We are trying to get our web based apps to accept Windows credentials
from the browser, but I figured out that I need an add-on module for
Apache (IHS). We have successfully used Centrify's apache module to
talk to their client, but that just seems like way too much overhead
to pass a set of credentials through the web server from a browser. I
haven't been able to build the mod_auth_kerb module successfully,
because it doesn't like IBM kerberos libraries. Has anybody else done
this?

Thank you so much in advance.

Scott <scottg480@hotmail.com> wrote:
> We are trying to get our web based apps to accept Windows credentials
> from the browser, but I figured out that I need an add-on module for
> Apache (IHS). We have successfully used Centrify's apache module to
> talk to their client, but that just seems like way too much overhead
> to pass a set of credentials through the web server from a browser. I
> haven't been able to build the mod_auth_kerb module successfully,
> because it doesn't like IBM kerberos libraries. Has anybody else done
> this?

Try using MIT krb5 instead of the IBM libs.

What errors do you get when using the IBM libs?

<<CDC

On Jul 21, 8:05 pm, "Christopher D. Clausen" <cclau...@acm.org> wrote:
> Scott <scottg...@hotmail.com> wrote:
> > We are trying to get our web based apps to accept Windows credentials
> > from the browser, but I figured out that I need an add-on module for
> > Apache (IHS). We have successfully used Centrify's apache module to
> > talk to their client, but that just seems like way too much overhead
> > to pass a set of credentials through the web server from a browser. I
> > haven't been able to build the mod_auth_kerb module successfully,
> > because it doesn't like IBM kerberos libraries. Has anybody else done
> > this?
>
> Try using MIT krb5 instead of the IBM libs.
>
> What errors do you get when using the IBM libs?
>
> <<CDC

At the tail end of the configure script I get:

checking for krb5_init_context in -lkrb5... no
checking for krb5_init_context in -lkrb5... (cached) no
checking for krb5_init_context in -lkrb5... (cached) no
configure: error: No Kerberos enviroment found

My configure command is:

CONFIG_SHELL=/usr/local/bin/bash CC=xlc ./configure --with-krb5=/usr/
krb5 --with-apache=/usr/local/apache2 --without-krb4

Scott <scottg480@hotmail.com> wrote:
> On Jul 21, 8:05 pm, "Christopher D. Clausen" <cclau...@acm.org> wrote:
>> Scott <scottg...@hotmail.com> wrote:
>>> We are trying to get our web based apps to accept Windows
>>> credentials from the browser, but I figured out that I need an
>>> add-on module for Apache (IHS). We have successfully used
>>> Centrify's apache module to talk to their client, but that just
>>> seems like way too much overhead to pass a set of credentials
>>> through the web server from a browser. I haven't been able to
>>> build the mod_auth_kerb module successfully, because it doesn't
>>> like IBM kerberos libraries. Has anybody else done this?
>>
>> Try using MIT krb5 instead of the IBM libs.
>>
>> What errors do you get when using the IBM libs?
>
> At the tail end of the configure script I get:
>
> checking for krb5_init_context in -lkrb5... no
> checking for krb5_init_context in -lkrb5... (cached) no
> checking for krb5_init_context in -lkrb5... (cached) no
> configure: error: No Kerberos enviroment found
>
> My configure command is:
>
> CONFIG_SHELL=/usr/local/bin/bash CC=xlc ./configure --with-krb5=/usr/
> krb5 --with-apache=/usr/local/apache2 --without-krb4

Oh, using xlc... I've had problems compiling MIT Kerberos with non-gcc.
Can you try with gcc? And do you actually have libkrb5 and krb5.h
files?

I'd still recomend trying with MIT Kerberos.

