0

I would like to do single sign-on of a website in my windows box. I am using the Kerberos Authentication module of apache. This is working pretty fine when having just one web site.

This is the current configuration:

.htaccess file:

RewriteEngine On
AuthType Kerberos
AuthName "Login"
KrbAuthRealms MY.DOMAIN.NAME
KrbServiceName HTTP/sub1.domain.com@MY.DOMAIN.NAME
Krb5Keytab /etc/mykeytab.keytab
KrbMethodK5Passwd on
KrbAuthoritative on
KrbMethodNegotiate on
Require valid-user

In order to get that working, I needed to create a keytab file on my Active Directory Controller using the following command:

ktpass -out c:\temp\mykeytab.keytab
    -princ HTTP/sub1.domain.com@MY.DOMAIN.NAME
    -mapUser user1
    -mapOp set 
    -pass secret
    -crypto AES256-SHA1 
    -pType KRB5_NT_PRINCIPAL

As said, up to this point everything is working pretty fine. Now for the tricky part:

I would like to have a 2nd web site (vhost) on the same physical machine which is using the same Active Directory user (user1). I don't care if I need to use a different Service Principal name (SPN) or if I can use the same one as before.

The new site is named:

sub2.domain.com

and the .htaccess file is

.htaccess file:

RewriteEngine On
AuthType Kerberos
AuthName "Login"
KrbAuthRealms MY.DOMAIN.NAME
KrbServiceName HTTP/sub2.domain.com@MY.DOMAIN.NAME
Krb5Keytab /etc/mykeytab2.keytab
KrbMethodK5Passwd on
KrbAuthoritative on
KrbMethodNegotiate on
Require valid-user

I also created a new keytab file like this:

ktpass -out c:\temp\mykeytab2.keytab
    -princ HTTP/sub2.domain.com@MY.DOMAIN.NAME
    -mapUser user1
    -mapOp add 
    -pass secret
    -crypto AES256-SHA1 
    -pType KRB5_NT_PRINCIPAL
    -in c:\temp\mykeytab1.keytab

This keytab file now contains both SPNs mapped to user1.

When opening both web sites, only sub1 is still working, sub2 is giving a login prompt, i.e. SSO does not work with sub2.

Unfortunately, the apache2 log files do not contain any related information, although I used LogLevel debug.

In the meantime I found out that one of my problems is the key version number (kvno) which is different in both keytabs and also in the merged keytab file. (Both entries keep their original kvno with the older one becoming invalid as soon as the newer one is active...) Is there a way to have the same kvno on both keytabs (or on both entries of the combined keytab?). Btw, the corresponding error log message is:

[auth_kerb:error] [pid 8222] [client 10.10.10.10:59840] gss_accept_sec_context() failed: Unspecified GSS failure. Minor code may provide more information (, Key version number for principal in key table is incorrect)

Does anyone know why sub2 is not working correctly and sub1 does? ... and what I can do to have the same kvnos?

Best, TomS

0

Your KVNO (key version number) does not seem to be correct. If you use AD, you can generate a keytab with KVNO 255 (AD does not use KVNO). You can enable debug as described here: Kerberos Troubleshooting and if you post the content of the trace file I might be able to tell more.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.