Kerberos

Authentication

Users

Password

✔

Presentation

Kerberos is a network authentication protocol used for authenticating users based on their desktop session.

LL::NG uses GSSAPI module to validate Kerberos ticket against a local keytab.

LL::NG Configuration

In Manager, go in General Parameters > Authentication modules and choose Kerberos for authentication. Then go to “Kerberos parameters” and configure the following parameters:

  • Keytab file (required): the Kerberos keytab file (see below.)

  • Use Ajax request: set to “enabled” if you want to use an Ajax request instead of a direct Kerberos attempt. This is required if you want to chain Kerberos in a combination

  • Kerberos authentication level: default to 3

  • Remove domain in username: set to “enabled” to strip username value and remove the ‘@domain’.

  • Allowed domains: if set, tickets will only be accepted if they come from one of the domains listed here. This is a space-separated list. This feature can be useful when using combination and cross-realm Kerberos trusts.

Attention

  • Due to a perl GSSAPI issue, you may need to copy the keytab in /etc/krb5.keytab which is the default location hardcoded in the library

Obtaining the Keytab

Configuring your environment (Windows domain, workstations, etc) and obtaining a keytab for LemonLDAP::NG is quite complex. You can find some guidance on this page.