<<CDC

On Jul 29, 1:42 am, "Christopher D. Clausen" <cclau...@acm.org> wrote:
> Scott <scottg...@hotmail.com> wrote:
> > On Jul 21, 8:05 pm, "Christopher D. Clausen" <cclau...@acm.org> wrote:
> >> Scott <scottg...@hotmail.com> wrote:
> >>> We are trying to get our web based apps to accept Windows
> >>> credentials from the browser, but I figured out that I need an
> >>> add-on module for Apache (IHS). We have successfully used
> >>> Centrify's apache module to talk to their client, but that just
> >>> seems like way too much overhead to pass a set of credentials
> >>> through the web server from a browser. I haven't been able to
> >>> build the mod_auth_kerb module successfully, because it doesn't
> >>> like IBM kerberos libraries. Has anybody else done this?
>
> >> Try using MIT krb5 instead of the IBM libs.
>
> >> What errors do you get when using the IBM libs?
>
> > At the tail end of the configure script I get:
>
> > checking for krb5_init_context in -lkrb5... no
> > checking for krb5_init_context in -lkrb5... (cached) no
> > checking for krb5_init_context in -lkrb5... (cached) no
> > configure: error: No Kerberos enviroment found
>
> > My configure command is:
>
> > CONFIG_SHELL=/usr/local/bin/bash CC=xlc ./configure --with-krb5=/usr/
> > krb5 --with-apache=/usr/local/apache2 --without-krb4
>
> Oh, using xlc... I've had problems compiling MIT Kerberos with non-gcc.
> Can you try with gcc? And do you actually have libkrb5 and krb5.h
> files?
>
> I'd still recomend trying with MIT Kerberos.
>
> <<CDC- Hide quoted text -
>
> - Show quoted text -

Tried to compile MIT Kerberos. I am getting this:

make[3]: Entering directory `/scratch/krb5-1.6.2/src/lib/rpc/unit-
test'
gcc -I../../../include -I./../../../include -I. -DKRB5_DEPRECATED=1 -
DKRB5_PRIVATE=1 -g -O2 -Wall -Wmissing-prototypes -Wcast-qual -Wcast-
align -Wconversion -Wshadow -pedantic -D_THREAD_SAFE -c client.c
client.c:9: warning: 'rcsid' defined but not used
gcc -I../../../include -I./../../../include -I. -DKRB5_DEPRECATED=1 -
DKRB5_PRIVATE=1 -g -O2 -Wall -Wmissing-prototypes -Wcast-qual -Wcast-
align -Wconversion -Wshadow -pedantic -D_THREAD_SAFE -c
rpc_test_clnt.c
gcc -L../../../lib -Wl,-blibpath:/usr/local/lib::/usr/lib:/lib -g -O2 -
Wall -Wmissing-prototypes -Wcast-qual -Wcast-align -Wconversion -
Wshadow -pedantic -D_THREAD_SAFE -o client client.o rpc_test_clnt.o
\
-lgssrpc -lgssapi_krb5 -lkrb5 -lk5crypto -lcom_err -
lkrb5support -lpthreads
ld: 0706-006 Cannot find or open library file: -l k5crypto
ldpen(): A file or directory in the path name does not
exist.
ld: 0706-006 Cannot find or open library file: -l com_err
ldpen(): A file or directory in the path name does not
exist.
ld: 0706-006 Cannot find or open library file: -l krb5support
ldpen(): A file or directory in the path name does not
exist.
collect2: ld returned 255 exit status
make[3]: *** [client] Error 1
make[3]: Leaving directory `/scratch/krb5-1.6.2/src/lib/rpc/unit-test'
make[2]: *** [all-recurse] Error 1
make[2]: Leaving directory `/scratch/krb5-1.6.2/src/lib/rpc'
make[1]: *** [all-recurse] Error 1
make[1]: Leaving directory `/scratch/krb5-1.6.2/src/lib'
make: *** [all-recurse] Error 1
Even when I use the "configure" line of "LD=/usr/local/bin/ld
CONFIG_SHELL=/usr/local/bin/bash CC=gcc ./configure --without-krb4"

It still wants to use the AIX linker.