I'm trying to set up Apache so that :

  • Users who connect to my website and send a valid Kerberos ticket are automatically logged in
  • Those who do not provide any Kerberos ticket see the website's login page

So far I've only managed to either get the Kerberos authentication to work ( but then users who do not provide any Kerberos tickets can't get to the website's login page and they get a "401 Unauthorized page" trying to access it ) or to show the website's login page to everyone ( but then neither the REMOTE_USER nor the REDIRECT_REMOTE_USER variables are set by Apache, which makes me think Apache doesn't even try to ask for a Kerberos ticket at all).

Here's my configuration for the login route :

<Location /login>
    Order allow-deny
    Allow from All
    Deny from
    AuthType Kerberos
    KrbAuthRealm my.realm
    KrbMethodNegotiate On
    KrbMethodK5Passwd Off
    KrbLocalUserMapping On
    KrbServiceName myServiceName
    Krb5Keytab /my/keytab
    Require valid-user
    Satisfy Any

This configuration was inspired by this paper on the matter. How you see it now, users who do not provide a Kerberos ticket get a 401 Unauthorized HTTP code. When I comment out the line "require valid-user", users who provide a Kerberos ticket are not automatically authenticated. How can I fix that ?

  • 1
    Before you implement something complex, I would suggest doing it with the more modern mod_auth_gssapi instead of the unmaintained mod_auth_kerb. – grawity Oct 5 '18 at 18:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.