Kerberos Authentication

Tue Mar 3 12:32:01 EST 2015

It is DIY to a degree. There isn't an automatic 'magically work with kerberos' setting in the IdP, I read there will be in a future release though.

_________________________________________________
Dave Perry
eLearning Technologist, Hull College Group

Room L34 - Queens Gardens Library
Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG
Extension 2230 / Direct Dial 01482 381930

* Need a fast reply? Try elearning at hull-college.ac.uk<mailto:elearning at hull-college.ac.uk> *

Rate our service with the Library & eLearning Survey
For Students: http://library.hull-college.ac.uk/survey
For Staff: http://library.hull-college.ac.uk/staffsurvey

From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Arnal, Pascal
Sent: 03 March 2015 17:31
To: Shib Users
Subject: RE: Kerberos Authentication

If I understand, the build in Kerberos feature is not for System Authentication ?
I had already think about mod_auth_kerb (or Tomcat identical feature), thanks for this help, but it seems like DIY.

Thanks

De : users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net> [mailto:users-bounces at shibboleth.net] De la part de David Mansfield
Envoyé : 3 mars 2015 12:01
À : users at shibboleth.net<mailto:users at shibboleth.net>
Objet : Re: Kerberos Authentication

Hi:

I think I used apache with mod_auth_kerb, combined with "remote user" authentication.

First get mod_auth_kerb working by creating some directory on your apache (say /secure) and get it protected.  There are lots of docs on the internet.

Basically: create a keytab on the AD server for HTTP/your.server.name, and export it and put it "somewhere" on your IDP with the right permissions and possibly the right selinux security context.  Configure in apache .conf file. Make sure this is working.

Second, use the RemoteUserAuthnConfiguration, standard.  I *think* you need to set tomcatAuthentication=false in your server.xml (assuming you are running the IdP in tomcat) or else it will ignore the passed credential information received from apache over the ajp link.

This is all from memory.  My test IdP is currently unavalable.

--
Thanks,
David Mansfield
Cobite,
On 03/03/2015 11:14 AM, Arnal, Pascal wrote:
Hi,

I would like to use my Windows Authentication with Shibboleth IDP V3 AND Shibboleth SP V2.
I followed the documentation https://wiki.shibboleth.net/confluence/display/IDP30/KerberosAuthnConfiguration
When I want to access my application, the login page of the IDP is displayed and after I filled my credentials, my application is accessible.
Now I would like to use my Windows Authentication and the Kerberos Token for not fill again my credential.

Is-it possible, and how please ?

Thanks

________________________________
AVIS: Ce courriel privilégié et confidentiel est destiné à la seule personne ou entité à laquelle il est adressé. Pour toute autre personne, toute action prise en rapport à ce courriel ainsi que toute lecture, reproduction, transmission et/ou divulgation d'une partie ou de l'ensemble de celui-ci est interdite. Si vous n'êtes pas la personne autorisée à recevoir ce courriel, S.V.P. le retourner à l'expéditeur et le détruire. Bien que ce courriel ait été traité contre les virus, il est de la responsabilité du destinataire de s'assurer que l'envoi en est exempt. Nos communications avec vous peuvent contenir des renseignements confidentiels ou protégés par le secret professionnel. Si vous désirez que nous communiquions avec vous par un autre moyen de transmission que le courrier électronique ordinaire non sécurisé, veuillez nous en aviser.

NOTICE: This privileged and confidential email is intended only for the individual or entity to whom it is addressed. With regard to all others, any action related with this email as well as any reading, reproduction, transmission and/or dissemination in whole or in part of the information included in this email is prohibited. If you are not the addressee, immediately return the email to sender prior to destroying all copies. Even if this email is believed to be free from any virus, it is the responsibility of the recipient to make sure that it is virus exempt. Our communications to you may contain confidential information or information protected under solicitor-client privilege. Please advise if you wish us to use a mode of communication other than regular, unsecured e-mail in our communications with you.

________________________________
AVIS: Ce courriel privilégié et confidentiel est destiné à la seule personne ou entité à laquelle il est adressé. Pour toute autre personne, toute action prise en rapport à ce courriel ainsi que toute lecture, reproduction, transmission et/ou divulgation d'une partie ou de l'ensemble de celui-ci est interdite. Si vous n'êtes pas la personne autorisée à recevoir ce courriel, S.V.P. le retourner à l'expéditeur et le détruire. Bien que ce courriel ait été traité contre les virus, il est de la responsabilité du destinataire de s'assurer que l'envoi en est exempt. Nos communications avec vous peuvent contenir des renseignements confidentiels ou protégés par le secret professionnel. Si vous désirez que nous communiquions avec vous par un autre moyen de transmission que le courrier électronique ordinaire non sécurisé, veuillez nous en aviser.

NOTICE: This privileged and confidential email is intended only for the individual or entity to whom it is addressed. With regard to all others, any action related with this email as well as any reading, reproduction, transmission and/or dissemination in whole or in part of the information included in this email is prohibited. If you are not the addressee, immediately return the email to sender prior to destroying all copies. Even if this email is believed to be free from any virus, it is the responsibility of the recipient to make sure that it is virus exempt. Our communications to you may contain confidential information or information protected under solicitor-client privilege. Please advise if you wish us to use a mode of communication other than regular, unsecured e-mail in our communications with you.

**********************************************************************
This message is sent in confidence for the addressee
only. It may  contain confidential or sensitive
information.  The contents are not to be disclosed
to anyone other than the addressee.  Unauthorised
recipients are requested to preserve this
confidentiality and to advise us of any errors in
transmission.  Any views expressed in this message
are solely the views of the individual and do not
represent the views of the College.  Nothing in this
message should be construed as creating a contract.

Hull College owns the email infrastructure, including the contents.

Hull College is committed to sustainability, please reflect before printing this email.
**********************************************************************

TEXT
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150303/858dcd1d/attachment.html 