I am after a solution to replace Microsoft TMG, and i am hoping there is an open source route of acomplishing.

Currently using TMG we are reverse proxying Web resources say for example sharepoint, from an internal Windows Domain (which utilises Kerberos for authentication) to a remote non-domain device.

TMG sets up a mutual (client authenticated) SSL tunnel to the devices, then performs a Kerberos Constrained Delegation to the internal domain using the UPN from the SSL Client Certificate.

This works really well and it means the client (providing it can talk mutual SSL) needs to know nothing about the Kerberos Authentication Context required to get into the back end service.

Question is - is there any way of doing this using Apache / NginX / Some other novel solution?


Nginx: There was someone working on a module back in 2009, however it looks like it never eventuated.

Apache: Yes, there is a module available for this. I personally haven't used it, however details seem to be available at the link. Kerberos Module

  • Ryhs - thanks for the response, i am not sure the Kerberos module does exactly what i need, i need the UPN from the Client Auth at the reverse proxy to be consumed by something to use for Kerberos Delegated Authentication. – diagonalbatman Oct 11 '13 at 9:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.