Dotaz: mod_auth_kerb overeni kerberosem

[červ]

Zdravim. Potreboval bych malou pomoc. Potrebuji nastavit overeni kerberosem pres modul mod_auth_kerb v apachi pro pristup na web. Server s uzivatelskou db je funkcni (overeno na jinych systemech) krb5 nakompilovan, mod_auth_kerb nakompilovan. Pouzity OS Solaris 9 (x86). Troufam si tvrdit, ze jak modul, tak krb5 jsou nainstalovany spravne.
Pokud zadam kinit uzivatel, tak vyzve spravne k zadani hesla a prideli ticket.
klist spravne vylistuje.

#kinit uzivatel
Password for uzivatel@domena.CZ:
#

#klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: uzivatel@domena.CZ

Valid starting Expires Service principal
06/12/08 14:08:47 06/13/08 00:08:53 krbtgt/domena.CZ@domena.CZ
renew until 06/13/08 14:08:47


Kerberos 4 ticket cache: /tmp/tkt0
klist: You have no tickets cached

Nerozumim jen vete You have no tickets cached.
Muj krb5.conf:
[libdefaults]
default_realm = DOMENA.CZ

[realms]
DOMENA.CZ = {
kdc = kerb1.domena.cz:88
kdc = kerb2.domena.cz:88
admin_server = kerb1.domena.cz:749
}

[domain_realm]
.mujserver.domena.cz = DOMENA.CZ

[appdefaults]
kinit = {
renewable = true
forwardable= true
}

Muj .htaccess:
AuthType Kerberos
KrbMethodNegotiate off
KrbMethodK5Passwd off
KrbAuthoritative off
KrbAuthRealms IP serveru kerb1.domena.cz
KrbVerifyKDC off
KrbServiceName HTTP
Krb5Keytab /usr/krb5/keytab
require valid-user

Bohuzel kdyz vlezu na prislusnou stranku, tak me vyzve k autentizaci, ale nepusti me nikam.
Log z apache:
[Thu Jun 12 14:23:44 2008] [debug] src/mod_auth_kerb.c(1485): [client moje ip] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos
[Thu Jun 12 14:23:56 2008] [debug] src/mod_auth_kerb.c(1485): [client moje ip] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos
[Thu Jun 12 14:23:56 2008] [error] [client moje ip] Cannot get krb4 ticket: krb_get_pw_in_tkt() failed: Can't send request (send_to_kdc)
[Thu Jun 12 14:23:56 2008] [error] [client moje ip] Verifying krb4 password failed

Priznam se, ze uz jsem zkusil kde co, a absolutne me nenapada, kde by mohl byt zakopanej pes. Budu rad za kazdou radu.

Odpovědi

[červ]

Dalsi info:
Pokud upravim .htaccess takto:
AuthType Kerberos
KrbMethodNegotiate off
KrbMethodK5Passwd on
KrbAuthoritative on
KrbAuthRealms (IP)
KrbVerifyKDC on
KrbServiceName HTTP
Krb5Keytab /usr/krb5/keytab
require valid-user

Tak samozrejme zapnu krb5, to uz by bylo. Nicmene prihodi apache log:
[Thu Jun 12 14:50:28 2008] [debug] src/mod_auth_kerb.c(680): [client moje ip] Trying to get TGT for user uzivatel@ip serveru
[Thu Jun 12 14:50:28 2008] [error] [client moje ip] krb5_get_init_creds_password() failed: Cannot resolve network address for KDC in requested realm
[Thu Jun 12 14:50:28 2008] [debug] src/mod_auth_kerb.c(1019): [client moje ip] kerb_authenticate_user_krb5pwd ret=401 user=(NULL) authtype=(NULL)
[Thu Jun 12 14:50:29 2008] [error] [client moje ip] Cannot get krb4 ticket: krb_get_pw_in_tkt() failed: Can't send request (send_to_kdc)
[Thu Jun 12 14:50:29 2008] [error] [client moje ip] Verifying krb4 password failed

Tzn. klasickej prubeh. Overuje krb5, ten mu zrejme neprojde a jde na krb4. Na tomhle apachi bezi tri virtual servery a autentifikaci nastavuji pro jede z virtualu, mohlo by to byt i napriklad tim? O cemz svedci i hlaska ze nemuze resolvovat. Prokontroloval jsem DNS a ma nastaveny A zaznam.

[červ]

Tak jo. Trochu ten dotaz pozmenim. Podarilo se mi, ze uz se autentifikuje. Ale. Autentifikuje se proti localhostu. Jak ho prinutim, aby se autentifikoval proti tomu co ma? Dik.