% Options for packages loaded elsewhere
\PassOptionsToPackage{unicode}{hyperref}
\PassOptionsToPackage{hyphens}{url}
%
\documentclass[
]{article}
\usepackage{amsmath,amssymb}
\usepackage{iftex}
\ifPDFTeX
  \usepackage[T1]{fontenc}
  \usepackage[utf8]{inputenc}
  \usepackage{textcomp} % provide euro and other symbols
\else % if luatex or xetex
  \usepackage{unicode-math} % this also loads fontspec
  \defaultfontfeatures{Scale=MatchLowercase}
  \defaultfontfeatures[\rmfamily]{Ligatures=TeX,Scale=1}
\fi
\usepackage{lmodern}
\ifPDFTeX\else
  % xetex/luatex font selection
\fi
% Use upquote if available, for straight quotes in verbatim environments
\IfFileExists{upquote.sty}{\usepackage{upquote}}{}
\IfFileExists{microtype.sty}{% use microtype if available
  \usepackage[]{microtype}
  \UseMicrotypeSet[protrusion]{basicmath} % disable protrusion for tt fonts
}{}
\makeatletter
\@ifundefined{KOMAClassName}{% if non-KOMA class
  \IfFileExists{parskip.sty}{%
    \usepackage{parskip}
  }{% else
    \setlength{\parindent}{0pt}
    \setlength{\parskip}{6pt plus 2pt minus 1pt}}
}{% if KOMA class
  \KOMAoptions{parskip=half}}
\makeatother
\usepackage{xcolor}
\setlength{\emergencystretch}{3em} % prevent overfull lines
\providecommand{\tightlist}{%
  \setlength{\itemsep}{0pt}\setlength{\parskip}{0pt}}
\setcounter{secnumdepth}{-\maxdimen} % remove section numbering
\ifLuaTeX
  \usepackage{selnolig}  % disable illegal ligatures
\fi
\IfFileExists{bookmark.sty}{\usepackage{bookmark}}{\usepackage{hyperref}}
\IfFileExists{xurl.sty}{\usepackage{xurl}}{} % add URL line breaks if available
\urlstyle{same}
\hypersetup{
  pdftitle={kerberos-and-apache2-single-sign-on},
  hidelinks,
  pdfcreator={LaTeX via pandoc}}

\title{kerberos-and-apache2-single-sign-on}
\author{}
\date{}

\begin{document}
\maketitle

\hypertarget{kerberos-and-apache2-single-sign-on}{%
\section{kerberos-and-apache2-single-sign-on}\label{kerberos-and-apache2-single-sign-on}}

Kerberos and Apache2 Single-Sign-on
\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#

\textbf{Record of steps taken when building testweb.foxhop.net}

.. contents::

\hypertarget{prepare-service-ad-account-and-keytab}{%
\section{Prepare Service AD account and
keytab}\label{prepare-service-ad-account-and-keytab}}

Windows Domain admin required.

\begin{enumerate}
\tightlist
\item
  configure the testservice AD user account
\item
  configure the testservice AD user password to sup3rs3cur3
\item
  generate a keytab file
\end{enumerate}

.. code-block:: txt

\# run on srv0103 ktpass -out c:\temp\testweb.foxhop.net.keytab \^{}
-princ HTTP/testweb.foxhop.net@AD.FOXHOP.NET \^{} -mapUser
testservice@AD.FOXHOP.NET -mapOp set -pass sup3rs3cur3 \^{} -crypto
RC4-HMAC-NT -pType KRB5\_NT\_PRINCIPAL

Copy keytab to /tmp on linux webserver.

\hypertarget{configure-kerberos}{%
\section{Configure Kerberos}\label{configure-kerberos}}

vim /etc/krb5.conf

.. code-block:: ini

{[}logging{]} default = FILE:/var/log/krb5libs.log kdc =
FILE:/var/log/krb5kdc.log admin\_server = FILE:/var/log/kadmind.log

{[}libdefaults{]} default\_realm = AD.FOXHOP.NET dns\_lookup\_realm =
true dns\_lookup\_kdc = true ticket\_lifetime = 24h forwardable = yes

{[}realms{]} AD.FOXHOP.NET = \{ kdc = DS1.AD.FOXHOP.NET kdc =
DS2.AD.FOXHOP.NET admin\_server = DS1.AD.FOXHOP.NET default\_domain =
AD.FOXHOP.NET \}

{[}domain\_realm{]} .ad.foxhop.net = AD.FOXHOP.NET ad.foxhop.net =
AD.FOXHOP.NET

{[}appdefaults{]} pam = \{ debug = false ticket\_lifetime = 36000
renew\_lifetime = 36000 forwardable = true krb4\_convert = false \}

\hypertarget{test-kerberos}{%
\section{Test Kerberos}\label{test-kerberos}}

Get a ticket and authenticate your user

.. code-block:: cli

kinit foxhop-test@AD.FOXHOP.NET

Password for foxhop@AD.FOXHOP.NET:

View the ticket

.. code-block:: cli

klist

Valid starting Expires Service principal 08/01/12 11:07:22 08/01/12
21:07:27 krbtgt/AD.FOXHOP.NET@AD.FOXHOP.NET renew until 08/02/12
11:07:22

Delete or destroy all tickets

.. code-block:: cli

kdestroy klist

Successfully configured kerberos

\hypertarget{configure-apache}{%
\section{Configure Apache}\label{configure-apache}}

Copy keytab and adjust perms

.. code-block:: bash

cd /etc/httpd cp /tmp/testweb.foxhop.net.keytab . chown root:apache
testweb.foxhop.net.keytab chmod 640 testweb.foxhop.net.keytab

Test keytab

.. code-block:: bash

\# you should see a ticket kinit -k -t
/etc/httpd/testweb.foxhop.net.keytab HTTP/testweb.foxhop.net klist

Install custom mod\_auth\_kerb RPM

.. code-block:: bash

rpm -Uvh /usr/local/src/mod\_auth\_kerb-5.4-0.x86\_64.rpm

Configure Apache2 VirtualHost

vi /etc/httpd/conf.d/000-testweb.foxhop.net.conf

.. code-block:: apache

\#\ldots{}

\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\# \# Kerberos \#
\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#

\begin{verbatim}
KrbServiceName HTTP
KrbAuthRealms AD.FOXHOP.NET
Krb5Keytab /etc/httpd/testweb.foxhop.net.keytab
KrbMethodNegotiate on
KrbMethodK5Passwd on
KrbSaveCredentials on
# KrbLocalUserMapping removes @REALM | NA in RHEL5 
# Compiled custom RPM: /usr/local/src/mod_auth_kerb-5.4-0.x86_64.rpm
KrbLocalUserMapping on
\end{verbatim}

\#\ldots{}

\end{document}
