Recent changes to patches

#27 Better integration with Apache 2.2

2013-08-23T19:34:25.250000Z

with the patch posted (not the CVS content), the KrbLocalUserMapping doesn't appear to have any effect.
I will be testing the CVS version and report.

little configure.in syntax error

2013-07-16T19:42:01.878000Z

it breaks ./configure for me

KrbUsernameLowercase

2012-06-23T05:18:01Z

This patch adds the directive KrbUsernameLowercase which defaults to off. If set to on it will translate the username to lowercase. This patch is useful on systems which authenticate against Active Directory's implementation of kerberos as AD does not enforce case sensitivity in a user's prinicipal.

Example:
AD account john exists and is stored in active directory as lowercase. This user may end up with a ticket that contains the principal JOHN@REALM. mod_auth_kerb will authenticate the user correctly but if apache is using the directive 'Require user john' authorization fails since REMOTE_USER is set by mod_auth_kerb as JOHN. This patch would set REMOTE_USER to john and thus satisfy the apache directive for ' Require user john'.

It has many other applications as well but this is the easiest to setup for proof of concept.

Support for apache2.4

2012-04-26T22:03:26Z

This patch updates the ap_log_* & a few request fields to support API changes for Apache 2.4.

Add enterprise & canonicalize support (Active Directory)

2012-01-09T22:44:55Z

Applies primarily to Active Directory authentication (possibly others?)

When KrbMethodK5Passwd=On and SSO doesn't work, the user get's prompted for authentication. Logging in with a bare username (i.e. user), if KRB is configured to do so, the default_realm is used to authentication the user as user@REALM. With a bare username, authentication works. When logging in with user@REALM, authentication also works. However, if the user attempts to logon with user@realm (lowercase), authentication will fail with the error:

krb5_get_init_creds_password() failed: KDC reply did not match expectations

Enterprise (NT-ENTERPRISE) authentication takes user@realm and converts it to user\@realm@REALM.
Canonical authentication will allow lowercase authentication.

KrbCanonicalize and KrbEnterprise configuration options added.

The kinit command supports these two options with '-E' and '-C' command options. For kerberos installations that require this (i.e. Active Directory), these options can be enabled so that various forms of username work for authentication (i.e. user, user@REALM, user@realm)

Patch to get rid of the regression of KrbSaveCredentials

2011-03-16T16:00:06Z

When using password authentication with Keep-Alive and Credential Delegation, only the first request gets credentials. A previous patch makes the user re-auth in this case. This patch makes already_succeeded recover the delegated credentials.

Patch to get rid of the regression of KrbSaveCredentials bec

2010-01-07T12:56:45Z

Proposed simple patch for the bug : already_succeeded prevents KrbSaveCredentials to work - ID 2818141

Remove rpath from SPNEGO configure check

2009-09-03T16:16:30Z

When checking if the Kerberos implementation supports SPNEGO, the configure script adds a linker flag used by GNU ld to set the library runtime search path. When using for example the Solaris ld, this causes the test to fail due to a linker error.

Setting the rpath at all, when only compile testing and not running the test case, seems unnecessary. Removing this flag altogether seems like the easiest solution. See attached path.

Removing this flag enabled the use of SPNEGO support from MIT Kerberos 1.7 on a Solaris 10 host.

Better integration with Apache 2.2

2009-04-27T11:47:59Z

Apache 2.2 made a separation with auhentication and authorization.
When used as a basic authentication back end, mod_kerberos should be less intrusive for a better integration with ehanced functionnality of this new separation.
This patch plug mod_auth_kerb as a AUTHN_PROVIDER_GROUP fo the name kerberos.
To use it, add this in the configuration file :
AuthBasicAuthoritative On
AuthBasicProvider kerberos

With this, all the new features of apache 2.2 can be used (like AuthnProviderAlias)

The KrbAuthoritative directive become useless.

I copied the function authenticate_user_krb5pwd to authenticate_user_krb5pwd22, but both could be merged with special care.

Few problems in autodection

2009-04-27T11:26:32Z

The configure script doesn't detect well Kerberos IV and the result doesn't compile in Centos 5.2. This patch should help. There is also a minor check added for kerberos 5