0

I have a running centos6.6 server who authenticates against a windows 2008 AD with realm EXAMPLE.LOCAL. I have successfully configured an apache webserver for authentication through kerberos keytab file. The name of the server is testsrv.example.local .

So far, so good. On my DC, next to example.local, I have a DNS forward lookup zone example.net . The records in example.net are used for internal navigation (like intranet, test sites, ...). I have configured several apache virtual hosts with example.net.

SSO authentication for testsrv.example.local works fine. When I try this for intra.example.net, I get authorization required.

Question: how can I achieve also authorization for example.net with kerberos keytab to domain example.local?

Thank you, Andries

Andries
  • 1
  • 1

1 Answers1

1

What you are looking for is cross-realm authentication. As you probably know Kerberos uses the concept of realm to provide its services. If whatever service is outside of this realm Kerberos isn't even asked.

Kei
  • 111
  • 2