1

I have a working setup in a corporate environment where we use RHEL7 together with SSSD to authenticate against Active Directory. Regular authentication works well.

I managed to get the NFSv4 server to work with NFSv4 clients all using the same domain together with Kerberos and SSSD but only in an interactive fashion (ie: SSSD auto-create ticket at login time or manually using kinit).

The purpose of these NFS shares is to store some content that will need to be accessible from applicative users (ie httpd or tomcat).

What is the best approach for such deployment to make the access possible to the user in a non-interactive way?

3
  • do you need to authenticate users of just httpd/tomcat service?
    – kofemann
    Nov 8, 2017 at 20:56
  • It is just for services. I got it working using gssproxy with keytab and cred files in appropriate location. That was the only missing part.
    – Nicolas
    Nov 9, 2017 at 9:05
  • cool! Can you post the answer to your question?
    – kofemann
    Nov 13, 2017 at 10:22

1 Answer 1

0

The approach I've generally used for this:

  • Create a user account for the service that requires access
  • Use kadmin to create a keytab for that service.
  • Use a process such as k5start to ensure the keytab is refreshed at appropriate intervals.

For ease of management, I've often used this SystemD unit file (or a variant) for k5start. Configure it as a user service managed by systemd.

[Unit]
Description=Service User Kerberos Auth (Keytab)
After=dbus.service
After=network.target
After=NetworkManager.service

[Service]
Environment="KEYTAB=${HOME}/krb5.keytab"
Environment="INTERVAL=120"
Type=simple
ExecStart=/usr/bin/k5start -f ${KEYTAB} -K ${INTERVAL} -L -u ${USER} 

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .