Re: Kerberos and Apache reverse proxy

2018-07-14 Thread Dmitri Pal
On Sat, Jul 14, 2018 at 6:51 AM, Jochen Hein wrote: > Dmitri Pal writes: > > > Some hints on how to deal with proxy if you want Kerberos to work can be > > found here. > > https://ssimo.org/blog/id_019.html > > I am not sure whether they are applicable to your situation or not. > > Thanks for th

Re: Kerberos and Apache reverse proxy

2018-07-14 Thread Jochen Hein
Dmitri Pal writes: > Some hints on how to deal with proxy if you want Kerberos to work can be > found here. > https://ssimo.org/blog/id_019.html > I am not sure whether they are applicable to your situation or not. Thanks for the hint. > What you can do is try KDC proxy instead of the reverse p

Re: Kerberos and Apache reverse proxy

2018-07-13 Thread Dmitri Pal
I am sorry I missed the proxy aspect in you original mail. But proxy with Kerberos in general is not a simple thing to do and should be avoided. Some hints on how to deal with proxy if you want Kerberos to work can be found here. https://ssimo.org/blog/id_019.html I am not sure whether they are ap

Re: Kerberos and Apache reverse proxy

2018-07-13 Thread Dmitri Pal
Hello, You can use an older package called mod_auth_kerb. It is not recommended as mod_auth_gssapi much better but if you distro does not have it you might not have a choice. Thanks Dmitri On Fri, Jul 13, 2018 at 8:25 PM, Jaap Winius wrote: > > Quoting Dmitri Pal : > > It should not. The Kerbe

Re: Kerberos and Apache reverse proxy

2018-07-13 Thread Jaap Winius
Quoting Dmitri Pal : > You can use an older package called mod_auth_kerb. > It is not recommended as mod_auth_gssapi much better but if you distro does > not have it you might not have a choice. Sorry, but I neglected to say that I already had libapache2-mod-auth-kerb installed on both server

Re: Kerberos and Apache reverse proxy

2018-07-13 Thread Jaap Winius
Quoting Dmitri Pal : > It should not. The Kerberos authenticated users should just map to existing > users. > See mod_auth_gssapi for more details. > https://github.com/modauthgssapi/mod_auth_gssapi/blob/master/README It's great to hear that a solution like this exists, but as my luck would h