Questions[mod-auth-kerb](server)

I have configured apache2 and mod_auth_kerb. I setted up my .htaccess in such way

# cat .htaccess
AuthType Kerberos
AuthName "Domain login"
KrbAuthRealms DOMAIN.COM
KrbMethodK5Passwd on
Krb5KeyTab /etc/httpd/httpd.keytab
require valid-user

When I open the page in IE, I get following error in apache logs:

gss_accept_sec_context() failed: Miscellaneous failure (, Key version number for principal in key table is incorrect)

Then I can set password and login via Basic Auth and it is totally ok. But I can't authenticate by ticket.

# klist -k /etc/httpd/httpd.keytab
Keytab name: FILE:/etc/httpd/httpd.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   6 host/[email protected]
   6 host/[email protected]
   6 host/[email protected]
   6 host/[email protected]
   6 host/[email protected]
   6 host/[email protected]
   6 [email protected]
   6 [email protected]
   6 [email protected]
   6 HTTP/[email protected]
   6 HTTP/[email protected]
   6 HTTP/[email protected]
   6 HTTP/[email protected]
   6 HTTP/[email protected]
   6 HTTP/[email protected]

What should I do with KVNO? What wrong with it?

P.S. KDC is KDC inside ActiveDirectory (windows 2003 server). My server platform is SUSE Linux 10:

# cat /proc/version
Linux version 2.6.16.60-0.21-smp (geeko@buemphasized textildhost) (gcc version 4.1.2 20070115 (SUSE Linux)) #1 SMP Tue May 6 12:41:02 UTC 2008

mod_auth_kerb is latest (5.4-4.15). Kerberos lib isn't:

# zypper search krb
Restoring system sources...
Parsing metadata for SUSE Linux Enterprise Server 10 SP3...
S | Catalog                             | Type    | Name               | Version        | Arch
--+-------------------------------------+---------+--------------------+----------------+-------
i | SUSE Linux Enterprise Server 10 SP3 | package | krb5               | 1.4.3-19.43.27 | x86_64
i | SUSE Linux Enterprise Server 10 SP3 | package | krb5-apps-clients  | 1.4.3-19.43.27 | x86_64
i | SUSE Linux Enterprise Server 10 SP3 | package | krb5-apps-servers  | 1.4.3-19.43.27 | x86_64
i | SUSE Linux Enterprise Server 10 SP3 | package | krb5-client        | 1.4.3-19.43.27 | x86_64
i | SUSE Linux Enterprise Server 10 SP3 | package | krb5-devel         | 1.4.3-19.43.27 | x86_64
i | SUSE Linux Enterprise Server 10 SP3 | package | krb5-server        | 1.4.3-19.43.27 | x86_64

I'm setting up an SSO for Active Directory users through a website that runs on an Apache (Apache2 on SLES 11.1), and when testing with Firefox it all works fine. But when I try to open the website in Internet Explorer 8 (Windows 7), all I get is

"Bad Request

Your browser sent a request that this server could not understand.

Size of a request header field exceeds server limit.

Authorization: Negotiate [ultra long string]"

My vhost.cfg looks like this:

<VirtualHost hostname:443>
  LimitRequestFieldSize 32760
  LimitRequestLine 32760
  LogLevel debug

  <Directory "/data/pwtool/sec-data/adbauth">
    AuthName "Please login with your AD-credentials (Windows Account)"
    AuthType Kerberos
    KrbMethodNegotiate on
    KrbAuthRealms REALM.TLD
    KrbServiceName HTTP/hostname
    Krb5Keytab /data/pwtool/conf/http_hostname.krb5.keytab
    KrbMethodK5Passwd on
    KrbLocalUserMapping on
    Order allow,deny
    Allow from all
  </Directory>

  <Directory "/data/pwtool/sec-data/adbauth">
    Require valid-user
  </Directory>

    SSLEngine on
    SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
    SSLCertificateFile /etc/apache2/ssl.crt/hostname-server.crt
    SSLCertificateKeyFile /etc/apache2/ssl.key/hostname-server.key
</VirtualHost>

I also made sure that the cookies are deleted and tried several smaller values for LimitRequestFieldSize and LimitRequestLine.

Another thing that seems weird to me is that even with LogLevel debug I won't get any logs about this. The log's last line is

ssl_engine_kernel.c(1879): OpenSSL: Write: SSL negotiation finished successfully

Does anyone have an idea about that?

I want to use Kerberos and Apache 2 on linux with mod_auth_kerb.

