modauthkerb-help Mailing List for Kerberos Module For Apache

Read and respond to this message at: 
https://sourceforge.net/forum/message.php?msg_id=2172809
By: matoch

The fact that the new one version has support for Heimdal makes me happy. This
should work on OpenBSD then. I've compiled it with APXS1 defined as well as
HEIMDAL What I'm not sure about is what other options/file paths need to be
defined to make this work. Are there a new set of instructions that explain
the compiling options yet?


Thankyou for any help provided,



James

______________________________________________________________________
You are receiving this email because you elected to monitor this forum.
To stop monitoring this forum, login to SourceForge.net and visit: 
https://sourceforge.net/forum/unmonitor.php?forum_id=171554

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

So, having a problem with my setup.

Things were built as follows:

/opt/apache2/bin/apxs -c -i -a  -DKRB_V5_KEYTAB=\\/etc/krb5.keytab\\ 
- -DKRB5 -DAPXS2 -DKRB5_SAVE_CREDENTIALS -DKRB5_VERIFY_TICKET 
- -DKRB_DEF_REALM=HERMES.EAENOS.ORG -I/usr/local/include -L/usr/local/lib 
- -lkrb5 -lcom_err -lk5crypto  /opt/src/modules/kerberos/mod_auth_kerb.c

(Yes, I know about the keytab, but no... apache is chrooted, that is 
apache's /etc, not systems's)...


.htaccess for /testing/ is:

AuthType KerberosV5
AuthName "Kerberos Login"
KrbAuthRealm HERMES.EAENOS.ORG
require valid-user
KrbAuthFailStatus forbidden
KrbAuthAuthoritative on

The error given is:

configuration error:  couldn't check user.  No user file?: /testing/

Yes, I have saw: 
http://sourceforge.net/mailarchive/message.php?msg_id=1913997, and as 
you can see -DKRB5 is called.  It seems to be similar issue to: 
http://sourceforge.net/mailarchive/message.php?msg_id=4701385




The machine is running Apache 2 and FreeBSD 5.1-release.
# gcc -v
Using built-in specs.
Configured with: FreeBSD/i386 system compiler
Thread model: posix
gcc version 3.2.2 [FreeBSD] 20030205 (release)




When things did not work...


 From google I found of interest: 
http://www.rudedog.org/pipermail/auth_ldap/2000-November/042927.html, 
so I placed

LoadModule kerb_auth_module   modules/mod_auth_kerb.so at the top 
(there are no other loadmodule directives btw), I also placed in the 
Directory config for </>
AuthAuthoritative Off

to allow the passing from mod_auth to mod_auth_kerb

I have a funny feeling that I am missing something pretty obvious.

Any ideas?


CH





-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (Darwin)

iD8DBQE/UEaotf2vknGZ+KoRAqn0AJ4k39J9BOK8xKVr9OthKaYu2sAe6gCdEi5A
SaKJAJ1qURAlRm666LVPf3k=
=6rZj
-----END PGP SIGNATURE-----

Read and respond to this message at: 
https://sourceforge.net/forum/message.php?msg_id=2148419
By: nobody

There's also the possibilty to use a "transformation" service, which translates
a krb4 ticket to an X.509 certificate and let the www client authenticate using
SSL. Such service exists for kerberos5 (kx509) and I think it should be possible
to port it to krb4 too. I believe you could find more information from your
colleagues at Cern (are you from Cern, aren't you :-)

______________________________________________________________________
You are receiving this email because you elected to monitor this forum.
To stop monitoring this forum, login to SourceForge.net and visit: 
https://sourceforge.net/forum/unmonitor.php?forum_id=171554

Read and respond to this message at: 
https://sourceforge.net/forum/message.php?msg_id=2148267
By: nobody

Dear Daniel,

sorry for replying 3 times previously.

Well - upgrade of our whole site to Kerberos 5 is planned, but unlikely happen
in a short feature.

Thank you again - very much for all your help.

Vlado Bahyl

______________________________________________________________________
You are receiving this email because you elected to monitor this forum.
To stop monitoring this forum, login to SourceForge.net and visit: 
https://sourceforge.net/forum/unmonitor.php?forum_id=171554

Read and respond to this message at: 
https://sourceforge.net/forum/message.php?msg_id=2148145
By: nobody

Dear Daniel,

OK - finally I found where the problem was. I was compiling for Kerberos 4 against
wrong libraries (krb5-devel-1.2.4-11) instead of krb4-devel-1.1-5.

