Reg: Kerberos login for Multiple UPN's

[Henry B. Hotz]

You can get multiple keytab files from all the different domains and merge them on the Unix box.  Using MIT ktutil the sequence of commands would be something like:

ktutil
rkt <domain 1 keytab>
rkt <domain 2 keytab>
…
wkt merged.keytab
q

If the only hangup is getting a single keytab file, that will do it.  If you need to use mod_auth_kerb, then:

Then in your mod_auth_kerb configuration make sure you have:
KrbServiceName Any
KrbAuthRealms  DOMAIN1.COM DOMAIN2.COM etc...

That will allow mod_auth_kerb to accept service tickets (first item), and user identities (second item) from multiple Kerberos realms/Windows domains.

I think this requires you to go with what Newcastle has done rather than SWITCH's Kerberos login handler, though.  You may also want to look at auth_to_local configuration in /etc/krb5.conf with the "KrbLocalUserMapping on" mod_auth_kerb directive.

On Mar 15, 2013, at 1:40 PM, Prasanna <PVBalachandar at imperosoftware.com> wrote:

> Hello All,
> 
> I am now aware that Kerberos login handler for Shibboleth does not work for
> multiple UPN's because I could not create keytab for multiple UPN's since
> keytab has already been created for the primary UPN.
> 
> But can you guys suggest me any alternative ways to work on kerberos for
> multiple UPN's. 
> 
> Authentication works without creating a keytab for multiple UPN, but there
> is no attribute flow. 
> 
> Please do help me in finding some ways to work on multiple UPN's. I have
> even emailed MIT kerberos regarding this issue. If we cannot do this, is
> there anything like web authentication or NTLM pass through.
> 
> Thanks
> Prasanna
> 
> 
> 
> -----
> Prasanna V B
> --
> View this message in context: http://shibboleth.1660669.n2.nabble.com/Reg-Kerberos-login-for-Multiple-UPN-s-tp7585425.html
> Sent from the Shibboleth - Users mailing list archive at Nabble.com.
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
Henry.B.Hotz at jpl.nasa.gov, or hbhotz at oxy.edu