Kerberos HTTP authentication in RHEL4/FC3/FC2

[Dax Kelson]

One of the new features of Mozilla 1.7 touted in the release notes is:

"Support for Kerberos HTTP authentication using GSSAPI (benefits
Unix-like platforms including Linux and OS X)."

Single sign on rules. 

Whats needed is the addition of --with-gssapi in the spec along with
adding krb5-devel to the BuildReq line.

I've filed a request in bugzilla.

mod_auth_kerb (http://modauthkerb.sourceforge.net/) for Apache makes a
nice companion to this.

Dax Kelson
Guru Labs

[Ulrich Drepper]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dax Kelson wrote:
>  One of the new features of Mozilla 1.7 touted in the release notes
> is:
>  
>  "Support for Kerberos HTTP authentication using GSSAPI (benefits
>  Unix-like platforms including Linux and OS X)."
>  
>  Single sign on rules. 
Have you even looked at the Mozilla in FC3?  The negotiateauth component
is present and...


>  mod_auth_kerb (http://modauthkerb.sourceforge.net/) for Apache makes
> a
>  nice companion to this. 
... mod_auth_kerb is also present.

- --
➧ Ulrich Drepper ➧ Red Hat, Inc. ➧ 444 Castro St ➧ Mountain View, CA ❖
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.6 (GNU/Linux)
>
> iD8DBQFBPpR02ijCOnn/RHQRAmQ2AJ0Qp6sfEzo0qrxow/N6PCh/QjhHFACgkF+6
> yKK9LfsAbOs8huu7K3rJpgA=
> =bXy0
> -----END PGP SIGNATURE-----

[Dax Kelson]

On Tue, 2004-09-07 at 23:11, Ulrich Drepper wrote:
>  -----BEGIN PGP SIGNED MESSAGE-----
>  Hash: SHA1
>  
>  Dax Kelson wrote:
>  > One of the new features of Mozilla 1.7 touted in the release notes is:
>  > 
>  > "Support for Kerberos HTTP authentication using GSSAPI (benefits
>  > Unix-like platforms including Linux and OS X)."
>  > 
>  > Single sign on rules.
>  
>  Have you even looked at the Mozilla in FC3?  The negotiateauth component
>  is present and... 
Yes, I examined mozilla-1.7.2-0.3.0.src.rpm snagged from rawhide
yesterday.

The --with-gssapi configuration option was missing in the spec for the
configure invocation and ldd showed no gssapi/krb libraries.

After further checking today it appears that --with-gssapi is the
default, and either dlopen is used or mozilla is statically linked
against the gssapi/kerb libraries.

Sorry, my bad.

Dax

[Christopher Aillon]

Dax Kelson wrote:

> One of the new features of Mozilla 1.7 touted in the release notes
> is:
>
> "Support for Kerberos HTTP authentication using GSSAPI (benefits
> Unix-like platforms including Linux and OS X)."
>
> Single sign on rules. 
>
> Whats needed is the addition of --with-gssapi in the spec along with
> adding krb5-devel to the BuildReq line.
>   
>  
The --with-gssapi configure flag is only required if you have a 
non-standard header location, or some weird setup as on SuSE.  From what 
I understand though, even that is broken so the flag will be getting 
work done on it soon.

The negotiateauth extension is enabled for both our Mozilla and Firefox 
packages, and has been working for me when I used it in the past.  Is 
there a specific case where it breaks for you?  If so, that would be a bug.