So now - with the browser, I am asked for my Kerberos username and password
and I am correctly authenticated.

All is fine up to here, but actually this is not what I want in the end.

We use Kerberos here as a part of authentication. It means that when I am connected
to a node A I am Kerberos authenticated.

What I now want is to start a web client (or an application) on the node A (where
I am already authenticated with my Kerberos credentials) and access something
on the web server B (which is running your module) without being asked for a
password.

My quess is that your module might not be a solution to this - but anyway -
do you know how do I pass the Kerberos credentials in a Kerberos 4 token from
1 node to another (web server) so that I am not asked for a password ?

Thank you in advance so much for your help.

Cheers,

Vlado bahyl

______________________________________________________________________
You are receiving this email because you elected to monitor this forum.
To stop monitoring this forum, login to SourceForge.net and visit: 
https://sourceforge.net/forum/unmonitor.php?forum_id=171554

Read and respond to this message at: 
https://sourceforge.net/forum/message.php?msg_id=2148169
By: kouril

The new version (in CVS) of the module will support ticket based authentication
(which is what you're looking for, I think) for Kerberos5. The client must support
this method, of course but there's a plugin for Mozilla and it's also possible
to make it work with MS IE. This is not supported for krb4, though. It would
be much easier for you if you could upgrade to krb5. Any chance to do so?

______________________________________________________________________
You are receiving this email because you elected to monitor this forum.
To stop monitoring this forum, login to SourceForge.net and visit: 
https://sourceforge.net/forum/unmonitor.php?forum_id=171554

Read and respond to this message at: 
https://sourceforge.net/forum/message.php?msg_id=2148152
By: nobody

Dear Daniel,

OK - finally I found where the problem was. I was compiling for Kerberos 4 against
wrong libraries (krb5-devel-1.2.4-11) instead of krb4-devel-1.1-5.

So now - with the browser, I am asked for my Kerberos username and password
and I am correctly authenticated.

All is fine up to here, but actually this is not what I want in the end.

We use Kerberos here as a part of authentication. It means that when I am connected
to a node A I am Kerberos authenticated.

What I now want is to start a web client (or an application) on the node A (where
I am already authenticated with my Kerberos credentials) and access something
on the web server B (which is running your module) without being asked for a
password.

My quess is that your module might not be a solution to this - but anyway -
do you know how do I pass the Kerberos credentials in a Kerberos 4 token from
1 node to another (web server) so that I am not asked for a password ?

Thank you in advance so much for your help.


Cheers,

Vlado bahyl

______________________________________________________________________
You are receiving this email because you elected to monitor this forum.
To stop monitoring this forum, login to SourceForge.net and visit: 
https://sourceforge.net/forum/unmonitor.php?forum_id=171554

Read and respond to this message at: 
https://sourceforge.net/forum/message.php?msg_id=2148142
By: nobody

Dear Daniel,

OK - finally I found where the problem was. I was compiling for Kerberos 4 against
wrong libraries (krb5-devel-1.2.4-11) instead of krb4-devel-1.1-5.

So now - with the browser, I am asked for my Kerberos username and password
and I am correctly authenticated.

All is fine up to here, but actually this is not what I want in the end.

We use Kerberos here as a part of authentication. It means that when I am connected
to a node A I am Kerberos authenticated.

What I now want is to start a web client (or an application) on the node A (where
I am already authenticated with my Kerberos credentials) and access something
on the web server B (which is running your module) without being asked for a
password.

My quess is that your module might not be a solution to this - but anyway -
do you know how do I pass the Kerberos credentials in a Kerberos 4 token from
1 node to another (web server) so that I am not asked for a password ?

Thank you in advance so much for your help.


Cheers,

Vlado bahyl

______________________________________________________________________
You are receiving this email because you elected to monitor this forum.
To stop monitoring this forum, login to SourceForge.net and visit: 
https://sourceforge.net/forum/unmonitor.php?forum_id=171554

Read and respond to this message at: 
https://sourceforge.net/forum/message.php?msg_id=2147913
By: kouril

The file should be created by apache, the filename is choosen to be unique for
each request (so it doesn't make sense to create another file of this name).

Please could you tell me which implementation/version of Kerberosv4 you're using?
Do you have access to you KDC to find out the log records appropriate?

You can also try using the new version available from CVS (see
http://cvs.sourceforge.net/cgi-bin/viewcvs.cgi/modauthkerb/mod_auth_kerb/src/
). I'm going to publish this new release soon, so the code is quite stable.
Let me know directly (to ko...@us...) if you have any problem
s with configuration.

______________________________________________________________________
You are receiving this email because you elected to monitor this forum.
To stop monitoring this forum, login to SourceForge.net and visit: 
https://sourceforge.net/forum/unmonitor.php?forum_id=171554

Read and respond to this message at: 
https://sourceforge.net/forum/message.php?msg_id=2146869
By: nobody

Dear Dan,

thanx for your help. I did manage to strace the httpd and I can see from this
call:

lstat64("/tmp/apache_tkt_2271", 0xbfffa820) = -1 ENOENT (No such file or
directory)

that the file which is missing is /tmp/apache_tkt_2271.

How is this file created ? Why isn't it created with the mod_auth_kerb module ?

What I tried was to issue kinit on the node. Then the file /tmp/tkt6774_2380
was created and I copied that file over to /tmp/apache_tkt_2271.
Unfortunatelly, that didn't help, the authorisation failed. Probably the file
didn't have the expected format.

So - I still didn't move any further.

What am I doing wrong ?
Who should create these tkt* files in /tmp ?

Please help me. Thank you in advance.

S pozdravom

Vlado Bahyl

______________________________________________________________________
You are receiving this email because you elected to monitor this forum.
To stop monitoring this forum, login to SourceForge.net and visit: 
https://sourceforge.net/forum/unmonitor.php?forum_id=171554

Read and respond to this message at: 
https://sourceforge.net/forum/message.php?msg_id=2140091
By: kouril

Are you able to get your tickets directly using kinit from the webserver machine?
If so, could you try using strace to find out which file or directory is
missing?

Empty intance is absolutely all right. SSL sholdn't have any influence on the
way how passwords are verified.

--
Dan

______________________________________________________________________
You are receiving this email because you elected to monitor this forum.
To stop monitoring this forum, login to SourceForge.net and visit: 
https://sourceforge.net/forum/unmonitor.php?forum_id=171554

Read and respond to this message at: 
https://sourceforge.net/forum/message.php?msg_id=2136901
By: nobody

Dear all,

I have downloaded the mod_auth_kerb.c, compiled it and created the binary
mod_auth_kerb.so without any problems.

After this I have configured Apache web server (no SSL) adding some directives
to Apache config file:

Alias /directory/ /usr/local/directory/
<Directory /usr/local/directory>
    AllowOverride None 
    AuthType KerberosV4
    AuthName "Kerberos Login"
    KrbAuthRealm DOMAIN.COM
    require valid-user
</Directory> 

And I restart the httpd with the new configuration.

When I try to open this web page (http://hostname/directory/) a prompt appears
asking for username and password. I type my AFS Kerberos 4 username and password
but they are not recognized => I am asked for the username & password again.

In the /var/log/httpd/error-log I can see lines like this:

[Mon Aug  4 18:01:26 2003] [error] (2)No such file or directory: access
to /directory/ failed for hostnameX.cern.ch, reason: krb_get_pw_in_tkt(vlado.):
Password incorrect

Where 'vlado' is my username and I am 100% sure that the password is correct
and the /usr/local/directory exists.

Looking into the source code, I can see that 'instance' variable is empty. Is
that normal ?

Why can not the server authenticate me ?
What am I doing wrong ? What am I missing here ? Is the fact that I am not using
SSL cause of this problem of repeated unsuccessful authentication ?

Kerberos ticket files on our system are in this format:
/tmp/tktUID_RandomNumber

Thank you very much in advance for any kind of help.

Vlado Bahyl

______________________________________________________________________
You are receiving this email because you elected to monitor this forum.
To stop monitoring this forum, login to SourceForge.net and visit: 
https://sourceforge.net/forum/unmonitor.php?forum_id=171554

Read and respond to this message at: 
https://sourceforge.net/forum/message.php?msg_id=2130780
By: kouril

Sorry, I don't have any experience with compiling apache on the Windows platforms.
Are you able to build the apache package without mod_auth_kerb (building instruction
for Windows can be found at
http://httpd.apache.org/docs-2.0/platform/win_compiling.html) ?

According to the error you're describing, I'd guess you're compiling the module
without defining the APXS2 cpp definition. Could you try adding
some equivalent of -DAPXS2 to your "Makefile", or try adding
  #define APXS2
to the begining of the file.

______________________________________________________________________
You are receiving this email because you elected to monitor this forum.
To stop monitoring this forum, login to SourceForge.net and visit: 
https://sourceforge.net/forum/unmonitor.php?forum_id=171554