2

when i configured the apache authentication using the kerberos. it is working fine. It is asking the password and logging into the website. and it is creating a log information like this. /var/log/kerberos/krb5kdc.log

Jul 03 15:30:03 ashokkrishna-Lenovo-B560 krb5kdc[4060](info): AS_REQ (6 etypes {18 17 16 23 25 26}) 192.168.1.224: NEEDED_PREAUTH: ashokkrishna@IGROUP.COM for krbtgt/IGROUP.COM@IGROUP.COM, Additional pre-authentication required
Jul 03 15:30:03 ashokkrishna-Lenovo-B560 krb5kdc[4060](info): AS_REQ (6 etypes {18 17 16 23 25 26}) 192.168.1.224: ISSUE: authtime 1435917603, etypes {rep=18 tkt=18 ses=18}, ashokkrishna@IGROUP.COM for krbtgt/IGROUP.COM@IGROUP.COM

but when i hit

ashokkrishna@ashokkrishna-Lenovo-B560:~$ klist
klist: No credentials cache found (ticket cache FILE:/tmp/krb5cc_1000)

It is not listing any obtained tickets. why? everytime when i open the firefox the website is asking the password and username again and again, although my ticket expiration time is long enough.

but when i adding the users using

ashokkrishna@ashokkrishna-Lenovo-B560:~$ kinit ashokkrishna
Password for ashokkrishna@IGROUP.COM: 

ashokkrishna@ashokkrishna-Lenovo-B560:~$ klist
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: ashokkrishna@IGROUP.COM

Valid starting       Expires              Service principal
2015-07-03T15:56:33  2015-07-04T01:56:33  krbtgt/IGROUP.COM@IGROUP.COM
    renew until 2015-07-04T15:56:30
2015-07-03T15:56:44  2015-07-04T01:56:33  HTTP/igroup.com@IGROUP.COM
    renew until 2015-07-04T15:56:30

its working fine.

why this is happening.

EDIT: /etc/apache2/sites-enabled/sites-enabled. **

<Directory /var/www/html/auth-kerberos>
    AuthType Kerberos
    AuthName "Kerberos Authntication"
    KrbAuthRealms IGROUP.COM
    Krb5Keytab /etc/krb5.keytab
    KrbMethodNegotiate On
    KrbSaveCredentials Off
    KrbVerifyKDC Off
    Require valid-user
</Directory>**

kadmin.local configuration.

kadmin.local: listprincs
HTTP/igroup.com@IGROUP.COM
K/M@IGROUP.COM
ashokkrishna/admin@IGROUP.COM
ashokkrishna@IGROUP.COM
host/igroup.com@IGROUP.COM
kadmin/admin@IGROUP.COM
kadmin/changepw@IGROUP.COM
kadmin/igroup.com@IGROUP.COM
krbtgt/IGROUP.COM@IGROUP.COM
root/admin@IGROUP.COM

ashokkrishna is the user(client).And one thing i am having kdc,admin-server,apache-server,client all are under single host(pc). I am testing in single system.

2

When KrbMethodNegotiate fails because you don't have a valid (in your case any) ticket, Apache fails back to KrbMethodK5Passwd, which is on by default. This is the expected behavior with your configuration.


Side notes

  1. Apache shouldn't be using the system keytab. Configure an application keytab for it.
  2. If you are using the Basic Auth mechanism, the module does not do any special encryption of any sort. The passing of the username and password is done with the same Base64 encoding that Basic Auth uses. This can easily be converted to plain text. To counter this, I would suggest also using mod_ssl or Apache-SSL. The use of SSL encryption is also recommended if you are using the Negotiate method.

| improve this answer | |
  • ok i understood it i put the configuration KrbMethodK5Passwd Off it is working fine. – ashok Jul 3 '15 at 15:59
3

[Kerberos authentication] is working fine. It is asking the password and logging into the website.

Your Apache server is probably configured to allow some form of fall-back authentication when no Kerberos authentication can be negotiated.
Because if your browser had presented a Kerberos ticket you would not have been prompted for a username and password.

To me that is confirmed by the fact you see neither your personal ticket granting ticket, nor a service ticket.

Once you manually obtain a ticket granting ticket with kinit, only then Firefox is able and willing negotiate Kerberos authentication with the webserver, and then the service ticket is used to log in, rather than username/password. Which is what show when you run klist the second time.

| improve this answer | |
  • no, as per my knowledge i configured everything correctly. see the updated configuration in the question – ashok Jul 3 '15 at 13:48
  • ok actually as you said when i opened the site without prior kinit(getting tickets). I got internal server error and i cannot able to get the page. But after i changed the permission of krb5.keytab file to chmod 777 krb5.keytab. from that time onwards the firefox is asking me the username and passwords. – ashok Jul 3 '15 at 13:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.