Auf dem Windows AD Controller
Anlegen eines SSO Users
Erzeugen eines keytab Files
ktpass -princ HTTP/macbook.panic.lan@PANIC.LAN -mapuser sso@PANIC.LAN -crypto RC4-HMAC-NT -ptype KRB5_NT_PRINCIPAL -pass DoesNotChange1 -out krb5.keytab Das File anschließend auf den Linux Host kopieren, z.B. nach /etc/krb5.keytab
Auf dem Linux Host
Die Apache2 Config (VirtualHost)
<Directory /var/www/html>
AuthType Kerberos
KrbAuthRealms PANIC.LAN
KrbServiceName HTTP/macbook.panic.lan@PANIC.LAN
Krb5Keytab /etc/krb5.keytab
KrbMethodNegotiate on
KrbMethodK5Passwd off
require valid-user
Satisfy Any
</Directory> Die krb5.conf
[libdefaults]
default_realm = PANIC.LAN
[realms]
PANIC.LAN = {
kdc = mordor.panic.lan
admin_server = mordor.panic.lan
}
[domain_realm]
macbook.panic.lan = PANIC.LAN
.panic.lan = PANIC.LAN
panic.lan = PANIC.LAN