Re: [Broken test case] Cryptic error message, fallback handling issue

On 01/12/2012 05:38 PM, Henry B. Hotz wrote:
> 
> On Jan 11, 2012, at 11:29 PM, Stephane LAPIE wrote:
> 
>> Thanks for the good practices, I'll admit I sorely lack in that. :)
>>
>> I am actually already using a dedicated keytab for apache (because yes,
>> I am fully aware "host" and "HTTP" services are two different things,
>> and thus require different permissions, enforced by my deployment tools :)).
>>
>> I am aware most of my woes stem from the non-removable requirement to
>> have stuff run from AD and a Windows environment, and the fact IE uses
>> the Windows Unified Authentication mechanism which is far more thorough
>> than other environments : i.e it will only accept authentication if the
>> hostname returned by an rDNS lookup matches the principal of the server,
>> and I wanted to eliminate unknowns.
>>
>> I ended up forcing the SPN after wasting some time because the server
>> was advertising "HTTP/<ApacheServerName>" (which is apparently what you
>> get when using only "KrbServiceName HTTP", and ServerName is acquired
>> from rDNS of the local IP) which didn't reflect the vhost
>> "<ApplicationName>", and made authentication fail from IE when it found
>> out the URL didn't match the SPN.
>>
>> This actually kind of brings the question : what is the best practice
>> with apache+vhosts and Kerberos ?
>>
>> Should I just forget the idea altogether and go with
>> "http://webserver.domain/application/" instead of
>> "http://application.domain/" ?
> 
> Well, if you need to support multiple server names (e.g. virtual hosts), then what I recommended is probably the only way it works.  Add in that different OSs and browsers (and versions?) might have different algorithms for how they construct a principal name from the user-input server name AND that you need to support all of them, and you might have quite a list of names to support.

It turns out using "Any" as service name in apache, and having
HTTP/<vhost> and HTTP/<mainhost> loaded in the apache keytab works just
fine !

Thanks again for your time and your advice. :)
-- 
Stephane LAPIE, EPITA SRS, Promo 2005
"Even when they have digital readouts, I can't understand them."
--MegaTokyo

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk8Xb5kACgkQ24Ql8u6TF2Od7ACdFYnxlpnKcTwHP8uBWZ6liV30
C08AoNBensqR0F2BgUiciNH0+C9MyiUh
=CHvg
-----END PGP SIGNATURE-----