Beerdude26's questions

EDIT: SOLVED! See my answer below.

Greetings, I am looking for a way to do a single sign on to an intranet in the following manner:

1. A Linux user logs on via a graphical frontend (for example, GNOME).
2. He automatically requests a TGT for his username from the MIT Kerberos KDC.
3. Via some way or another, the Apache server (which we'll assume is on the same server as the KDC), is informed that this user has logged in.
4. When the user accesses the intranet, he is automatically granted access to his web applications.

I don't think I've seen this kind of functionality while searching the net. I know the following possibilities exist:

• Using an authentication module such as mod_auth_kerb, a user is presented with a login prompt to enter his username and password, which are then authenticated against the MIT Kerberos server. (I would like this to be automatic.)
• IIS supports integrated Windows logon via ASP.Net when the user is part of an Active Directory. (I'm looking for the Linux / Apache equivalent.)

Any suggestions, criticism and ideas are highly appreciated. This is for a school project to show a proof-of-concept, so every handy piece of information is more than welcome. :)

Greetings, I was wondering how one might link a Linux MIT Kerberos with a Windows 2003 Active Directory to achieve the following:

1. A user, [email protected], attempts to log in at an Apache website, which runs on the same server as the Linux MIT Kerberos.

2. The Apache module first asks the local Linux MIT Kerberos if he knows a user by that name or realm.

3. The MIT Kerberos finds out it isn't responsible for that realm, and forwards the request to the Windows 2003 Active Directory.

4. The Windows 2003 Active Directory replies positively and gives this information to the Linux MIT Kerberos, which in turn tells this to the Apache module, which grants the user access to its files.

   Here is an image of the situation:

The documentation I have read concerning this issue often differ from this problem:

• Some discuss linking up a MIT Kerberos with an Active Directory to gain access to resources on the Active Directory server;

• While another uses the link to authenticate Windows users to the MIT Kerberos through the Windows 2003 Active Directory. (My problem is the other way around.)

So what my question boils down to, is this:

Is it possible to have a Linux MIT Kerberos server pass through requests for a Active Directory realm, and then have it receive the reply and give it to the requesting service? (Although it's not a problem if the requesting service and the Windows 2003 Active Directory communicate directly.)

Suggestions and constructive criticism are greatly appreciated. :)

LATER EDIT

I'm having some issues with this. I've successfully configured mod_auth_kerb to do negotiation with the MIT Kerberos (in my case, EINDWERK.LAN), and if I fetch a ticket for the local MIT Kerberos with kinit on Ubuntu, I can surf to the Apache webserver without being prompeted for a login.

However, if I fetch a ticket from the Active Directory server (in my case, WINDOWS.LAN) and surf to the Apache webserver, I am greeted with a login prompt. Looking at the packets through Wireshark, it appears the Apache webserver is incorrectly attempting to use a TGT of EINDWERK.LAN for WINDOWS.LAN.

I have uploaded the Wireshark output for:

1. A kinit for the Active Directory user "tester" ([email protected]), which succeeds (ignore KRB5KDC_ERR_PREAUTH_REQUIRED, there is no preauth here)

2. One trip to the Apache webserver,where you can see that it goes wrong. [LINK]

EDIT: Yup, it always tries to authenticate with a TGT for EINDWERK.LAN. I'm going to try and create a trust between the AD and the MIT Kerberos and see if that fixes it.

EDIT2: Ok, by creating a trust (Here's a tutorial), everything seems to be checking out correctly, but I had to force rc4-hmac encryption for the tickets from the Active Directory, and the Apache HTTP service is encrypted in des3-cbc-sha1. Does anyone know how to delete a principal and encrypt its keys with a certain encryption?