Re: Seamless/transparent SSO with Apache, Win2003, IE

2005-11-15 Thread Nikola Milutinovic
[EMAIL PROTECTED] wrote: Fred Dennis wrote: I'm trying to create a seamless sign on to a web site using Solaris (Kerberos installed), Apache (mod_auth_kerb installed), MS Active directory, and IE client. I was doing some Google searches the other day for a similar project and found

Re: Kerberos and IE Single Sign-on

2005-08-03 Thread Nikola Milutinovic
Luciano Bolonheis wrote: Hi, i'm trying to make a Single sign-on environment... and I have all the possible problems... using the mod_auth_kerb with apache in internet explorer, it authenticate but asks for the password. I get a ticket with the Kfw Leash32 application, and even with valid

Re: Active Directory -- Java web app

2005-08-01 Thread Nikola Milutinovic
Richard Gundersen wrote: Hi I have written a Java web application which has a basic password login screen. This works fine, but I would now like to allow users into my system if they have previously authenticated against Active Directory. I.E. if they can provide a valid kerberos ticket,

Re: Active Directory -- Java web app

2005-08-01 Thread Nikola Milutinovic
Richard Gundersen wrote: Hi I have written a Java web application which has a basic password login screen. This works fine, but I would now like to allow users into my system if they have previously authenticated against Active Directory. I.E. if they can provide a valid kerberos ticket,

Re: Active Directory -- Java web app

2005-08-01 Thread Nikola Milutinovic
Richard Gundersen wrote: Hi Nikola Thanks for your quick and detailed reply. While it would be great if Tomcat could interpret SPNEGO, I don't mind setting up Apache to sit in front of Tomcat (in fact I was going to do this anyway for speeding up the static content). Most people advocate

Re: Kerberos ticket access to MS Exchange

2005-07-31 Thread Nikola Milutinovic
Rodney M Dyer wrote: At 12:41 PM 7/29/2005, Nebergall, Christopher wrote: Are there ANY mail client programs besides MS Outlook on any OS which support kerberos ticket authentication to Microsoft exchange? How about IMAP kerberized client in general? I'm using Cyrus IMAP 2.2.10 on Tru64

Re: Kerberos Authentication via Apache

2005-01-11 Thread Nikola Milutinovic
Luis Daniel Lucio Quiroz wrote: MOD_KRB5 or whatever you are using just auth agains krb db without ticket support. Read documentation. Instead of that you could use mod_auth_ntlm, it works in a single-sign-on mode. mod_auth_krb5 can use BOTH clinet (accept HTTP-Auth BASIC and run like a

Re: Is Kerberos a good solution for web-single signon

2004-03-13 Thread Nikola Milutinovic
Christopher Kranz wrote: [EMAIL PROTECTED] (paul b) wrote in message news:[EMAIL PROTECTED]... Hello, I am currently developping a web single signon-system and I am thinking about using Kerberos for this propose [snip] Perhaps someone can tell me if Kerberos is really a good solution

Re: Thread-safe libraries

2004-02-24 Thread Nikola Milutinovic
Sam Hartman wrote: Lukas == Lukas Kubin [EMAIL PROTECTED] writes: Lukas Is there any progress in the ability of Kerberos libraries Lukas on Linux to be used by threads-enabled applications? I'm Lukas still having troubles using sasl kerberos authentication to Lukas ldap server

Re: Does kadmind work on a multi-realm KDC?

2003-09-04 Thread Nikola Milutinovic
We've had experience supporting multi realms on a single server. Here is what you want to do: 1.) Start one instance of kadmind for each realm that you want to administrate. Use the -r switch on the commandline to specify the realm that will be managed, ie: kadmind -r

MIT Kerberos: is it Thread-Safe?

2003-07-21 Thread Nikola Milutinovic
Hi all. As the subject says, is MIT Kerberos thread-safe and if it is, which version? OpenLDAP FAQ warns that MIT Kerberos libraries are not thread safe and that one should either use --no-threads when building it or build with Heimdal implementation. Now, I have gotten quite used to MIT

Multiple realms

2003-07-10 Thread Nikola Milutinovic
Am I reading the docs correctly? The man page of krb5kdc states that there can be only one realm per TCP/UDP port. Am I reading it right? Nix. Kerberos mailing list [EMAIL PROTECTED] https://mailman.mit.edu/mailman/listinfo/kerberos

Re: HP-UX Secure Shell and Kerberos 5

2002-09-18 Thread Nikola Milutinovic
Marc wrote: Hello, I am currently making a HP-UX 11i authenticate itself to a Windows 2000 KDC using HP-UX Secure Shell which is the following version (output from swlist): Sorry for being slightly off the topic, but your e-mail doesn't work. Could someone give me pointers to docs