<html><head/><body><html><head></head><body>Hi.<br>
<br>
I've done the kerberos part with several Apache Web servers with success. I've not done the fallback to ldap basic auth. <br>
<br>
Set KrbServiceName to Any in httpd.conf and put a HTTP service kerberos keytab from AD and one from IPA in the same keytab file. Reference this keytab file in httpd.conf.<br>
<br>
<br>
<br>
Regards<br>
Siggi<br>
<br><br><div class="gmail_quote">KodaK <sakodak@gmail.com> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
Another off the wall one from me, but I just want to know if this is worth pursuing.<div><br /></div><div>I have a series of internal web applications that authenticate variously to AD or IPA via prompted credentials.</div><div>
<br /></div><div>I'd like to use Kerberos tickets (and fall back to LDAP) instead.</div><div><br /></div><div>I have an IPA connected apache server that most of this stuff runs on.</div><div><br /></div><div>Is it possible to use both?</div>
<div><br /></div><div>I'm going to try following this example to get my feet wet:</div><div><br /></div><div><a href="http://www.tuxlanding.net/kerberos-authentication-with-apache-in-a-multi-domain-active-directory/">http://www.tuxlanding.net/kerberos-authentication-with-apache-in-a-multi-domain-active-directory/</a></div>
<div><br /></div><div>but that's just talking about mutilple AD realms. I'd like to know if there was any special considerations for IPA</div><div><br /></div><div>Thanks again,</div><div><br /></div><div>--Jason<br clear="all" />
<div><br /></div>-- <br />The government is going to read our mail anyway, might as well make it tough for them. GPG Public key ID: B6A1A7C6
</div>
<p style="margin-top: 2.5em; margin-bottom: 1em; border-bottom: 1px solid #000"></p><pre style="white-space: pre-wrap; word-wrap:break-word; font-family: sans-serif; margin-top: 0px"><hr /><br />Freeipa-users mailing list<br />Freeipa-users@redhat.com<br /><a href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre></blockquote></div><br>
-- <br>
Sent from my Android phone with K-9 Mail. Please excuse my brevity.</body></html></body></html>