php_krb5 rc2

#1.1 - Moritz Bechler 2010-04-20 11:32 - (Reply)

Thanks, and thanks for the report (can confirm that problem).

The more general problem is determining the correct server principal, at the moment I'm using a lookup on the ServerName (SERVER_NAME) to get the FQDN (which should work in most cases when the ServerName is correctly configured). But propably I should add some means to statically configure the server principal.

I just posted to the pecl list, so may be that will be available shortly.

#2.1 - Moritz Bechler 2010-04-30 14:08 - (Reply)

I'm sorry, so far I haven't even looked at windows support. It should be perfectly possible to support windows (using MIT's kerberos for windows, not the native win kerberos stuff as this provides a completely different API) but I don't even have a PHP build environment on a windows platform.

If you have, you might try to put together a config.w32 file, that shouldn't be too hard (linking the gssapi library and setting some defines like in config.m4 should be sufficient), and try whether it compiles using VC.

I might look into that too some time. But that propably won't happen in the near future.

#7.1 - Moritz Bechler 2012-08-19 13:15 - (Reply)

Did you use the rc2 package found here? If so, please use the PECL SVN version (https://svn.php.net/repository/pecl/krb5/trunk). This should at least fix the HAVE_KRB5_CC_NEW_UNIQUE problem. The undefined symbol error looks strange, is mod_krb5.so the extension module? This shouldn't be loaded as apache module but by PHP (add it using a extension= line in your php.ini).

What you want to do is definititly possible with this module. I do not know about SoapClient, you propably will have to find a way to pass a custom Authorization Header which will contain a SPNEGO (if you are doing Negotiate auth) or a GSSAPI token (if performing the Kerberos auth scheme). As far as I can see the SOAP extension uses cURL, which in theory is able to do the authentication but this mechanism seems not to be available trough the SOAPClient interface (https://bugs.php.net/bug.php?id=52231).

On the client side you will have to perform the Negotiate authentication mechanism, which is also implemented in the NegotiateAuth class of this extension, but that won't work when running mod_php. But it should be as simple as sending the appropriate WWW-Authenticate header, registering the acceptorIdentity for your server, and passing the token from the Authorization header into acceptSecContext. If the client is configured to perform credential delegation you'll also get a credential cache with the delegated credentials out of this function.

Using these credentials you will then be able to initialize a GSSAPI context for your backend, and pass it to your backend. If performing SPNEGO authentication you'll have to wrap the resulting GSSAPI token in the SPNEGO format.

One word about credential delegation in HTTP Negotiate: Enabling credential delegation causes the client to get a TGT for delegation for every authentication requested by the server. This can possibly add massive latency and load on the KDC. So, you will propably want to restrict delegation to some "login"-page, cache the delegated credentials on the server and possibly use session based authentication afterwards (or Negotitate, but not enabling delegation for these URLs).