Let me start from describing my real goal, because I am not sure that I am trying to solve it in a proper way =)
I am simply trying to make my web application obtain Kerberos credentials on behalf of the user who logs in. The webserver is part of my Linux domain (enrolled with FreeIPA / RedHat IdM). The client is external, but the user exists in my domain. So what I want to achieve is this:
- The user browses to my webapp and enters his username/password (in a custom login form)
- The webapp validates the username/password against FreeIPA
- The webapp obtains Kerberos credentials on behalf of the logged in user, so that (for example) the webapp can now display the user's vaults or perform some privileged tasks on FreeIPA (which requires Kerberos authentication to it).
So far, I played with mod_intercept_form_submit
, and I was able to authenticate the user against FreeIPA, using pam_sss.so
(PAM + SSSD). This worked fine, but I couldn't find a TGT obtained for the user, so I couldn't accomplish the item 3.
Alternatively, I could probably use GSSAPI authentication on Apache, but since the client is not enrolled in the domain, this would display a system login form (while ideally I'd like to use the custom login form from the webapp).
Alternatively, I think the webapp could just bluntly take the password from the login form and run kinit <username>
with it, directly on the webserver.
What would be your recommended way? Because I feel like there must be something elegant... E.g. if PAM would just obtain Kerberos TGT for me, and my webapp would be able to access it after the login, that would be great...