CentOS 7 Apache HTTPD Kerberos Windows AD问题

Question

我真的很想解决这个问题，所以我希望你能帮助我。我GOOGLE了几个小时，但似乎无法得到正确的配置。

我在CentOS 7上使用Kerberos身份验证设置Apache，以便我可以在Windows AD环境中实现SSO。根据我的理解，这是可能的，我应该能够通过Internet Explorer访问时实现真正的SSO。目前我有以下配置，当通过Internet Explorer访问网站时会生成500内部服务器错误，但在使用Firefox时奇怪地起作用（尽管我必须在提示中输入凭据）。

我首先生成一个服务主体并使用以下命令在Windows中导出keytab。

ktpass -princ HTTP/server.example.local@EXAMPLE.LOCAL -mapuser EXAMPLE\http-user -crypto ALL -ptype KRB5_NT_PRINCIPAL -mapop set -pass password -out D:\krb5.keytab 

在将keytab复制到/etc/httpd/conf/krb5.keytab下的CentOS服务器之后，我配置了以下虚拟主机。

<VirtualHost *:80> 
    ServerName server.shc.local 
    DocumentRoot /var/www/html/test 

    LogLevel debug 
    ErrorLog /var/log/httpd/test-error.log 
    CustomLog /var/log/httpd/test-custom.log combined 

<Location /> 
    Options Indexes 
    AuthType Kerberos 
    KrbServiceName "HTTP/server.example.local@EXAMPLE.LOCAL" 
    AuthName "Welcome to the KRB5 Test" 
    KrbMethodNegotiate on 
    KrbMethodK5Passwd off 
    KrbVerifyKDC off 
    KrbAuthRealms SHC.LOCAL 
    Krb5KeyTab /etc/httpd/conf/krb5.keytab 
    require valid-user 
</Location> 

</VirtualHost> 

当我通过互联网浏览器访问该网站，我得到一个500内部服务器错误和日志看起来是这样的：

[Mon Jun 27 19:14:07.552584 2016] [authz_core:debug] [pid 2832] mod_authz_core.c(809): [client 192.168.214.202:21545] AH01626: authorization result of Require valid-user : denied (no authenticated user yet) 
[Mon Jun 27 19:14:07.552637 2016] [authz_core:debug] [pid 2832] mod_authz_core.c(809): [client 192.168.214.202:21545] AH01626: authorization result of <RequireAny>: denied (no authenticated user yet) 
[Mon Jun 27 19:14:07.552690 2016] [auth_kerb:debug] [pid 2832] src/mod_auth_kerb.c(1954): [client 192.168.214.202:21545] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos 
[Mon Jun 27 19:14:07.552747 2016] [auth_kerb:debug] [pid 2832] src/mod_auth_kerb.c(1295): [client 192.168.214.202:21545] Acquiring creds for HTTP/server.example.local@EXAMPLE.LOCAL 
[Mon Jun 27 19:14:07.555237 2016] [auth_kerb:debug] [pid 2832] src/mod_auth_kerb.c(1155): [client 192.168.214.202:21545] GSS-API major_status:000d0000, minor_status:0000000d 
[Mon Jun 27 19:14:07.555250 2016] [auth_kerb:error] [pid 2832] [client 192.168.214.202:21545] gss_acquire_cred() failed: Unspecified GSS failure. Minor code may provide more information (, Permission denied) 

，然后当我通过Firefox浏览正常访问的网站，我得到提示进入凭据，但后来我成功通过身份验证。日志是这样的：

[Mon Jun 27 19:16:49.936807 2016] [authz_core:debug] [pid 2828] mod_authz_core.c(809): [client 192.168.214.202:21577] AH01626: authorization result of Require valid-user : denied (no authenticated user yet) 
[Mon Jun 27 19:16:49.936849 2016] [authz_core:debug] [pid 2828] mod_authz_core.c(809): [client 192.168.214.202:21577] AH01626: authorization result of <RequireAny>: denied (no authenticated user yet) 
[Mon Jun 27 19:16:49.936888 2016] [auth_kerb:debug] [pid 2828] src/mod_auth_kerb.c(1954): [client 192.168.214.202:21577] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos 
[Mon Jun 27 19:16:50.042925 2016] [authz_core:debug] [pid 2829] mod_authz_core.c(809): [client 192.168.214.202:21578] AH01626: authorization result of Require valid-user : denied (no authenticated user yet) 
[Mon Jun 27 19:16:50.042960 2016] [authz_core:debug] [pid 2829] mod_authz_core.c(809): [client 192.168.214.202:21578] AH01626: authorization result of <RequireAny>: denied (no authenticated user yet) 
[Mon Jun 27 19:16:50.042982 2016] [auth_kerb:debug] [pid 2829] src/mod_auth_kerb.c(1954): [client 192.168.214.202:21578] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos 

没有人有任何的想法是什么，我需要做的就是无缝访问SSO通过Internet Explorer网站时工作。

Answer 1

好的，我终于解决了这个问题。我必须禁用SELinux！我不能相信这很简单，但我所做的只是禁用SElinux，重启服务器并开始认证。我希望这可以帮助别人解决我一直头疼的问题！