AW: Kerberos SSO with fail over to login auth

[Ristow Rodrigo]

Hi Aaron,

We have this scenario implemented in our organization (Shibboleth authentication trough the Kerberos/Active Directory credentials).
To understand exactly what happens when the ticket-request negotiation fails (no kerberos tickets, browser misconfigured, etc.), you need to take a look in the SPNEGO documentation:  http://www.ietf.org/rfc/rfc4559.txt
 
This is the pitfall using Kerberos, because each browser can take different steps after receiving the "401 Unauthorized" response (part of the negotiation). For example:
  - Internet explorer will automatically "downgrade" to NTLM and ask for username/password in a popup;
  - Firefox will show the "401 error page" (which can be customized, take a look at "customUnauthorized" in the kerberos-Idp documentation)

In our case, we just avoid this situation. We verify first if the user has the kerberos-ticket with some heuristic (you can use maybe the ip-range) and then we show or hide the kerberos-authentication part in the login screen.

Please let me know if you have any other solution or idea for this problem, this is also interesting for other people.

Rodrigo


----Ursprüngliche Nachricht-----
Von: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] Im Auftrag von Aaron Roots
Gesendet: Donnerstag, 27. Oktober 2011 06:48
An: Shib Users
Betreff: Re: Kerberos SSO with fail over to login auth

Thanks for the response Nick.

One of the business requirements for our Single Sign On project: The successful authentication of logging into the SOE OS needs to mean that you are automatically authenticated to protected web pages and are not prompted to authenticate again.

So unless I can make the Shibboleth IdP the login screen for Windows I need to use another method
- Kerberos is available and is possible:
https://wiki.shibboleth.net/confluence/display/SHIB2/Kerberos+Login+Handler
- but I also need to rework the out of the box solution to truly achieve what we need as our business requirements.


Cheers
Aaron



On 27/10/11 3:27 PM, "Nick Duan" <nduan at verizon.net> wrote:

>Shouldn't Shibboleth be the "Internet replacement" of Kerberos?  Why do 
>you want to make these two play together? Each serves different purpose 
>in different environment.  What would be the use case for integrating 
>Kerberos with Shibboleth?
>
>Thanks!
>
>ND
>
>
>-----Original Message-----
>From: users-bounces at shibboleth.net 
>[mailto:users-bounces at shibboleth.net]
>On
>Behalf Of Aaron Roots
>Sent: Wednesday, October 26, 2011 6:17 PM
>To: Shib Users
>Subject: Kerberos SSO with fail over to login auth
>
>Hi all,
>
>Just looking if anyone has successfully setup Kerberos Auth to the 
>Shibboleth IdP that occurs automatically - but if there is no ticket or 
>the ticket is not valid then it fails back to the login web page.
>
>I am just about to start looking into achieving this - from the 
>preliminary reading I have done so far I have seen the following:
>* Fully Kerberos with no fail over as all users are using an SOE
>* Choice of login type on the login web page
>* Using Apache - but fails over to a basic auth box instead of a login 
>screen
>* Wanting the above scenario - but not having achieved it yet
>
>I am hoping somebody may have had some success that I haven't come 
>across yet and have any advice they could share. If not that's all good 
>- just means I'll probably be very busy for a few weeks :)
>
>Cheers heaps,
>Aaron
>
>--
>To unsubscribe from this list send an email to 
>users-unsubscribe at shibboleth.net
>
>--
>To unsubscribe from this list send an email to 
>users-unsubscribe at shibboleth.net

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net