The way it works (when the setup is correct) is that Zanata will try to authenticate using Kerberos tickets first. This involves interaction with the browser. If a ticket is not found, or the authentication is unsuccessful, Zanata will show a login screen that will allow the user to enter a user name and password. I've found that in order for this to work, the aforementioned krb5.conf file is the key. I think in your case the fact that Zanata cannot connect to the authentication server is why you don't see this screen.<div> </div><div>As for the format of the principal value, it looks like the format is correct, but the actual value is specific to each server in the end. You can take a look here: <a href="https://docs.oracle.com/javase/7/docs/jre/api/security/jaas/spec/com/sun/security/auth/module/Krb5LoginModule.html">https://docs.oracle.com/javase/7/docs/jre/api/security/jaas/spec/com/sun/security/auth/module/Krb5LoginModule.html</a> for a bit more info.</div><div> </div><div>Regards,</div><div> </div><div>Carlos </div><div> </div><div> <div> On Wednesday, 23 September 2015, Ramann, Björn <<a href="mailto:Bjoern.Ramann@governikus.de">Bjoern.Ramann@governikus.de</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> <div lang="DE" link="blue" vlink="purple"> <div> Two more question: 1. Without kerberos, i have a username and password form in the main page, with enabled Kerberos, there is no user and pass form. Is this correct? When yes, how do I enter my credentials? 2. In the domain-security “host”, I have: <module-option name="principal" value="HTTP/<a href="javascript:_e(%7B%7D,'cvml','dc01.domain.com@DOMAIN.COM');" target="_blank">dc01.domain.com@DOMAIN.COM</a>"/> Is there a detailed documentation about the syntax of the value? Thanks! <div> </div> <div> <div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0cm 0cm 0cm"> Von: <a href="javascript:_e(%7B%7D,'cvml','zanata-users-bounces@redhat.com');" target="_blank">zanata-users-bounces@redhat.com</a> [mailto:<a href="javascript:_e(%7B%7D,'cvml','zanata-users-bounces@redhat.com');" target="_blank">zanata-users-bounces@redhat.com</a>] Im Auftrag von Ramann, Björn Gesendet: Dienstag, 22. September 2015 13:28 An: <a href="javascript:_e(%7B%7D,'cvml','zanata-users@redhat.com');" target="_blank">zanata-users@redhat.com</a> Betreff: [zanata-users] Auth with kerberos </div> </div> <div> hi@all, </div> <div> </div> <div> i try to auth users with Kerberos to our windows Active directory and configure: </div> <div> </div> <div> <bindings> </div> <div>  </div> <div> <!-- <simple name="java:global/zanata/security/auth-policy-names/openid" value="zanata.openid"/> à </div> <div> <simple name="java:global/zanata/security/auth-policy-names/kerberos" value="zanata.kerberos"/> </div> <div> <simple name="java:global/zanata/security/admin-users" value="admin"/> </div> <div> <simple name="java:global/zanata/files/document-storage-directory" value="${user.home}/zanata/files"/> </div> <div> <simple name="java:global/zanata/email/default-from-address" value="<a href="javascript:_e(%7B%7D,'cvml','noreply@blub.com');" target="_blank">noreply@blub.com</a>"/> </div> <div> </bindings> </div> <div> … </div> <div> </div> <div> <security-domain name="zanata.kerberos"> </div> <div> <authentication> </div> <div> <login-module code="org.jboss.security.negotiation.spnego.SPNEGOLoginModule" flag="sufficient"> </div> <div> <module-option name="password-stacking" value="useFirstPass"/> </div> <div> <module-option name="serverSecurityDomain" value="host"/> </div> <div> <module-option name="removeRealmFromPrincipal" value="true"/> </div> <div> <module-option