I added .htaccess to my project with following:

#SSLRequireSSL
AuthType Kerberos
AuthName "Kerberos Login"
KrbMethodNegotiate On
KrbMethodK5Passwd Off
KrbAuthRealms DOMAIN.COM
Krb5KeyTab /etc/httpd/httpd.keytab
KrbLocalUserMapping On
require valid-user

When I tried to test my single sign on on IE or Firefox I get the following error in apache log:

[Thu Jan 19 21:03:27 2012] [error] [client 10.65.0.1] gss_accept_sec_context() failed: An unsupported mechanism was requested (, Unknown error)

I don't know what is it and what I should do to make it work.

My aim is to get REMOTE_USER to be filled by AD user name. But now I can't do anything because of this error...

I implemented a SSO authentication using mod_auth_kerb on Apache. My config looks like this:

<Location /login/ >
    AuthType Kerberos
    AuthName "Kerberos Login"
    KrbMethodNegotiate on
    KrbAuthoritative on
    KrbVerifyKDC on
    KrbAuthRealm D.ETHZ.CH
    Krb5Keytab /etc/HTTP.keytab
    KrbSaveCredentials on
    RequestHeader set KERBEROS_USER %{REMOTE_USER}s
</Location>

My problem is that, without require valid-user, mod_auth_kerb doesn't even try to authenticate the user and KERBEROS_USER ends up being (null). If I add require valid-user, the user is authenticated automatically if the browser supports it, but gets shown an ugly modal login form (ala HTTP Basic Auth) if the browser doesn't support Kerberos Negotiate.

What I want to achieve is that if a user visits /login/, mod_auth_kerb tries to authenticate the user through Kerberos Negotiate. If that fails, a normal HTML login form will be presented to the user.

Is it possible to configure Apache/mod_auth_kerb in such a way?

Greetings, I was wondering how one might link a Linux MIT Kerberos with a Windows 2003 Active Directory to achieve the following:

1. A user, [email protected], attempts to log in at an Apache website, which runs on the same server as the Linux MIT Kerberos.

2. The Apache module first asks the local Linux MIT Kerberos if he knows a user by that name or realm.

3. The MIT Kerberos finds out it isn't responsible for that realm, and forwards the request to the Windows 2003 Active Directory.

4. The Windows 2003 Active Directory replies positively and gives this information to the Linux MIT Kerberos, which in turn tells this to the Apache module, which grants the user access to its files.

   Here is an image of the situation:

The documentation I have read concerning this issue often differ from this problem:

• Some discuss linking up a MIT Kerberos with an Active Directory to gain access to resources on the Active Directory server;

• While another uses the link to authenticate Windows users to the MIT Kerberos through the Windows 2003 Active Directory. (My problem is the other way around.)

So what my question boils down to, is this:

Is it possible to have a Linux MIT Kerberos server pass through requests for a Active Directory realm, and then have it receive the reply and give it to the requesting service? (Although it's not a problem if the requesting service and the Windows 2003 Active Directory communicate directly.)

Suggestions and constructive criticism are greatly appreciated. :)

LATER EDIT

I'm having some issues with this. I've successfully configured mod_auth_kerb to do negotiation with the MIT Kerberos (in my case, EINDWERK.LAN), and if I fetch a ticket for the local MIT Kerberos with kinit on Ubuntu, I can surf to the Apache webserver without being prompeted for a login.

However, if I fetch a ticket from the Active Directory server (in my case, WINDOWS.LAN) and surf to the Apache webserver, I am greeted with a login prompt. Looking at the packets through Wireshark, it appears the Apache webserver is incorrectly attempting to use a TGT of EINDWERK.LAN for WINDOWS.LAN.

I have uploaded the Wireshark output for:

1. A kinit for the Active Directory user "tester" ([email protected]), which succeeds (ignore KRB5KDC_ERR_PREAUTH_REQUIRED, there is no preauth here)

2. One trip to the Apache webserver,where you can see that it goes wrong. [LINK]

EDIT: Yup, it always tries to authenticate with a TGT for EINDWERK.LAN. I'm going to try and create a trust between the AD and the MIT Kerberos and see if that fixes it.

EDIT2: Ok, by creating a trust (Here's a tutorial), everything seems to be checking out correctly, but I had to force rc4-hmac encryption for the tickets from the Active Directory, and the Apache HTTP service is encrypted in des3-cbc-sha1. Does anyone know how to delete a principal and encrypt its keys with a certain encryption?