5 ms·

How do you integrate kerberos sso and http? Is there web browser support? The last time I looked at this, I could get sso to work with apache on the server side

by e12e 9y ago

How do you integrate kerberos sso and http? Is there web browser support? The last time I looked at this, I could get sso to work with apache on the server side and windows (internet explorer) clients - but for anything else I don't think I got ticket forwarding etc to work? (Granted this is a long while back). I'd love to hear a few keywords about your stack (heimdal/mit, web server(s), directory server(s) etc)?

gerdesj 9y ago
Have a look at the Arch and Gentoo wikis both have a lot of notes. I wrote this: https://wiki.gentoo.org/wiki/Kerberos_Windows_Interoperability https://wiki.gentoo.org/wiki/Kerberos_Windows_Interoperabili... It is a little out of date (I keep the latest set of notes on our corp wiki) but will get you most of the way there. The notes on the Arch wiki also have some quite up to date notes on using pam_mount and getting mount.cifs working with Kerberos (ie I've read the docs and experimented, so you don't have to) winbindd in Samba 4.x is really rather good and will happily manage the Kerberos side of things for you for a minimal setup cost. If you find yourself following a howto that starts whittering on about using setspn.exe on a DC then run away! I recently noticed that SSSD is available on rather a lot of Linux distros and is well respected. Must have a look. As I mentioned in another thread there is a lot of support for SSO with Kerberos/GSSAPI in nearly everything you can get your paws on. Even Nagstamon can do it! Chrome on Windows - Group Policy, Chrome or Chromium on Linux - policies in a JSON file in a certain location, Firefox - about:config - you can send out FF settings with a file (can't remember the name), IE - Group Policy. PuTTY for ssh. OpenSSH client and server. Squid. Apache, nginx, IIS all do it. I login to this laptop using my AD username and password. If the wifi is a bit slow and winbindd can't get to the domain then it uses a cached (cryptographically hashed) version of my password to allow me in or not. When it finds the DC (VPN or LAN) then it is able to fix up my Kerberos ticket cache on my behalf. I know for a fact (by direct experience) that this all works on Gentoo, Arch and Ubuntu (Xenial and Trusty). Any Unix-alike distro that can run mitkrb or heimdal and Samba 4 should be able to do all of this.
- noinsight 9y ago
  > winbindd ... I recently noticed that SSSD is available on rather a lot of Linux distros and is well respected. Must have a look. Yeah definitely ditch winbindd and use SSSD. SSSD makes doing this really easy and works really well.
  - jabl 9y ago
    Yes. Except on samba servers, on those you really really want to run winbindd.
    - Spivak 9y ago
      Are you using Samba as a DC in this situation? Because I can't think of a reason you would have to ditch SSSD to set up file shares.
      - jabl 9y ago
        No, just as a AD member server. Without winbindd, samba has to fall back to the libc pam/nss functionality which is not as full-featured as the one provided by winbindd. So there's some performance benefits which might or might not matter for you, but there's also some cases that don't work at all without winbindd; at least we were unable to allow non-domain clients (e.g. personal laptops) access to a smb share without winbindd. If you dig into this topic you can find mails from samba core devs on samba-technical saying that you REALLY should run winbind for a samba AD member server.
0x6019 9y ago
We use Keycloak (hooked up to FreeIPA) which will try to authenticate against Kerberos and then fall back to a regular login screen or a cookie for more limited SSO. The actual web apps are configured with OpenID Connect or SAML and don't know anything about Kerberos.
- icebraining 9y ago
  Keycloak is interesting, thanks.
- emmelaich 9y ago
  http://www.keycloak.org/ http://www.keycloak.org/ looks fantastic. btw, https doesn't work, the cert indicates github
feld 9y ago
FreeBSD, OpenSSH, Apache mod_kerb2 (and mod_auth_ldap for authorization), Active Directory. 1. install server 2. msktutil tool joins machine to domain (simple tool; no dependencies) and now you have /etc/krb5.keytab file 3. minor configuration for base OS -- LDAP using keytab instead of bind user with static password, etc 4. webservers just need an HTTP principal keytab created (simple msktutil command, then extract it from the /etc/krb5.keytab file into a file apache can read/write) 5. I can ssh to every server without a password after running "kinit" on my macbook 6. it just works and it's reliable, time tested, and secure.

