I am after a solution to replace Microsoft TMG, and i am hoping there is an open source route of acomplishing.
Currently using TMG we are reverse proxying Web resources say for example sharepoint, from an internal Windows Domain (which utilises Kerberos for authentication) to a remote non-domain device.
TMG sets up a mutual (client authenticated) SSL tunnel to the devices, then performs a Kerberos Constrained Delegation to the internal domain using the UPN from the SSL Client Certificate.
This works really well and it means the client (providing it can talk mutual SSL) needs to know nothing about the Kerberos Authentication Context required to get into the back end service.
Question is - is there any way of doing this using Apache / NginX / Some other novel solution?