I would like to do single sign-on of a website in my windows box. I am using the Kerberos Authentication module of apache. This is working pretty fine when having just one web site.
This is the current configuration:
RewriteEngine On AuthType Kerberos AuthName "Login" KrbAuthRealms MY.DOMAIN.NAME KrbServiceName HTTP/sub1.domain.com@MY.DOMAIN.NAME Krb5Keytab /etc/mykeytab.keytab KrbMethodK5Passwd on KrbAuthoritative on KrbMethodNegotiate on Require valid-user
In order to get that working, I needed to create a keytab file on my Active Directory Controller using the following command:
ktpass -out c:\temp\mykeytab.keytab -princ HTTP/sub1.domain.com@MY.DOMAIN.NAME -mapUser user1 -mapOp set -pass secret -crypto AES256-SHA1 -pType KRB5_NT_PRINCIPAL
As said, up to this point everything is working pretty fine. Now for the tricky part:
I would like to have a 2nd web site (vhost) on the same physical machine which is using the same Active Directory user (user1). I don't care if I need to use a different Service Principal name (SPN) or if I can use the same one as before.
The new site is named:
.htaccess file is
RewriteEngine On AuthType Kerberos AuthName "Login" KrbAuthRealms MY.DOMAIN.NAME KrbServiceName HTTP/sub2.domain.com@MY.DOMAIN.NAME Krb5Keytab /etc/mykeytab2.keytab KrbMethodK5Passwd on KrbAuthoritative on KrbMethodNegotiate on Require valid-user
I also created a new keytab file like this:
ktpass -out c:\temp\mykeytab2.keytab -princ HTTP/sub2.domain.com@MY.DOMAIN.NAME -mapUser user1 -mapOp add -pass secret -crypto AES256-SHA1 -pType KRB5_NT_PRINCIPAL -in c:\temp\mykeytab1.keytab
This keytab file now contains both SPNs mapped to user1.
When opening both web sites, only sub1 is still working, sub2 is giving a login prompt, i.e. SSO does not work with sub2.
Unfortunately, the apache2 log files do not contain any related information, although I used
In the meantime I found out that one of my problems is the key version number (kvno) which is different in both keytabs and also in the merged keytab file. (Both entries keep their original kvno with the older one becoming invalid as soon as the newer one is active...) Is there a way to have the same kvno on both keytabs (or on both entries of the combined keytab?). Btw, the corresponding error log message is:
[auth_kerb:error] [pid 8222] [client 10.10.10.10:59840] gss_accept_sec_context() failed: Unspecified GSS failure. Minor code may provide more information (, Key version number for principal in key table is incorrect)
Does anyone know why sub2 is not working correctly and sub1 does? ... and what I can do to have the same kvnos?