2 ms·
One time I actually implemented that on OIDC... by having the OIDC login page do a kerberos login :D this meant that at most you had a short flash on screen fo
by p_l 2y ago
One time I actually implemented that on OIDC... by having the OIDC login page do a kerberos login :D
this meant that at most you had a short flash on screen for web apps... which is a bit like OIDC/SAML login on windows domains (but I did it with keycloak back then)
- lq9AJ8yrfs 2y agoAuthentik supports this [1] too, kinda. It seems you can set it up to register you based on a bona fide kerberos auth, and logs you in (maybe? would have to check) with kerberos but seems to keep a parallel synchronized authenticator in its own database for OIDC and "modern" auth. Doesn't seem to embed kerberos-isms as "claims" in OIDC either. Might be awesome if it did? Or terrible, depending on how you look at it. [1] https://docs.goauthentik.io/docs/users-sources/sources/protocols/kerberos/ https://docs.goauthentik.io/docs/users-sources/sources/proto...
- p_l 2y agoMIT Kerberos can authenticate using OIDC created token, but in my case I essentially authenticated to Keycloak with HTTP Negotiate with Kerberos, then based on data from LDAP (that was also used by Kerberos) I generated appropriate OIDC token.