Apache and Kerberos SSO issues

climbingmerlin · 09-10-2008, 10:11 AM

Hi,

I am trying to set up a linux server running apache2 and mod_auth_kerb to authenticate users against our Windows 2003 AD server.

I have got the server to authenticate with AD using kerberos, however this is only possible with the authentication dialog box appearing. I can't seem to have the users authenticate seamlessly i.e. without the dialog box.

I would prefer to use krb rather than LDAP as we have users in different OUs for each business group.

Here is the contents of the .htaccess file

Code:

AuthName "Intranet"
AuthType Kerberos
Krb5Keytab /usr/lib/krb5/auth_kerb.keytab
KrbAuthRealm UK.MYDOMAIN.COM
KrbMethodNegotiate off
KrbSaveCredentials off
KrbVerifyKDC off
Require valid-user

Any ideas how I can get users to authenticate against the server without the dialog box?

Cheers....

San-Raal · 08-06-2009, 10:11 AM

You have set

Code:

KrbMethodNegotiate off

which actually is the "without dialog box" option.

Recommend using

Code:

KrbMethodNegotiate On
KrbMethodK5Passwd Off

This disables the dialog box, and enables only the GSSAPI authentication.

I really recommended using

Code:

LogLevel Debug
ErrorLog /var/log/apache2/error.log

in your httpd.conf/apache2.conf/virtual hosts file, and check your apache error logs, while trying to authenticate without the dialog box.

chandramani_yadav · 08-09-2009, 05:12 AM

Refer this link for alternate method

http://linuxpower.ismywebsite.com/we...in-apache.html