I have this scenario: a windows 2008 R2 Domain and a linux server (CentOs) with Apache.
I need to configure SSO using kerberos in order to permit our internal client using IE or Chrome to authenticate on a website without asking for a password.
In order to do this i follow this tutorial https://wiki.gentoo.org/wiki/Kerberos_Windows_Interoperability.
My Apache conf file for the site is:
AuthType Kerberos AuthName "Kerberos Login" KrbAuthRealms <MYREALM> KrbServiceName HTTP/OTRS5@<MYREALM> Krb5Keytab /etc/krb5.keytab KrbMethodNegotiate On KrbMethodK5Passwd Off KrbSaveCredentials Off KrbVerifyKDC Off Require valid-user
Now when I try to connect to the site I receive a 401 code.
On error.log I found :
kerb_authenticate_user entered with user (NULL) and auth_type Kerberos Acquiring creds for HTTP/OTRS5@<MYREALM> Verifying client data using KRB5 GSS-API Client didn't delegate us their credential
GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server not found in Kerberos database)
I'm totally clueless about it.
Can you help me? Regards Francesco