php_krb5 beta / Negotiate auth with ...

Moritz Bechler

php_krb5 beta / Negotiate auth with GSSAPI for PHP Tue, Apr 17. 2007

I finally managed to get the krb5 extension for PHP ready for some kind of release, since the last time I wrote about it I felt the urge to implement yet another feature: Negotiate authentication using GSSAPI. This enables real kerberos single sign on support for webapplications in PHP and works in Mozilla (tested on Windows and Linux - using MIT kerberos/KfW) and should work on IE, too, but I have not yet had the chance to test using SSPI. Nice to have :-)

I'll post some article on this feature in the next days.

I now have copied the missing headers from the the mit-krb5 distribution, so the source is not needed anymore.


You can get it here -
php_krb5-beta.tar.gz - and maybe some day through PECL.

Posted by Moritz Bechler in PHP Comments: (4) Trackbacks: (0)

Trackbacks
Trackback specific URI for this entry

No Trackbacks

Comments
Display comments as (Linear | Threaded)

#1 - Alberto Mancini 2008-12-09 22:52 - (Reply)

I found a previous post stating that you are working on an AFS php extension;
I will need a similar extension and i wonder if you had some result.
I have no experience in building php extensions but if you have someting almost-working I can try to add functionalities.

#2 - Tom Pasrker 2009-11-28 13:41 - (Reply)

I have been searching for a plugin to do User Authentication with Kerberos for a while. Can you post some sample code if you have any. I am really out of practice with my C/C++.

I would like to pass a username@REALM and password to php via SSL to Authenticate users of a web app.

Thanks

#2.1 - Moritz Bechler 2009-11-28 16:34 - (Reply)

Doing this is as simple as initializing a credential cache and acquiring a TGT using a password. See my most recent post for a current version of the extension.

Verifying the users credentials against a KDC should be as simple as this:

  1.  
  2. // assuming $princial and $password are available here
  3. $authenticated = false;
  4. $ccache = new KRB5CCache();
  5. try {
  6.    $ccache->initPassword($principal, $password);
  7.    $authenticated = true;
  8. } catch(Exception $e) { }
  9.  

as initPassword will throw an exception when it is unable to obtain a ticket using the given credentials. (This refers to the new version of the extension)

#3 - Ashish 2013-08-22 06:07 - (Reply)

I have a problem and hope you can help me regarding the library you have created.

I was looking for some sort of example code based on the functions of library which shows how to fetch page content in php with kerberos authentication.

So my site is in kerberos iis server and I wanted to show only some of it's part to global one.

I know how to work with ccache but then from there I am kind of lost, if you can help me with that then that would be great.

cheers


Add Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.


You can use [geshi lang=lang_name [,ln={y|n}]][/geshi] tags to embed source code snippets.