<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-GB" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Hi all,<o:p></o:p></p>
<p class="MsoNormal">Apologies for cross posting, I’ve also posted this on the Apache users mailing list, as I think that’s where the problem actually lies, but I thought as this is a Shibboleth setup someone here might be able to help. For reference it’s an
IdP setup using Apache with the Tomcat connector to Shiboleth on port 8009. I’m using the mod_auth_kerb module of httpd and the RemoteUser handler of Shibboleth IdP.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">“I have two Apache 2.2.15 servers running on Redhat 6.7, both of which are using the mod_auth_kerb module to authenticate users. As far as I can see the apache and module config is identical, but I’m seeing different behaviour when a user
enters an invalid username. One will just reprompt for the credentials, the other gives a 403 Forbidden error. This doesn’t happen when the user enters an invalid password with a valid user, in this instance the user gets reprompted for the password.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">My auth_kerb.conf file is identical apart from the keytab filename on both:<o:p></o:p></p>
<p class="MsoNormal"><i>LoadModule auth_kerb_module modules/mod_auth_kerb.so<o:p></o:p></i></p>
<p class="MsoNormal"><i><Location /idp/Authn/RemoteUser><o:p></o:p></i></p>
<p class="MsoNormal"><i>SSLRequireSSL<o:p></o:p></i></p>
<p class="MsoNormal"><i>AuthType Kerberos<o:p></o:p></i></p>
<p class="MsoNormal"><i>AuthName "Shib Kerberos Login"<o:p></o:p></i></p>
<p class="MsoNormal"><i>KrbMethodNegotiate On<o:p></o:p></i></p>
<p class="MsoNormal"><i>KrbMethodK5Passwd On<o:p></o:p></i></p>
<p class="MsoNormal"><i>KrbAuthRealms DOMAIN.AC.UK<o:p></o:p></i></p>
<p class="MsoNormal"><i>Krb5KeyTab /etc/shibdevkerb.keytab<o:p></o:p></i></p>
<p class="MsoNormal"><i>KrbSaveCredentials On<o:p></o:p></i></p>
<p class="MsoNormal"><i>KrbServiceName <a href="mailto:HTTP/server.dev.publicdomain.ac.uk@DOMAIN.AC.UK">
HTTP/server.dev.publicdomain.ac.uk@DOMAIN.AC.UK</a><o:p></o:p></i></p>
<p class="MsoNormal"><i>require valid-user<o:p></o:p></i></p>
<p class="MsoNormal"><i></Location><o:p></o:p></i></p>
<p class="MsoNormal"><i><o:p> </o:p></i></p>
<p class="MsoNormal">I can successfully perform a kinit on both, so Kerberos is working ok as far as I can tell. However I’m not sure why the invalid user would be rejected on one and not the other.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The error log on the failing server shows:<o:p></o:p></p>
<p class="MsoNormal">[Tue Aug 18 11:29:58 2015] [error] [client 192.168.219.233] gss_accept_sec_context() failed: No credentials were supplied, or the credentials were unavailable or inaccessible (, Unknown error), referer:
<a href="https://server.publicdomain.ac.uk/CookieAuth.dll?GetLogon?curl=Z2FidpZ2FAuthnZ2FRemoteUser&reason=0&formdir=2">
https://server.publicdomain.ac.uk/CookieAuth.dll?GetLogon?curl=Z2FidpZ2FAuthnZ2FRemoteUser&reason=0&formdir=2</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">For reference, this server is part of a Shibboleth IdP setup, published to the internet using MS Forefront TMG. Once authentication has happened, the Apache server passes onto a Tomcat server for the Shibboleth functions to run using the
RemoteUser handler.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Can somebody please point out just where I might be able to find the thing that is different between these servers in order to resolve this?”<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Cheers,<o:p></o:p></p>
<p class="MsoNormal">Andi<o:p></o:p></p>
</div>
<hr>
<br>
<a href="http://www.cardiffmet.ac.uk/cardiffmet150" target="_blank"><img src="http://campaigns.cardiffmet.ac.uk/150/email-footer.gif" alt="Cardiff Metropolitan University - 150 years of nurturing talent" width="398" height="108" border="0"></a>
</body>
</html>