Russ Allbery wrote: > > I am just curious. What Windows client programs and Unix server programs > > (or vice versa) must you use? How do you use this trust?
> We allow all Active Directory users at Stanford to log on either in the AD > realm or in the university Heimdal realm, and try to set up as many > services as we can to accept either set of credentials as equivalent. > This is relatively easy on the AD side. On the UNIX side, WebAuth (via > Negotiate-Auth/SPNEGO) is configured to trust AD credentials and treat > them as equivalent, as is AFS; the rest is somewhat hit or miss. For > example, I don't think AD credentials work with GSSAPI authentication to > Zimbra, mostly because we've not gotten around to figuring out how to tell > Zimbra to treat the credentials as equivalent. > We also routinely authenticate automated UNIX clients to AD services and > vice versa for things like authenticated LDAP queries and the like. > In general, AD is used as the primary authentication realm for all > services running on Windows inside the AD forest, and for users who log in > via AD. Most systems (such as student systems) are not joined to AD, and > general campus use all uses the Heimdal realm, with occasional cross-realm > authentications to Windows web services. Most principals for automated > processes, host and service principals, and so forth are issued from the > Heimdal realm, since we have invested more effort into automated principal > management, distributed ACLs, and the like on the Heimdal side. Thank you, that was interesting to read. > > I am trying to setup a trust so that MSIE users could have a SSO to a > > site running Apache on FreeBSD but I don't know yet if the game is > > worth the candle. > It should be fairly straightforward. I seem to have hit a problem where I have not expected any: # apachectl configtest httpd: Syntax error on line 106 of /usr/local/etc/apache22/httpd.conf: Cannot load /usr/local/libexec/apache22/mod_auth_kerb.so into server: /usr/local/libexec/apache22/mod_auth_kerb.so: Undefined symbol "gsskrb5_register_acceptor_identity" # # ldd /usr/local/libexec/apache22/mod_auth_kerb.so /usr/local/libexec/apache22/mod_auth_kerb.so: libgssapi.so.10 => /usr/lib/libgssapi.so.10 (0x281b1000) libheimntlm.so.10 => /usr/lib/libheimntlm.so.10 (0x281ba000) libkrb5.so.10 => /usr/lib/libkrb5.so.10 (0x28300000) libhx509.so.10 => /usr/lib/libhx509.so.10 (0x281bf000) libcom_err.so.5 => /usr/lib/libcom_err.so.5 (0x281f5000) libcrypto.so.6 => /lib/libcrypto.so.6 (0x2835e000) libasn1.so.10 => /usr/lib/libasn1.so.10 (0x284b9000) libroken.so.10 => /usr/lib/libroken.so.10 (0x2852e000) libcrypt.so.5 => /lib/libcrypt.so.5 (0x2853e000) libc.so.7 => /lib/libc.so.7 (0x28090000) # uname -sr FreeBSD 8.1-RELEASE # pkg_info | grep ^ap ap22-mod_auth_kerb-5.4_2 An Apache module for authenticating users with Kerberos v5 apache-2.2.17_1 Version 2.2.x of Apache web server with prefork MPM. apr-nothr-devrandom-gdbm-1.4.2.1.3.10 Apache Portability Library # -- Victor Sudakov, VAS4-RIPE, VAS47-RIPN 2:5005/4...@fidonet http://vas.tomsk.ru/ -- Victor Sudakov, VAS4-RIPE, VAS47-RIPN 2:5005/4...@fidonet http://vas.tomsk.ru/ ________________________________________________ Kerberos mailing list Kerberos@mit.edu https://mailman.mit.edu/mailman/listinfo/kerberos