Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am after a solution to replace Microsoft TMG, and i am hoping there is an open source route of acomplishing.

Currently using TMG we are reverse proxying Web resources say for example sharepoint, from an internal Windows Domain (which utilises Kerberos for authentication) to a remote non-domain device.

TMG sets up a mutual (client authenticated) SSL tunnel to the devices, then performs a Kerberos Constrained Delegation to the internal domain using the UPN from the SSL Client Certificate.

This works really well and it means the client (providing it can talk mutual SSL) needs to know nothing about the Kerberos Authentication Context required to get into the back end service.

Question is - is there any way of doing this using Apache / NginX / Some other novel solution?

share|improve this question

1 Answer 1

Nginx: There was someone working on a module back in 2009, however it looks like it never eventuated.

Apache: Yes, there is a module available for this. I personally haven't used it, however details seem to be available at the link. Kerberos Module

share|improve this answer
    
Ryhs - thanks for the response, i am not sure the Kerberos module does exactly what i need, i need the UPN from the Client Auth at the reverse proxy to be consumed by something to use for Kerberos Delegated Authentication. –  diagonalbatman Oct 11 '13 at 9:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.