3 ms·
Just use a reverse proxy. Envoy, Nginx, whatever.
by cryptonector 4y ago
Just use a reverse proxy. Envoy, Nginx, whatever.
- p_l 4y agoThe problematic part wasn't handling Negotiate w/ GSSAPI on server side, it was handling Negotiate w/ GSSAPI on client side. On keycloak side, it took a small configuration change (provide it with keytab, pretty much). By also using OIDC with Keycloak, I could ensure that access based on LDAP group membership was checked before accessing the application.
- cryptonector 4y agoHmm? All browsers, and curl, support Negotiate. There's support in many HTTP libraries for various languages as well. It's not universal though, that's for sure. At $WORK we have a [proprietary] client-side proxy to do Negotiate for apps that don't.