ssl or Apache-SSL. The use of SSL encryption is also recommended if you are using the Negotiate method.

1
  • ok i understood it i put the configuration KrbMethodK5Passwd Off it is working fine.
    – ashok
    Jul 3, 2015 at 15:59
3

[Kerberos authentication] is working fine. It is asking the password and logging into the website.

Your Apache server is probably configured to allow some form of fall-back authentication when no Kerberos authentication can be negotiated.
Because if your browser had presented a Kerberos ticket you would not have been prompted for a username and password.

To me that is confirmed by the fact you see neither your personal ticket granting ticket, nor a service ticket.

Once you manually obtain a ticket granting ticket with kinit, only then Firefox is able and willing negotiate Kerberos authentication with the webserver, and then the service ticket is used to log in, rather than username/password. Which is what show when you run klist the second time.

2
  • no, as per my knowledge i configured everything correctly. see the updated configuration in the question
    – ashok
    Jul 3, 2015 at 13:48
  • ok actually as you said when i opened the site without prior kinit(getting tickets). I got internal server error and i cannot able to get the page. But after i changed the permission of krb5.keytab file to chmod 777 krb5.keytab. from that time onwards the firefox is asking me the username and passwords.
    – ashok
    Jul 3, 2015 at 13:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .