SSO only works after an initial identification (stored in a cookie)

[Ctixou]

Hi everyone,
I've set up GSSAPI to connect using SSO over HTTPS, but it only works after the first user input using Edge, but same result with chrome/firefox

From the shell (kinit) the user is authorized connexion with AD is working
Bellow my SSL vHost configuration :
AuthType GSSAPI
AuthName "Login"
GssapiCredStore keytab:/etc/apache2/krbtmp.keytab
BrowserMatch Windows gssapi-no-negotiate
GssapiBasicAuth On
GssapiUseSessions On
require valid-user

I hope it's possible, thanks for your help.

[simo5]

You may want to reconsider the usage of:
BrowserMatch Windows gssapi-no-negotiate
if you want SSO to work on Windows hosts.

[Ctixou]

Hello,
With or without same result, I also tried to mount a new GLPI VM, same result ...

            AuthType GSSAPI
            AuthName "Login"
            GssapiCredStore keytab:/etc/apache2/krbtmp.keytab
            GssapiBasicAuth On (with or without)
            require valid-user

Thank you for your help.

[Ctixou]

Hello,

The problem persists, does anyone have any ideas?

Best regards,

[Ctixou]

When BrowserMatch Windows gssapi-no-negotiate is active, I can log in by entering my credentials. When I comment out this line, I can no longer log in and I get the following error in /var/www/apache2/error.log.

[auth_gssapi:error] [pid 235475] [client 192.168.14.120:28911] GSS ERROR In Negotiate Auth: gss_accept_sec_context() failed: [An unsupported mechanism was requested (Unknown error)]

[simo5]

This error means that Windows is trying to use NTLM for authentication, which means it failed to obtain a kerberos ticket.
Generally this is due to the name used by the client which does not match the hostname requested in the keytab, or the keytab being requested with a bad name (incorrect casing, incorrect host name, etc...).

[Ctixou]

Thank you for helping me.

My server is registered with dns A "sv-prod.domain.local" I have configured the keytab as "HTTP/[email protected]"
kinit -k -t /etc/apache2/krb.keytab HTTP/sv-prod is working fine.

Do you think it's misconfigured?

[simo5]

The correct name is HTTP/[email protected]

[Ctixou]

I created a new keytab with HTTP/[email protected] and it's working now.

Thank you for your help.