| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 1211 | RackTables | default | public | 2014-04-08 07:54 | 2014-10-06 14:35 |
| Reporter | hc | Assigned To | |||
| Priority | normal | Severity | major | Reproducibility | always |
| Status | acknowledged | Resolution | open | ||
| OS | Linux | ||||
| Product Version | 0.20.7 | ||||
| Summary | 1211: Kerberos authentication via httpd will not work because of '@' sign prohibitede in username | ||||
| Description | Hi! I'm trying to set up Kerberos authentication. I changed secret.php this way: $user_auth_src = 'httpd'; $require_local_account = FALSE; After that I tried to log in and got next result (screenshot attached) When I tried to add "allow {$userhame_hc@GSK.LOC}" directive to permissions, I had no success because of @-sign. Without it rule can be added, but makes no sence. | ||||
| Tags | No tags attached. | ||||
 |
I understand the problem but don't have a good solution for it at the moment. |
 |
Hi, I guess you're using mod_auth_kerb on Apache? How about setting KrbLocalUserMapping On (available since version 5.4 IIRC). If the version is too old for that and my guess about Apache is correct, maybe you can install the mod_map_user module and put something like that MapUsernameRule x(.*)@(.*) "$1" in the configuration? Best regards Max |
|
|
Do users authenticate within only one domain? |
 |
Barbarossa, thanks for the proposal, will test it now infrastation, yes, users authenticate from only one domain. It's some kind of workaround, but I think it should work for 60-70% of cases |
|
|
Barbarossa, thanks, the solution with KrbLocalUserMapping works! infrastation, why not just exclude @ from prohibited symbols in 'allow' directive? |
 |
Could a solution be something like rewriting the username if it contains an "@" by replacing it with something like "(at)". We have been using another piece of software where we had to manually add a few lines that would take the username attribute from our CAS solution and rewrite it from "user@dom.ai.n" to "user(at)dom.ai.n". In other solutions we were forced to use "_" og "-" instead of "\" or "@" when authenticating against our AD. It is a hack of sorts but it would possible to handle. |
