Recent changes to patches

#27 Better integration with Apache 2.2

Joachim Thuau — Fri, 23 Aug 2013 19:34:25 -0000

with the patch posted (not the CVS content), the KrbLocalUserMapping doesn't appear to have any effect.
I will be testing the CVS version and report.

little configure.in syntax error

Buck — Tue, 16 Jul 2013 19:42:01 -0000

it breaks ./configure for me

KrbUsernameLowercase

John Julien — Sat, 23 Jun 2012 05:18:01 -0000

This patch adds the directive KrbUsernameLowercase which defaults to off. If set to on it will translate the username to lowercase. This patch is useful on systems which authenticate against Active Directory's implementation of kerberos as AD does not enforce case sensitivity in a user's prinicipal.

Example:
AD account john exists and is stored in active directory as lowercase. This user may end up with a ticket that contains the principal JOHN@REALM. mod_auth_kerb will authenticate the user correctly but if apache is using the directive 'Require user john' authorization fails since REMOTE_USER is set by mod_auth_kerb as JOHN. This patch would set REMOTE_USER to john and thus satisfy the apache directive for ' Require user john'.

It has many other applications as well but this is the easiest to setup for proof of concept.

Support for apache2.4

Grant Byers — Thu, 26 Apr 2012 22:03:26 -0000

This patch updates the ap_log_* & a few request fields to support API changes for Apache 2.4.

Add enterprise & canonicalize support (Active Directory)

George H. — Mon, 09 Jan 2012 22:44:55 -0000

Applies primarily to Active Directory authentication (possibly others?)

When KrbMethodK5Passwd=On and SSO doesn't work, the user get's prompted for authentication. Logging in with a bare username (i.e. user), if KRB is configured to do so, the default_realm is used to authentication the user as user@REALM. With a bare username, authentication works. When logging in with user@REALM, authentication also works. However, if the user attempts to logon with user@realm (lowercase), authentication will fail with the error:

krb5_get_init_creds_password() failed: KDC reply did not match expectations

Enterprise (NT-ENTERPRISE) authentication takes user@realm and converts it to user\@realm@REALM.
Canonical authentication will allow lowercase authentication.

KrbCanonicalize and KrbEnterprise configuration options added.

The kinit command supports these two options with '-E' and '-C' command options. For kerberos installations that require this (i.e. Active Directory), these options can be enabled so that various forms of username work for authentication (i.e. user, user@REALM, user@realm)

Patch to get rid of the regression of KrbSaveCredentials

Benjamin Kahn — Wed, 16 Mar 2011 16:00:06 -0000

When using password authentication with Keep-Alive and Credential Delegation, only the first request gets credentials. A previous patch makes the user re-auth in this case. This patch makes already_succeeded recover the delegated credentials.

Patch to get rid of the regression of KrbSaveCredentials bec

pj101 — Thu, 07 Jan 2010 12:56:45 -0000

Proposed simple patch for the bug : already_succeeded prevents KrbSaveCredentials to work - ID 2818141

Remove rpath from SPNEGO configure check

Andreas Johansson — Thu, 03 Sep 2009 16:16:30 -0000

When checking if the Kerberos implementation supports SPNEGO, the configure script adds a linker flag used by GNU ld to set the library runtime search path. When using for example the Solaris ld, this causes the test to fail due to a linker error.

Setting the rpath at all, when only compile testing and not running the test case, seems unnecessary. Removing this flag altogether seems like the easiest solution. See attached path.

Removing this flag enabled the use of SPNEGO support from MIT Kerberos 1.7 on a Solaris 10 host.

Better integration with Apache 2.2

Fabrice Bacchella — Mon, 27 Apr 2009 11:47:59 -0000

Apache 2.2 made a separation with auhentication and authorization.
When used as a basic authentication back end, mod_kerberos should be less intrusive for a better integration with ehanced functionnality of this new separation.
This patch plug mod_auth_kerb as a AUTHN_PROVIDER_GROUP fo the name kerberos.
To use it, add this in the configuration file :
AuthBasicAuthoritative On
AuthBasicProvider kerberos

With this, all the new features of apache 2.2 can be used (like AuthnProviderAlias)

The KrbAuthoritative directive become useless.

I copied the function authenticate_user_krb5pwd to authenticate_user_krb5pwd22, but both could be merged with special care.

Few problems in autodection

Fabrice Bacchella — Mon, 27 Apr 2009 11:26:32 -0000

The configure script doesn't detect well Kerberos IV and the result doesn't compile in Centos 5.2. This patch should help. There is also a minor check added for kerberos 5