We configured Apache to use Kerberos authentication. Apache just send "X-Authenticated-User" header with username. For example:
AD domain login: [email protected]
Request Header name: 'x-authenticated-user' value: '[[email protected]]'
AD domain login: [email protected]
Request Header name: 'x-authenticated-user' value: '[[email protected]]'
My question is how to get original AD user name like "[email protected]", "[email protected]" in apache header?
Here is my configuration:
[root@server]$ sudo cat /etc/krb5.conf
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm =
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
[realms]
FOO.EXAMPLE.COM = {
kdc = foo.example.com
admin_server = foo.example.com
}
[domain_realm]
.foo.example.com = FOO.EXAMPLE.COM
foo.example.com = FOO.EXAMPLE.COM
======================================================================
[root@server]$ sudo cat server.conf
<VirtualHost *:80>
.....
.....
.....
RewriteEngine On
RewriteCond %{LA-U:REMOTE_USER} (.+)
RewriteRule . - [E=RU:%1]
RequestHeader set X-Authenticated-User %{RU}e
Header set X-Authenticated-User %{RU}e
RequestHeader set Host "site.foo.example.com"
<Location />
AuthType Kerberos
AuthName "Kerberos Login"
KrbMethodNegotiate On
KrbMethodK5Passwd Off
Krb5KeyTab /etc/httpd/conf/http.keytab
require valid-user
</Location>
.....
.....
.....
</VirtualHost>
