Имеется: web сервер redmine: SLES 11 (x86_64) апач: apache2-devel-2.2.12-1.51.52.1 модуль kerb: apache2-mod_auth_kerb-5.4-0.3.8 и KDC: windows server 2012 R2 standard.
1. Добавил A, PTR записи в DNS для redmine сервера.
2. Cинхронизировал время через NTP(c местным сервером), находится в пределах 5 мин.
3. Cоздал учетную запись redmineapache в AD для связи с principal'ом сервиса HTTP.
4. Cоздал keytab файл и прикрепил к principal'y:
ktpass.exe -princ HTTP/redmine.sbt.mot.loc@SBT.MOT.LOC -pass * -mapuser redmineapache@SBT.MOT.LOC -crypto ALL -ptype KRB5_NT_PRINCIPAL -out c:\temp\krb5.keytab
после связывания, сервис появился:
setspn.exe -L redmineapache
Registered ServicePrincipalNames for CN=Redmine dummy,CN=Users,DC=sbt,DC=mot,DC=loc:
HTTP/redmine.sbt.mot.loc
проверяю что в keytab: redmine:/home/kirill # klist -ek /etc/krb5.keytab
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
25 HTTP/redmine.sbt.mot.loc@SBT.MOT.LOC (DES cbc mode with CRC-32)
25 HTTP/redmine.sbt.mot.loc@SBT.MOT.LOC (DES cbc mode with RSA-MD5)
25 HTTP/redmine.sbt.mot.loc@SBT.MOT.LOC (ArcFour with HMAC/md5)
25 HTTP/redmine.sbt.mot.loc@SBT.MOT.LOC (AES-256 CTS mode with 96-bit SHA-1 HMAC)
25 HTTP/redmine.sbt.mot.loc@SBT.MOT.LOC (AES-128 CTS mode with 96-bit SHA-1 HMAC)
redmine:/home/kirill # kinit -k -t /etc/krb5.keytab HTTP/redmine.sbt.mot.loc@SBT.MOT.LOC
redmine:/home/kirill # kvno HTTP/redmine.sbt.mot.loc@SBT.MOT.LOC
HTTP/redmine.sbt.mot.loc@SBT.MOT.LOC: kvno = 25
5. Конфиг виртуального хоста vhosts.conf:
<VirtualHost *:80>
ServerAdmin kirill-ke@sbt.ru
ServerName redmine.sbt.mot.loc
ServerAlias www.redmine.sbt.mot.loc
RailsEnv production
RailsBaseURI /redmine
DocumentRoot /var/www/redmine/www/public
ErrorLog /var/www/redmine/error.log
Loglevel debug
CustomLog /var/www/redmine/access.log common
<Directory "/var/www/redmine/www/public/">
Options Indexes ExecCGI FollowSymLinks
Order allow,deny
Allow from all
AllowOverride all
</Directory>
<Location "/login">
AuthType Kerberos
AuthName "Redmine access:"
KrbAuthRealms SBT.MOT.LOC
Krb5KeyTab /etc/krb5.keytab
KrbServiceName HTTP/redmine.sbt.mot.loc
KrbMethodNegotiate on
KrbMethodK5Passwd on
KrbLocalUserMapping on
require valid-user
</Location>
/etc/krb5.conf:
[logging]
kdc = FILE:/var/log/krb5/krb5kdc.log
adminin_server = FILE:/var/log/krb5/kadminind.log
default = SYSLOG:NOTICE:DAEMON
[libdefaults]
default_realm = SBT.MOT.LOC
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
forwardable = yes
default_tkt_enctypes = arcfour-hmac-md5 des-cbc-crc des-cbc-md5
default_tgs_enctypes = arcfour-hmac-md5 des-cbc-crc des-cbc-md5
[realms]
SBT.MOT.LOC = {
kdc = ito.sbt.mot.loc
adminin_server = ito.sbt.mot.loc
default_domain = sbt2
}
[domain_realm]
.sbt.mot.loc = SBT.MOT.LOC
sbt.mot.loc = SBT.MOT.LOC
.sbt2 = SBT.MOT.LOC
[appdefaults]
pam = {
debug = false
ficket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
}
5. Логи. обращение с linux машины:
