Configure Apache to use mod_auth_kerb for authentication To password-protect university websites, UITS recommends using the Central Authentication Service (CAS). If for some reason you can't use CAS, and Apache is your web server, mod_auth_kerb is one alternative for authentication.
You can subscribe to this list. If you're allowed in, then it works. If the LDAP check blocks you, then it works fine in Firefox on CentOS and MacOS.
('Works fine' means you get a 401 Authorization Required error.) With Safari 3 on MacOS 10.4.11 it seems to be an infinite loop. Anyone else run into anything like this? Does it work with IE? I suppose I'll need to debug this a bit. Probably need Apple to fix something. *bleah* ------------------------------------------------------------------------ The opinions expressed in this message are mine, not those of Caltech, JPL, NASA, or the US Government. Henry.B.Hotz@., or hbhotz@.
Mounting locations can include underneath seats or in the trunk or cargo area. Mercedes w203 subwoofer install in gmc dealers. We'll show you the size of wires you'll need when you make your purchase, and we can offer tips online and by phone for wiring strategies. You'll need to check the dimensions of the amps you're interested in, which we provide, then measure the available space you have in your vehicle. • Subwoofers Just about all subwoofers need to be mounted in an enclosure, which then fits in an available spot in your car.
The below error was caused by a bad configuration of mod_auth_kerb, not a Heimdal bug. Sorry about the noise. Doesn't explain the problem with mod_spnego, but it's not generic to Heimdal. On Nov 12, 2007, at 6:17 PM, Henry B.
Hotz wrote: > Hmmm. Looks like I just hit something similar with mod_auth_kerb > and Heimdal 1.0.1 on Solaris 9, Apache 2.2. > >> [Mon Nov 12 18:] [info] Initial (No.1) HTTPS request >> received for child 1 (server redhotz.jpl.nasa.gov:443) >> [Mon Nov 12 18:] [debug] src/mod_auth_kerb.c(1572): >> [client 137.78.61.96] kerb_authenticate_user entered with user >> (NULL) and auth_type Kerberos >> [Mon Nov 12 18:] [debug] src/mod_auth_kerb.c(1194): >> [client 137.78.61.96] Acquiring creds for HTTP@. >> [Mon Nov 12 18:] [debug] src/mod_auth_kerb.c(1338): >> [client 137.78.61.96] Verifying client data using KRB5 GSS-API >> [Mon Nov 12 18:] [debug] src/mod_auth_kerb.c(1354): >> [client 137.78.61.96] Verification returned code 1 >> [Mon Nov 12 18:] [debug] src/mod_auth_kerb.c(1372): >> [client 137.78.61.96] GSS-API token of length 22 bytes will be >> sent back >> [Mon Nov 12 18:] [error] [client 137.78.61.96] >> gss_display_name() failed: An invalid name was supplied (unknown >> mech-code 0 for mech unknown) > > Have to look into this some more. > > On Nov 11, 2007, at 10:27 AM, Markus Moeller wrote: > >> Changing mod_spnego so that it returns data to the client when >> continuation >> is required I see the following reply showing heimdals(1.0.1) >> authentication reply (w.g. Authentication is incomplete and the only >> supported mechanism is NTLM). On Nov 15, 2007, at 5:40 AM, Berkes Alexander wrote: > Hello, I am trying to configure apache to do sso (single sign on) > against our Windows kerberos.
> > I installed apache and installed the mod_auth_kerb version from =20 > ubuntu (libapach2-mod-auth-kerb). > > Everything works fine if I try to authenticate as a user without =20 > german-umlauts in the username. There is intent to make everything UTF-8, but that's not yet the =20 case. If you want guaranteed interoperability among Kerberos =20 implementations then you should stick to ASCII. (I think this has =20 nothing to do with Apache, or even mod_auth_kerb.) > When I try to authenticate as a user who das german umlauts in =20 > username I get an error.
> On the linux side i get 'user unknown'. > > When I look at the windows logs I can see that f.e. For the user =20 > M=FCller > the '=FC' just vanishes.
Like I would like to authenticate the user =20= > Mller > > After googling a while and reading a lot of howtos and rfcs I found =20= > out, > that kerberos doesn't like latin1 characters. It only 'understands' > ASCII and UTF-8 so I have to send the latin1 '=FC' utf-8 encoded. > > > I haven't looked at the source of the module itself so I don't =20 > really know if this is a module issue. > I also tried to set apaches default charset to UTF-8 (with the =20 > directive =3D> AddDefaultCharset UTF-8). > > Still not working.
> I then looked at the http headers between server and my browser. > > ----- from server ---------- > HTTP/1.1 401 Authorization Required > Date: Thu, 15 Nov 2007 13:27:35 GMT > Server: Apache > WWW-Authenticate: Negotiate > WWW-Authenticate: Basic realm=3D'Kerberos Login' > Content-Length: 401 > Connection: close > Content-Type: text/html; charset=3Diso-8859-1 > --------------------------------- > > > It is not hard to see, that the server sends in iso-8859-1 encoding =20= > and not in utf-8. > Therefor my browser sends back in latin1 of course and therefor the =20= > umlaut vanishes.
> I don't know if the module is doing the charset=3D thing or if this =20= > is an apache issue. > as I told setting default charset didn't work, therefor I thought =20 > about writing to the mailinglist. > > > best regards. > > > ________________________________ > Alexander Berkes > Service & Mobilisierung > EDV und PDV > > =D6VP Bundespartei > Lichtenfelsgasse 7, 1010 Wien > > Tel.: +43 (1) 40126 512 > Fax: +43 (1) 40126 519 > mailto:Alexander.Berkes@. > ________________________________ > > > > ----------------------------------------------------------------------=20= > --- > This SF.net email is sponsored by: Splunk Inc. > Still grepping through log files to find problems?