I'm trying to set up Apache so that :
- Users who connect to my website and send a valid Kerberos ticket are automatically logged in
- Those who do not provide any Kerberos ticket see the website's login page
So far I've only managed to either get the Kerberos authentication to work ( but then users who do not provide any Kerberos tickets can't get to the website's login page and they get a "401 Unauthorized page" trying to access it ) or to show the website's login page to everyone ( but then neither the REMOTE_USER nor the REDIRECT_REMOTE_USER variables are set by Apache, which makes me think Apache doesn't even try to ask for a Kerberos ticket at all).
Here's my configuration for the login route :
<Location /login> Order allow-deny Allow from All Deny from 10.0.0.0/8 AuthType Kerberos KrbAuthRealm my.realm KrbMethodNegotiate On KrbMethodK5Passwd Off KrbLocalUserMapping On KrbServiceName myServiceName Krb5Keytab /my/keytab Require valid-user Satisfy Any </Location>
This configuration was inspired by this paper on the matter. How you see it now, users who do not provide a Kerberos ticket get a 401 Unauthorized HTTP code. When I comment out the line "require valid-user", users who provide a Kerberos ticket are not automatically authenticated. How can I fix that ?