REMOTE_USER variable empty with Apache and PHP-FPM

[aukfood]

Hello,

we’re circling around a problem and maybe we missed something in the setup. All our configuration with kerberos and Active Directory works fine in linux system console. But when we try to use this configuration to connect application (Wordpress with SSO module) it's not works.

In phpinfo page we don't have REMOTE_USER variable with user id and so Worpress SSO modules does not works it needs this variable to works

Our Apache vhost is like that

 <Directory /var/www/site/www/>
  #  Require all granted
    AllowOverride All
    DirectoryIndex index.php


#.svn & .git directories must be avoided!!
    RedirectMatch 404 /\.svn(/|$)
    RedirectMatch 404 /\.git(/|$)
    RewriteCond %{REQUEST_URI} !^/robots.txt$
    RewriteRule \.txt$ - [F]

    AuthType GSSAPI
    AuthName "GSSAPI Single Sign On Login"
    GssapiSSLonly On
    GssapiAllowedMech krb5
    BrowserMatch Windows gssapi-no-negotiate
    GssapiLocalName On
    GssapiBasicAuth Off
    GssapiImpersonate On
    GssapiNegotiateOnce On
    GssapiCredStore keytab:/etc/apache2/site.keytab
    Require valid-user
   </Directory>


   <Location /kerb/>
    AuthType GSSAPI
    AuthName "GSSAPI Single Sign On Login"
    GssapiSSLonly On
    #GssapiAllowedMech krb5
    BrowserMatch Windows gssapi-no-negotiate
    GssapiLocalName On
    GssapiBasicAuth On
    GssapiImpersonate On
    GssapiNegotiateOnce On
    GssapiCredStore keytab:/etc/apache2/intranetv2.keytab
    GssapiCredStore client_keytab:/etc/apache2/intranetv2.keytab

    RequestHeader set REMOTE_USER %{REMOTE_USER}s
    RequestHeader set AUTH_TYPE %{AUTH_TYPE}s
    RequestHeader set KRB5CCNAME %{KRB5CCNAME}s
    GssapiConnectionBound On
    Header set Persistent-Auth "true"

    Require valid-user
   </Location>

We test in https://site/kerb

krb5.conf is like that

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
        default_realm = VILLE.LOCAL
        dns_lookup_realm = false
        ticket_lifetime = 24h
        renew_lifetime = 7d
        forwardable = true
        rdns = false

[realms]
        VILLE.LOCAL = {
                kdc = cdssrv5.ville.local
                kdc = cdssrv6.ville.local
                admin_server = cdssrv5.ville.local
        }

[domain_realm]
        .ville.local = VILLE.LOCAL
        ville.local = VILLE.LOCAL

System informations

• debian 12
• Apache 2.4.57
• php8.2 fpm

Thanks for you're help

[simo5]

Your configuration is confusing, as you seem to use two different keytabs for two different locations.
Do they correspond to different fully qualified names?

What is the difference between /etc/apache2/site.keytab and /etc/apache2/intranetv2.keytab ?
Kerberos knows nothing about the HTTP protocol, it can only distinguish between FQDNs.

It is unclear why you try to set KRB5CCNAME or AUTH_TYPE in the headers.
if you want to influence what ccache to use use GssapiCredStore ccache:/path then set that path as the KRB5CCNAME environment variable if your application depends on that.

BrowserMatch Windows gssapi-no-negotiate will prevent windows client from authenticating except via BAsic Auth (which is on, so ok, I guess).

If you are using mismatching FQDN vs principal name because your KDC support aliasing you may want to set ignore_acceptor_hostname = true in the [libdefaults] section of your krb5.conf file.
Otherwise GSSAPI will accept the negotiation only if the FQDN in the URL matches exactly the second part of the principal name (after HTTP/) in the keytab.

With GssapiLocalName On you must have corresponding uses in /etc/passwd or use something like SSSD on ajoined host to provide the users to the system. Otherwise leave it off the REMOTE_NAME will be set to the krb5 user principal name (ie [email protected])

[simo5]

Also unless you are using gss-proxy and have an application specially built to know how to do s4u2 operations you probably want to leave GssapiImpersonate to off.