Replies: 3 comments 7 replies
-
|
Managed the find the page that hinted at this being possible using mod_auth_kerb: |
Beta Was this translation helpful? Give feedback.
-
|
Really looking for some pointers, I have it working perfectly for Negotiate Kerberos but basic login only works perfectly in Mozzilla Firefox, both Google Chrome and Microsoft Edge don't honour the redirect to the dummy /login-basic URL that attempts to switch auth to only offering Basic via the static user file. RewriteEngine also doesn't work with ProxyPass so I split the virtual servers instead: Debugging on Debian 11.3 (bullseye): When the initial GET arrives it falls through to GSSAPI, which works perfectly with Negotiate Kerberos on a domain joined workstation via either Chrome, Edge or Firefox as a standard session in the user's logged in profile: When testing via private/incognito windows, to use basic authentication against the static user file, it only works in Firefox: Neither Edge nor Chrome honour the 401 redirect to the '/login-basic' dummy URL which initiates Basic authentication. All 3 browsers ask for credentials which are entered in the section marked with XXX. They don't send the next connection to '/login-basic' so they don't receive the basic auth offer. Chrome - incognito mode: Microsoft Edge - InPrivate window: |
Beta Was this translation helpful? Give feedback.
-
|
The problem is that GSSAPI has no real state. We could try by setting a cookie or something, and not repeat the 401 if the browser asks again, but are these browsers actually going to come back and ask again preserving cookies? |
Beta Was this translation helpful? Give feedback.
-
|
Ie are they trying again 3 times, or was that you explicitly hitting reload on the browser? |
Beta Was this translation helpful? Give feedback.
-
|
Thank you for your time on this, the examples I provided above was me entering the credentials only once, when prompted via popup, where depicted with XXX. Both Edge and Chrome try another two times after being fed the credentials and then display their own error message for the 401 response. The configuration displayed in message #268 (comment) (the 2nd version above) essentially works perfectly on the following browsers. In that I can navigate to '/', the browser receives the Negotiate auth request, I enter credentials in the popup and it then honours the 401 redirect to /login-basic, in that it sends a request to /login-basic and upon receiving the basic auth 401 then automatically submits the credentials entered earlier; after which the browser is then redirected back to '/' and the site loads. This as such is the behaviour I was hoping to achieve, it works perfectly in the following scenarios:
With Chrome and Edge on Windows, either in normal mode on a non-domain joined workstation or running an incognito or private window on a domain joined workstation, it appears to latch on to the presented Negotiate challenge and entered credentials keep failing as it doesn't redirect to trying the credentials on the /login-basic redirect URL. What I however now discovered is that I can hit cancel on the first credentials popup and it does then actually does redirect to /login-basic at which point an identically looking credential popup appears and everything works as with the other browsers (using basic auth). My presumption is that Chromium was hardened to prevent a Negotiate to Basic auth downgrade attack. The following discussion in 2013/2014 had some insight in to Chrome apparently being stricter with the process than other browsers. Facebook and some others for example issue a 302 redirect when authentication fails to redirect the browser to a page that handles authentication:
My current understanding is that Apache 2.4 does allow chaining authentication providers but we essentially need GSSAPI to have an option to change its behaviour, possible something along the lines of 'GssapiAuthoritative Off', where it then:
PS: I'm really not a developer and unfortunately have no meaningful way to understand or contribute to the code. |
Beta Was this translation helpful? Give feedback.
-
|
By the way, I did try GssapiNegotiateOnce On but I'm not sure if this is a bug or Chromium based browsers refusing to let go of Negotiate when they have the ability to identify the presented Negotiate challenge. |
Beta Was this translation helpful? Give feedback.
-
|
Apologies, I miss read your last post. I think that behaviour would be perfect. I'll create the feature enhancement request, many thanks! |
Beta Was this translation helpful? Give feedback.
-
|
In summary, the above essentially works as intended in that SSO negotiates Kerberos successfully on Chrome, Edge and Firefox. Basic auth against a static 3rd party user file also works perfectly when I point browsers directly at the https://site1.company.com/login-basic URL. The only thing that isn't working is getting Chrome or Edge to honour the redirect to /login-basic when GSSAPI fails to negotiate Kerberos. I presume this to be a security feature in Chrome and Edge, looking for anyone with experience on how to change the ErrorDocument 401 line to get those browsers to redirect to the correct login URL. |
Beta Was this translation helpful? Give feedback.
-
I presume I'm essentially looking or a method for GSSAPI to include Basic in the list of offers but then passing control over to AuthType Basic? I believe mod_auth_kerb does this via the
KrbAuthoritative Offfeature?This is what I've pieced together so far, it currently works perfectly via Negotiate Kerberos providing staff a SSO experience in Edge, Chrome and Firefox (requires
about:confignetwork.negotiate-auth.trusted-uristo include the URL without a trailing /). Samplenetwork.negotiate-auth.trusted-urisentry:https://site1.company.com,https://site2.company.comMobile devices do not show a password popup, but a Chrome incognito window does and works if I enter an AD account as user@realm. Edge's InPrivate window lets me either login with my AD credentials or a certificate (YubiCo PIV mode). Only Firefox doesn't work at all when launched as a private window. I presume these are using my workstation's ability to interact with KDCs.
PS: Is there a way to prevent users typing in credentials via GSSAPI, we wish to go completely passwordless...
Apache config file:
PS: If I remove the If/Else logic and move the
AuthType Basicsection below theAuthType GSSAPIsection it works in reverse. In that I can then successfully use Basic auth against the static user file but GSSAPI isn't available anywhere else.Have also fiddled with the
GssapiBasicAuth(then I have GSSAPI and AD BasicAuth working but no ability to use Kerberos for staff and a static file for external 3rd parties), can't perceive a difference withGssapiNegotiateOnce.The
BrowserMatchline initially appeared to kill any logins of any kind (Kerberos included), except for Chrome where I had relatively recently authenticated viaBasicAuth. It's almost as if enabling theBrowserMatchoptions gets Apache to use theAuthType Basichandler without prompting the user to authenticate.Beta Was this translation helpful? Give feedback.
All reactions