name="usernamePasswordDomain" value="krb5"/> </div> <div> </login-module> </div> <div> </authentication> </div> <div> </security-domain> </div> <div> <security-domain name="krb5"> </div> <div> <authentication> </div> <div> <login-module code="com.sun.security.auth.module.Krb5LoginModule" flag="sufficient"> </div> <div> <module-option name="storePass" value="false"/> </div> <div> <module-option name="clearPass" value="true"/> </div> <div> <module-option name="debug" value="true"/> </div> <div> <module-option name="doNotPrompt" value="false"/> </div> <div> </login-module> </div> <div> </authentication> </div> <div> </security-domain> </div> <div> <security-domain name="host"> </div> <div> <authentication> </div> <div> <login-module code="com.sun.security.auth.module.Krb5LoginModule" flag="required"> </div> <div> <module-option name="storeKey" value="true"/> </div> <div> <module-option name="useKeyTab" value="true"/> </div> <div> <module-option name="principal" value="<a href="javascript:_e(%7B%7D,'cvml','HTTP/dc01.domain.com@DOMAIN.COM');" target="_blank">HTTP/dc01.domain.com@DOMAIN.COM</a>"/> </div> <div> <module-option name="keyTab" value="/opt/zanata/wildfly/standalone/configuration/jboss.keytab"/> </div> <div> <module-option name="doNotPrompt" value="true"/> </div> <div> <module-option name="debug" value="true"/> </div> <div> </login-module> </div> <div> </authentication> </div> <div> </div> <div> </div> <div> But on the page, when I press login, I get da 403 and there is no fiel to type my credentials in. </div> <div> </div> <div> Soft: </div> <div> 13:25:45,457Z INFO [org.quartz.core.QuartzScheduler] (ServerService Thread Pool -- 58) Scheduler DefaultQuartzScheduler_$_NON_CLUSTERED started. </div> <div> 13:25:45,755Z INFO [org.zanata.ZanataInit] (ServerService Thread Pool -- 58) App server release codename: Kenny </div> <div> 13:25:45,755Z INFO [org.zanata.ZanataInit] (ServerService Thread Pool -- 58) App server release version: 1.0.1.Final </div> <div> 13:25:45,755Z INFO [org.zanata.ZanataInit] (ServerService Thread Pool -- 58) WildFly Full version: 9.0.1.Final </div> <div> 13:25:45,757Z INFO [org.zanata.ZanataInit] (ServerService Thread Pool -- 58) ============================================ </div> <div> 13:25:45,757Z INFO [org.zanata.ZanataInit] (ServerService Thread Pool -- 58) _____ _ </div> <div> 13:25:45,757Z INFO [org.zanata.ZanataInit] (ServerService Thread Pool -- 58) /__ / ____ _____ ____ _/ /_____ _ </div> <div> 13:25:45,757Z INFO [org.zanata.ZanataInit] (ServerService Thread Pool -- 58) / / / __ `/ __ \/ __ `/ __/ __ `/ </div> <div> 13:25:45,758Z INFO [org.zanata.ZanataInit] (ServerService Thread Pool -- 58) / /__/ /_/ / / / / /_/ / /_/ /_/ / </div> <div> 13:25:45,758Z INFO [org.zanata.ZanataInit] (ServerService Thread Pool -- 58) /____/\__,_/_/ /_/\__,_/\__/\__,_/ </div> <div> 13:25:45,758Z INFO [org.zanata.ZanataInit] (ServerService Thread Pool -- 58) Application version: 3.7.2 </div> <div> 13:25:45,758Z INFO [org.zanata.ZanataInit] (ServerService Thread Pool -- 58) SCM: git-server-3.7.2 </div> <div> 13:25:45,758Z INFO [org.zanata.ZanataInit] (ServerService Thread Pool -- 58) Red Hat Inc 2008-2015 </div> <div> 13:25:45,758Z INFO [org.zanata.ZanataInit] (ServerService Thread Pool -- 58) ============================================ </div> <div> 13:25:45,758Z INFO [org.zanata.ZanataInit] (ServerService Thread Pool -- 58) SPNEGO/Kerberos authentication: enabled </div> <div> 13:25:45,759Z INFO [org.zanata.ZanataInit] (ServerService Thread Pool -- 58) Enable copyTrans: true </div> <div> </div> <div> </div> <div> Please advise! </div> <div> </div> <div> Thanks </div> <div> bjoern </div> <div> </div> <div> </div> </div> </div> </blockquote></div></div> -- Carlos A. Muñoz Software Engineering Supervisor Globalization Red Hat