<p>can anybody recommend some really good resources for how to get Apache authenticating users with Kerberos.</p>

<p>Background reading on Kerberos would also be useful </p>

<p>Thanks</p>

<p>Peter</p>

[{'answer_id': 43600, 'author': 'Joseph Daigle', 'author_id': 507, 'author_profile': 'https://Stackoverflow.com/users/507', 'pm_score': 3, 'selected': True, 'text': '<p>mod_auth_kerb is a good start: <a href="http://modauthkerb.sourceforge.net/" rel="nofollow noreferrer">http://modauthkerb.sourceforge.net/</a>. If you need Active Directory support, look here: <a href="http://support.microsoft.com/?id=555092" rel="nofollow noreferrer">http://support.microsoft.com/?id=555092</a>.</p>\n'}, {'answer_id': 1613191, 'author': 'schlenk', 'author_id': 60725, 'author_profile': 'https://Stackoverflow.com/users/60725', 'pm_score': 1, 'selected': False, 'text': '<p>I found mod_auth_spnego also quite okay, as it can use SSPI on windows instead of requiring MIT Kerberos. <a href="http://sourceforge.net/projects/modgssapache/" rel="nofollow noreferrer">mod_spnego</a></p>\n'}, {'answer_id': 1853525, 'author': 's00th', 'author_id': 224478, 'author_profile': 'https://Stackoverflow.com/users/224478', 'pm_score': 1, 'selected': False, 'text': '<p>Here\'s an example using Active Directory as the KDC:\n<a href="http://oslabs.mikro-net.com/krb_apache.html" rel="nofollow noreferrer">http://oslabs.mikro-net.com/krb_apache.html</a></p>\n'}, {'answer_id': 18693599, 'author': 'Tomas Tomecek', 'author_id': 909579, 'author_profile': 'https://Stackoverflow.com/users/909579', 'pm_score': 1, 'selected': False, 'text': '<p>I liked this article about configuring apache to use Kerberos:</p>\n\n<p><a href="http://www.roguelynn.com/words/apache-kerberos-for-django/" rel="nofollow">http://www.roguelynn.com/words/apache-kerberos-for-django/</a></p>\n\n<p>(you may skip parts about django if you are not interested)</p>\n\n<p>EDIT:</p>\n\n<p><strong>Fullblown answer</strong></p>\n\n<p>It is pretty easy to configure apache to use Kerberos authentication.</p>\n\n<p>I am assuming you have correctly configured Kerberos on your machine.</p>\n\n<p>1) Your webserver has to have keytab [1].</p>\n\n<p>Bottom line, your webserver <em>has</em> to be able to read the keytab!</p>\n\n<p>2) You have to have proper httpd module for authentication -- <code>mod_auth_kerb</code>:</p>\n\n<pre><code>LoadModule auth_kerb_module modules/mod_auth_kerb.so\n</code></pre>\n\n<p>3) Then you have to tell apache about Kerberos:</p>\n\n<pre><code>&lt;Location /&gt; \n    AuthName "Kerberos Authentication -- this will be showed to users via BasicAuth"\n    AuthType Kerberos\n    KrbMethodNegotiate On\n    KrbMethodK5Passwd Off\n    # this is the principal from your keytab (you may lose the FQDN part)\n    KrbServiceName HTTP/$FQDN\n    KrbAuthRealms KERBEROS_DOMAIN\n    Krb5KeyTab /path/to/http.keytab\n    Require valid-user\n\n    Order Deny,Allow\n    Deny from all\n&lt;/Location&gt;\n</code></pre>\n\n<p>Then apache will pass the user to your app via <code>REMOTE_USER</code> HTTP header.</p>\n\n<p>And that\'s it.</p>\n\n<p>I also advice you to turn on debugging logging in apache during setup. Be sure that you have correct time and httpd can read keytab, that\'s all.</p>\n\n<p>[1] <a href="http://kb.iu.edu/data/aumh.html" rel="nofollow">http://kb.iu.edu/data/aumh.html</a></p>\n\n<p>[2] Main resource: <a href="http://www.roguelynn.com/words/apache-kerberos-for-django/" rel="nofollow">http://www.roguelynn.com/words/apache-kerberos-for-django/</a></p>\n'}]
['https://Stackoverflow.com/questions/43459', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/3720/']