<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
color:black;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="FR-CA" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-CA" style="color:#1F497D">If I understand, the build in Kerberos feature is not for System Authentication ?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA" style="color:#1F497D">I had already think about mod_auth_kerb (or Tomcat identical feature), thanks for this help, but it seems like DIY.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA" style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA" style="color:#1F497D">Thanks</span><span lang="EN-CA"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="FR" style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext;mso-fareast-language:FR-CA">De :</span></b><span lang="FR" style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext;mso-fareast-language:FR-CA">
users-bounces@shibboleth.net [mailto:users-bounces@shibboleth.net] <b>De la part de</b> David Mansfield<br>
<b>Envoyé :</b> 3 mars 2015 12:01<br>
<b>À :</b> users@shibboleth.net<br>
<b>Objet :</b> Re: Kerberos Authentication<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt">Hi:<br>
<br>
I think I used apache with mod_auth_kerb, combined with "remote user" authentication.<br>
<br>
First get mod_auth_kerb working by creating some directory on your apache (say /secure) and get it protected. There are lots of docs on the internet.<br>
<br>
Basically: create a keytab on the AD server for HTTP/your.server.name, and export it and put it "somewhere" on your IDP with the right permissions and possibly the right selinux security context. Configure in apache .conf file. Make sure this is working.<br>
<br>
Second, use the RemoteUserAuthnConfiguration, standard. I *think* you need to set tomcatAuthentication=false in your server.xml (assuming you are running the IdP in tomcat) or else it will ignore the passed credential information received from apache over
the ajp link.<br>
<br>
This is all from memory. My test IdP is currently unavalable.<br>
<br>
-- <br>
Thanks,<br>
David Mansfield<br>
Cobite,<br>
<br>
<o:p></o:p></p>
<div>
<p class="MsoNormal">On 03/03/2015 11:14 AM, Arnal, Pascal wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal">Hi,<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-CA">I would like to use my Windows Authentication with Shibboleth IDP V3 AND Shibboleth SP V2.</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-CA">I followed the documentation <a href="https://wiki.shibboleth.net/confluence/display/IDP30/KerberosAuthnConfiguration">
https://wiki.shibboleth.net/confluence/display/IDP30/KerberosAuthnConfiguration</a></span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-CA">When I want to access my application, the login page of the IDP is displayed and after I filled my credentials, my application is accessible.</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-CA">Now I would like to use my Windows Authentication and the Kerberos Token for not fill again my credential.</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-CA"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-CA">Is-it possible, and how please ?</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-CA"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-CA">Thanks</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman","serif";mso-fareast-language:FR-CA"><o:p> </o:p></span></p>
<div class="MsoNormal" align="center" style="text-align:center"><span style="font-size:12.0pt;font-family:"Times New Roman","serif";mso-fareast-language:FR-CA">
<hr size="2" width="100%" align="center">
</span></div>
<p class="MsoNormal"><span style="font-size:7.5pt;font-family:"Arial","sans-serif";color:gray;mso-fareast-language:FR-CA">AVIS: Ce courriel privilégié et confidentiel est destiné à la seule personne ou entité à laquelle il est adressé. Pour toute autre personne,
toute action prise en rapport à ce courriel ainsi que toute lecture, reproduction, transmission et/ou divulgation d'une partie ou de l'ensemble de celui-ci est interdite. Si vous n'êtes pas la personne autorisée à recevoir ce courriel, S.V.P. le retourner
à l'expéditeur et le détruire. Bien que ce courriel ait été traité contre les virus, il est de la responsabilité du destinataire de s'assurer que l'envoi en est exempt. Nos communications avec vous peuvent contenir des renseignements confidentiels ou protégés
par le secret professionnel. Si vous désirez que nous communiquions avec vous par un autre moyen de transmission que le courrier électronique ordinaire non sécurisé, veuillez nous en aviser.<br>
<br>
NOTICE: This privileged and confidential email is intended only for the individual or entity to whom it is addressed. With regard to all others, any action related with this email as well as any reading, reproduction, transmission and/or dissemination in whole
or in part of the information included in this email is prohibited. If you are not the addressee, immediately return the email to sender prior to destroying all copies. Even if this email is believed to be free from any virus, it is the responsibility of the
recipient to make sure that it is virus exempt. Our communications to you may contain confidential information or information protected under solicitor-client privilege. Please advise if you wish us to use a mode of communication other than regular, unsecured
e-mail in our communications with you.<br>
</span><span style="font-size:12.0pt;font-family:"Times New Roman","serif";mso-fareast-language:FR-CA"><br>
<br>
<o:p></o:p></span></p>
</blockquote>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman","serif";mso-fareast-language:FR-CA"><o:p> </o:p></span></p>
</div>
<br>
<hr>
<font face="Arial" color="Gray" size="1">AVIS: Ce courriel privilégié et confidentiel est destiné à la seule personne ou entité à laquelle il est adressé. Pour toute autre personne, toute action prise en rapport à ce courriel ainsi que toute lecture, reproduction,
transmission et/ou divulgation d'une partie ou de l'ensemble de celui-ci est interdite. Si vous n'êtes pas la personne autorisée à recevoir ce courriel, S.V.P. le retourner à l'expéditeur et le détruire. Bien que ce courriel ait été traité contre les virus,
il est de la responsabilité du destinataire de s'assurer que l'envoi en est exempt. Nos communications avec vous peuvent contenir des renseignements confidentiels ou protégés par le secret professionnel. Si vous désirez que nous communiquions avec vous par
un autre moyen de transmission que le courrier électronique ordinaire non sécurisé, veuillez nous en aviser.<br>
<br>
NOTICE: This privileged and confidential email is intended only for the individual or entity to whom it is addressed. With regard to all others, any action related with this email as well as any reading, reproduction, transmission and/or dissemination in whole
or in part of the information included in this email is prohibited. If you are not the addressee, immediately return the email to sender prior to destroying all copies. Even if this email is believed to be free from any virus, it is the responsibility of the
recipient to make sure that it is virus exempt. Our communications to you may contain confidential information or information protected under solicitor-client privilege. Please advise if you wish us to use a mode of communication other than regular, unsecured
e-mail in our communications with you.<br>
</font>
</body>
</html>