3

I want to use the Apache Module mod_auth_kerb to implement SSO for a web application. With the following config:

<VirtualHost 10.5.3.200:443>

#Proxy
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
ProxyPass /elasticsearch/ http://127.0.0.1:9200/
ProxyPassReverse /elasticsearch/ http://127.0.0.1:9200/

#Server Config
ServerName spufi002.ads.ktag.ch
ServerAdmin "sm-linux@ag.ch"
DocumentRoot /srv/www/htdocs/kibana/
ErrorLog /var/log/apache2/error_log
TransferLog /var/log/apache2/access_log
SSLEngine on
SSLProtocol all -SSLv2 -SSLv3
SSLCipherSuite ALL:!aNULL:!eNULL:!SSLv2:!LOW:!EXP:!MD5:@STRENGTH
SSLCertificateFile /etc/apache2/ssl.crt/server.crt
SSLCertificateKeyFile /etc/apache2/ssl.key/server.key
<Files ~ "\.(cgi|shtml|phtml|php3?)$">
SSLOptions +StdEnvVars
</Files>
<Directory "/srv/www/cgi-bin">
SSLOptions +StdEnvVars
</Directory>
CustomLog /var/log/apache2/ssl_request_log   ssl_combined
<Directory "/srv/www/htdocs/kibana">

#Authentication
AuthType Kerberos
AuthName "SPNEGO"
KrbAuthRealms ADS.KTAG.CH
Krb5Keytab /etc/krb5.keytab
KrbMethodNegotiate on
KrbServiceName http
KrbMethodK5Passwd on
KrbLocalUserMapping On
Require user abnn ABNN tloi TLOI pwix PWIX rhe6 RHE6 dwav DWAV
options Indexes FollowSymLinks
AllowOverride None
Order allow,deny
Allow from all
</Directory>
</VirtualHost>

Without the Kerberos Stuff I can access the website. With the Kerberos part a login box pops up, but I can't login.

I get the following error (Apache2.2 error_log):

[Tue Mar 18 13:58:34 2014] [error] [client 10.5.4.12] failed to verify krb5 credentials: Key table entry not found, referer: https://spufi002/

Any ideas?

1

I supose the problem is in KrbServiceName. You should using name of principal the same, when you generate keytab file. ktpass /princ HTTP/name.domain@DOMAIN.COM... HTTP/name.domain@DOMAIN.COM - name of principal, which you should using.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.