我正在尝试在Windows Server 2008中使用ActiveDirectory设置与kerberos的集成Windows身份验证,一切正常,我能够在成功登录时获得kerberos票证。我在将此票证转发到配置了 Apache 的服务器时遇到问题。当放弃票证时,未在 Apache/PHP 环境变量中设置工单KRB5CCNAME。
我的 kerberos 配置文件 (krb5.conf( 是
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm = DIVAMI.COM
default_keytab_file = /etc/krb5.keytab
dns_lookup_realm = true
dns_lookup_kdc = true
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
[realms]
DIVAMI.COM = {
kdc = meluha.divami.com:88
admin_server = meluha.divami.com:749
default_domain = divami.com
}
[domain_realm]
meluha.divami.com = DIVAMI.COM
divami.com = DIVAMI.COM
Apache mod_auth_kerb配置文件(auth_kerb( 是
<Location /perfmon>
AuthType Kerberos
AuthName "Kerberos Login"
KrbMethodNegotiate On
KrbMethodK5Passwd Off
KrbAuthRealms DIVAMI.COM
Krb5KeyTab /etc/httpd/conf.d/apache.keytab
KrbSaveCredentials On
KrbServiceName HTTP/greenplum.divami.com
require valid-user
ErrorDocument 404 "No favicon"
</Location>
浏览器配置
火狐
Set network.negotiate-auth.delegation-uris to greenplum.divami.com.
Set network.negotiate-auth.trusted-uris to greenplum.divami.com
IE
In Internet Explorer, select Tools > Internet Options.
In the Local Internet (Advanced) dialog box, enter all relative domain names that will be used on the intranet (e.g. greenplum.divami.com).
当我将 KrbMethodK5Passwd 设置为 On 时,浏览器会生成 kerberos 用户名和密码以提供有效凭据票证,并在 Apache/PHP 环境变量 KRB5CCNAME 中设置其缓存位置。使用此变量KRB5CCNAME,我们可以使用被放弃的 kerberos 票证作为身份验证凭据。
当 KrbMethodK5Passwd 关闭时,我收到以下错误消息。
[Wed Sep 25 18:48:11 2013] [debug] src/mod_auth_kerb.c(1939): [client 10.81.17.156] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos
[Wed Sep 25 18:48:11 2013] [debug] src/mod_auth_kerb.c(1939): [client 10.81.17.156] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos
[Wed Sep 25 18:48:11 2013] [debug] src/mod_auth_kerb.c(1278): [client 10.81.17.156] Acquiring creds for HTTP/greenplum.divami.com
[Wed Sep 25 18:48:11 2013] [debug] src/mod_auth_kerb.c(1691): [client 10.81.17.156] Verifying client data using KRB5 GSS-API
[Wed Sep 25 18:48:11 2013] [debug] src/mod_auth_kerb.c(1707): [client 10.81.17.156] Client didn't delegate us their credential
[Wed Sep 25 18:48:11 2013] [debug] src/mod_auth_kerb.c(1726): [client 10.81.17.156] GSS-API token of length 180 bytes will be sent back
plum.divami.com/perfmon/login.php
[Wed Sep 25 18:48:11 2013] [debug] src/mod_auth_kerb.c(1691): [client 10.81.17.156] Verifying client data using KRB5 GSS-API , referer:http://greenplum.divami.com/perfmon/login.php
我不知道是浏览器无法选择kerberos票证,还是浏览器选择了票证但无法在KRB5CCNAME中设置缓存位置。请帮助我解决这个问题。
检查您的密钥表文件
cat apache.keytab
如果您看到纯文本且没有奇怪的字符,则您的密钥表未正确生成。可能是AD方面的一些东西。
正确的键表应如下所示,
cat httpd.keytab
.G..COMPANY.LOCALweb01.httpd.[N5�...��f'.Z�GR._x?���.G..COMPANY.LOCALweb01.httpd.[N5�...�=.�.�6w!k�e���.W..COMPANY.LOCALweb01.httpd.[N5�.. ]c��84��w�1Jo�.zH�rDY>�
����B.F..COMPANY.LOCAL.HTTtestlogs.[N5�...��f'.Z�GR._x?���.F..COMPANY.LOCAL.HTTtestlogs.[N5�...�=.�.�6w!k�e���.V..