I have this scenario: a windows 2008 R2 Domain and a linux server (CentOs) with Apache.
I need to configure SSO using kerberos in order to permit our internal client using IE or Chrome to authenticate on a website without asking for a password.
In order to do this i follow this tutorial https://wiki.gentoo.org/wiki/Kerberos_Windows_Interoperability.
My Apache conf file for the site is:
AuthType Kerberos
AuthName "Kerberos Login"
KrbAuthRealms <MYREALM>
KrbServiceName HTTP/OTRS5@<MYREALM>
Krb5Keytab /etc/krb5.keytab
KrbMethodNegotiate On
KrbMethodK5Passwd Off
KrbSaveCredentials Off
KrbVerifyKDC Off
Require valid-user
Now when I try to connect to the site I receive a 401 code.
On error.log I found :
kerb_authenticate_user entered with user (NULL) and auth_type Kerberos
Acquiring creds for HTTP/OTRS5@<MYREALM>
Verifying client data using KRB5 GSS-API
Client didn't delegate us their credential
On journalctl:
GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server not found in Kerberos database)
I'm totally clueless about it.
Can you help me? Regards Francesco