Home / user-491861

tj94's questions

Martin Hope
tj94
Asked: 2021-10-01 23:07:55 +0800 CST
  • 0

I've configured Apache HTTPD as a reverse proxy (for SSL) for my Artifactory instance, and I'm now trying to get HTTP SSO working on it.

Using the below configuration, I am successfully automatically signed in from my machine. However, when I run Chrome in Incognito mode (to disable Kerberos forwarding), the behaviour becomes undesirable.

What I want to happen is that the user be silently taken to Artifactory's standard login page, at /ui/login. However, what actually happens is that the browser prompts its built-in username and password window.

The other solutions I've seen in my research seem to be based on the Kerberos auth failing, or the user hitting cancel at this window. Instead, what I am trying to cater for is my users browsing to Artifactory from a non-domain-joined machine, which doesn't have a Kerberos ticket. I want these users to be shown the nicer-looking Artifactory standard login page.

# httpd -v
Server version: Apache/2.4.6 (Red Hat Enterprise Linux)
Server built:   Oct  8 2020 21:27:40

    <Location />
        AuthType Kerberos
        AuthName "Intranet"

        KrbMethodNegotiate On
        KrbMethodK5Passwd Off
        KrbAuthRealms DOMAIN.EXAMPLE.ORG
        KrbLocalUserMapping On
        Krb5KeyTab /etc/httpd/artf_ldap.keytab

        Require valid-user

        KrbAuthoritative On

        ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=/ui/login\"></html>"

        RewriteEngine On
        RewriteCond %{REMOTE_USER} (.+)
        RewriteRule . - [E=RU:%1]
        RequestHeader set REMOTE_USER %{RU}e
    </Location>

The ErrorDocument 401 and KrbMethodK5Passwd Off parts were my attempts at solving this myself.

kerberos google-chrome single-sign-on apache-2.4 artifactory
Martin Hope
tj94
Asked: 2020-09-08 17:21:47 +0800 CST
  • 2

I have a number of existing virtual machines within my vSphere datacenter. These VMs were not created using our vRealize 8 blueprints etc. However, I want to add the VMs to the vRA 8 inventory so that my users, who do not have access to vSphere, can have the ability to power them off/on, do basic reconfiguration, etc.

I believe the way to do this with vRA 7 was via a bulk import, but I can't for the life of me work out how to do such a thing on vRA 8. I know VMware changed the names of a lot of things, so hopefully the functionality is still there but is hidden away.

bulk-action automation vmware-vsphere import
Martin Hope
tj94
Asked: 2018-10-14 20:29:50 +0800 CST
  • 2

I need to set up a small computer network for what is effectively a satellite office for a business. The small network consists of several workstations and a server. The server machine has two physical network interfaces, one of which connects to the internet, and the other which connects to the workstations. What we want is for the workstations to access the internet through the server's VPN connection to the greater company network.

However, most of the tutorials I have found seem to effectively perform NAT on the VPN connection to each workstation.

What I need is for every workstation and the server to be granted an address on the greater company network using the greater network's DHCP servers and domain controllers, and use their DNS servers too, via the server's VPN (rather than every workstation containing its own VPN client and all of them using an individual VPN connection). I assume that each workstation would still require an IP address on the smaller network too, and possibly a virtual network adapter to be configured - this is all acceptable for us.

Unfortunately my networking knowledge is not great, and so I am not sure what keywords to search for to find tutorials that accomplish this.

All of the workstations and the server use Red Hat Enterprise Linux 7.4 Server. I am free to make changes to the system in terms of software network configuration, but I cannot change the network architecture, nor the operating system version, if that matters.

vpn