Silently try more then one login handler with UnsolicitedSSO

[Henry B. Hotz]

Without looking in detail, I *thought* the kerberos login stuff leveraged mod_jk, and the mod_auth_kerb stuff.  And I *thought* that it should be possible to use client certs via mod_ssl's +FakeBasicAuth option as an alternative.

Not true, I gather.  Since I, too, want to accept client cert's as an alternative to Kerberos tickets, should I assume the Kerberos login handler is *not* the way to go.  (Yes, that is a question.)

I agree the normal login page is more informative than the usual basic-auth prompt.  I could live with either, if passwords are an acceptable alternative.

So, where should I map X.509 DNs and Kerberos principals to usernames, and how do I create an attribute which says how the original authentication was done?

On Apr 25, 2013, at 8:18 AM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

> On 4/25/13 11:13 AM, "Douglas E. Engert" <deengert at anl.gov> wrote:
> 
>> Now the issue is how to get the Kerberos Login Handler to
>> silently try SPNEGO, and if it fails, fall back to our normal
>> login page.
> 
> I don't know anything of how SPNEGO works, but perhaps one could implement
> the SPNEGO via Apache and mod_auth_kerb, and have a custom login handler
> that looked for REMOTE_USER and if not set operated like the existing
> UserPass handler.
> 
> I have been led to think that SPNEGO in general has no effective error
> handling behavior and that if it doesn't work for everything it basically
> becomes a problem, but if not, the above might work.

mod_auth_kerb will fall back to a basic auth prompt if SPNEGO/GSSAPI fails (and it's configured).  It also logs some useful information.  I've never heard of anyone doing anything fancy/useful with the error pages sent back to the user though.

> -- Scott

------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
Henry.B.Hotz at jpl.nasa.gov, or hbhotz at oxy.edu