[Tue Dec 01 11:30:44 2015] [debug] src/mod_auth_kerb.c(1667): [client 172.4.1.22] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos
[Tue Dec 01 11:30:44 2015] [debug] src/mod_auth_kerb.c(1025): [client 172.4.1.22] Using HTTP/redmine.sbt.mot.loc@SBT.MOT.LOC as server principal for password verification
[Tue Dec 01 11:30:44 2015] [debug] src/mod_auth_kerb.c(714): [client 172.4.1.22] Trying to get TGT for user kirill-ke@SBT.MOT.LOC
[Tue Dec 01 11:30:44 2015] [debug] src/mod_auth_kerb.c(625): [client 172.4.1.22] Trying to verify authenticity of KDC using principal HTTP/redmine.sbt.mot.loc@SBT.MOT.LOC
[Tue Dec 01 11:30:44 2015] [debug] src/mod_auth_kerb.c(1110): [client 172.4.1.22] kerb_authenticate_user_krb5pwd ret=0 user=kirill-ke@SBT.MOT.LOC authtype=Basic
[Tue Dec 01 11:30:44 2015] [debug] src/mod_auth_kerb.c(1573): [client 172.4.1.22] kerb_authenticate_a_name_to_local_name kirill-ke@SBT.MOT.LOC -> kirill-ke
[Tue Dec 01 11:32:17 2015] [debug] src/mod_auth_kerb.c(1025): [client 172.4.1.22] Using HTTP/redmine.sbt.mot.loc@SBT.MOT.LOC as server principal for password verification, referer: http://redmine.sbt.mot.loc/login
[Tue Dec 01 11:32:17 2015] [debug] src/mod_auth_kerb.c(714): [client 172.4.1.22] Trying to get TGT for user kirill-ke@SBT.MOT.LOC, referer: http://redmine.sbt.mot.loc/login
[Tue Dec 01 11:32:17 2015] [debug] src/mod_auth_kerb.c(625): [client 172.4.1.22] Trying to verify authenticity of KDC using principal HTTP/redmine.sbt.mot.loc@SBT.MOT.LOC, referer: http://redmine.sbt.mot.loc/login
[Tue Dec 01 11:32:17 2015] [debug] src/mod_auth_kerb.c(1110): [client 172.4.1.22] kerb_authenticate_user_krb5pwd ret=0 user=kirill-ke@SBT.MOT.LOC authtype=Basic, referer: http://redmine.sbt.mot.loc/login
[Tue Dec 01 11:32:17 2015] [debug] src/mod_auth_kerb.c(1573): [client 172.4.1.22] kerb_authenticate_a_name_to_local_name kirill-ke@SBT.MOT.LOC -> kirill-ke, referer: http://redmine.sbt.mot.loc/login
c win машины при обращении к http://redmine.sbt.mot.loc/login. Имя учетки подставляется верно.
[Tue Dec 01 11:34:10 2015] [debug] src/mod_auth_kerb.c(1667): [client 172.4.1.23] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos
[Tue Dec 01 11:34:10 2015] [debug] src/mod_auth_kerb.c(1667): [client 172.4.1.23] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos
[Tue Dec 01 11:34:10 2015] [debug] src/mod_auth_kerb.c(1277): [client 172.4.1.23] Acquiring creds for HTTP/redmine.sbt.mot.loc
[Tue Dec 01 11:34:10 2015] [debug] src/mod_auth_kerb.c(1424): [client 172.4.1.23] Verifying client data using KRB5 GSS-API
[Tue Dec 01 11:34:10 2015] [debug] src/mod_auth_kerb.c(1440): [client 172.4.1.23] Client didn't delegate us their credential
[Tue Dec 01 11:34:10 2015] [debug] src/mod_auth_kerb.c(1459): [client 172.4.1.23] GSS-API token of length 164 bytes will be sent back
[Tue Dec 01 11:34:10 2015] [debug] src/mod_auth_kerb.c(1573): [client 172.4.1.23] kerb_authenticate_a_name_to_local_name admin-kke@SBT.MOT.LOC -> admin-kke
вопрос: Почему не происходит аутентификации на win машине?
