Re: [modauthkerb] Apache multiauth with mod_auth_kerb

[Bernd M. <be...@ne...>]

Hey,

On 02.09.2013 14:45, Martin Yves wrote:
> On Mon, 2013-09-02 at 14:21 +0200, Bernd May wrote:
> As a result, I think you cannot implement a "OR" behavior. SSL
> authentication will be required in any case, as far as you use the same
> listening port for HTTPS.

I tested around with various combinations of SSLVerifyClient
(require|optional) and require (all allow|valid_user) and activated
mod_auth_kerb with AuthType Kerberos and got the following responses.

SSLVerifyClient Optional
AuthType Kerberos
KrbMethodK5Passwd off
KrbMethodNegotiate on
require valid_user
...

Using an old svn 1.6.9 client I can access the repository both with and
without a client certificate as long as I have a valid kerberos ticket.

Setting _SSLVerifyClient require_ requires both ticket and cert to get
access while removing the 'require valid_user' removes mod_auth_kerb
completely from the picture, i.e. I do not even get a request for my
client kerberos ticket.

Using an svn 1.6.17 client resulted in weird ssl parsing errors (I
suspect libneon, gnutls and some other stuff), using svn 1.7.13 worked
with both kerberos ticket and ssl cert and with kerberos ticket only

Using svn 1.8.1 client did not work with kerberos at all (svn: E120191:
Error running context: The requested authentication type(s) are not
supported) but worked fine just with SSL client certs, though I had to
remove the 'require valid_user' directive

TL;DR
SSL_Client_Cert/Kerberos Ticket works with svn 1.6.9 and svn 1.7.13
-/Kerberos Ticket works with svn 1.6.9, 1.6.16 and 1.7.13
SSL_Client_Cert/- works with all svn versions *But* only when 'require
valid_user' is commented out and then mod_auth_kerb is not called at all
even though the rest is configured


So I guess I will bury my idea of kerberos authentication for SVN until
lib_serf has developed far enough to actually support SPNEGO or I have
convinced everyone here to move to git and use gitolite :-/


thanks for the help though
-- 
Technische Universität Berlin - FGINET

Bernd May

System Administration
Sekr. TEL 16
Ernst-Reuter-Platz 7
10587 BERLIN
GERMANY

Mobile: 0160/90257737
E-Mail: be...@in...
WWW:    inet.tu-berlin.de