by e12e 9y ago

gerdesj 9y ago

Have a look at the Arch and Gentoo wikis both have a lot of notes. I wrote this: https://wiki.gentoo.org/wiki/Kerberos_Windows_Interoperability https://wiki.gentoo.org/wiki/Kerberos_Windows_Interoperabili... It is a little out of date (I keep the latest set of notes on our corp wiki) but will get you most of the way there. The notes on the Arch wiki also have some quite up to date notes on using pam_mount and getting mount.cifs working with Kerberos (ie I've read the docs and experimented, so you don't have to) winbindd in Samba 4.x is really rather good and will happily manage the Kerberos side of things for you for a minimal setup cost. If you find yourself following a howto that starts whittering on about using setspn.exe on a DC then run away! I recently noticed that SSSD is available on rather a lot of Linux distros and is well respected. Must have a look. As I mentioned in another thread there is a lot of support for SSO with Kerberos/GSSAPI in nearly everything you can get your paws on. Even Nagstamon can do it! Chrome on Windows - Group Policy, Chrome or Chromium on Linux - policies in a JSON file in a certain location, Firefox - about:config - you can send out FF settings with a file (can't remember the name), IE - Group Policy. PuTTY for ssh. OpenSSH client and server. Squid. Apache, nginx, IIS all do it. I login to this laptop using my AD username and password. If the wifi is a bit slow and winbindd can't get to the domain then it uses a cached (cryptographically hashed) version of my password to allow me in or not. When it finds the DC (VPN or LAN) then it is able to fix up my Kerberos ticket cache on my behalf. I know for a fact (by direct experience) that this all works on Gentoo, Arch and Ubuntu (Xenial and Trusty). Any Unix-alike distro that can run mitkrb or heimdal and Samba 4 should be able to do all of this.

noinsight 9y ago
> winbindd ... I recently noticed that SSSD is available on rather a lot of Linux distros and is well respected. Must have a look. Yeah definitely ditch winbindd and use SSSD. SSSD makes doing this really easy and works really well.
- jabl 9y ago
  Yes. Except on samba servers, on those you really really want to run winbindd.
  - Spivak 9y ago
    Are you using Samba as a DC in this situation? Because I can't think of a reason you would have to ditch SSSD to set up file shares.
    - jabl 9y ago
      No, just as a AD member server. Without winbindd, samba has to fall back to the libc pam/nss functionality which is not as full-featured as the one provided by winbindd. So there's some performance benefits which might or might not matter for you, but there's also some cases that don't work at all without winbindd; at least we were unable to allow non-domain clients (e.g. personal laptops) access to a smb share without winbindd. If you dig into this topic you can find mails from samba core devs on samba-technical saying that you REALLY should run winbind for a samba AD member server.

0x6019 9y ago

We use Keycloak (hooked up to FreeIPA) which will try to authenticate against Kerberos and then fall back to a regular login screen or a cookie for more limited SSO. The actual web apps are configured with OpenID Connect or SAML and don't know anything about Kerberos.

icebraining 9y ago
Keycloak is interesting, thanks.
emmelaich 9y ago
http://www.keycloak.org/ http://www.keycloak.org/ looks fantastic. btw, https doesn't work, the cert indicates github

feld 9y ago

FreeBSD, OpenSSH, Apache mod_kerb2 (and mod_auth_ldap for authorization), Active Directory. 1. install server 2. msktutil tool joins machine to domain (simple tool; no dependencies) and now you have /etc/krb5.keytab file 3. minor configuration for base OS -- LDAP using keytab instead of bind user with static password, etc 4. webservers just need an HTTP principal keytab created (simple msktutil command, then extract it from the /etc/krb5.keytab file into a file apache can read/write) 5. I can ssh to every server without a password after running "kinit" on my macbook 6. it just works and it's reliable, time tested, and secure.