SPNEGO使用了错误的KRBTGT主体名称

Question

我正在尝试为我们的网站启用Kerberos身份验证-这个想法是让用户登录到Windows AD域获得自动登录（和初始帐户创建）

在我处理Windows方面的问题之前，我想让它在本地工作。因此，我使用[e-mail]：ist dsi/docker kerberos。吉特

Web服务器位于本地docker容器中，其中编译了nginx和spnego模块。KDC/KADMIN容器172.17.0.2，可从我的Web服务器容器访问。

这是我当地的krb。形态：

default_realm = SERVER.LOCAL

[realms]
SERVER.LOCAL = {
                kdc_ports = 88,750
                kadmind_port = 749
                kdc = 172.17.0.2:88
                admin_server = 172.17.0.2:749
        }

[domain_realms]
  .server.local = SERVER.LOCAL
  server.local = SERVER.LOCAL

还有krb。Web服务器容器上的conf

[libdefaults]
  default_realm = SERVER.LOCAL
  default_keytab_name  = FILE:/etc/krb5.keytab
  ticket_lifetime      = 24h
  kdc_timesync         = 1
  ccache_type          = 4
  forwardable          = false
  proxiable            = false

[realms]
  LOCALHOST.LOCAL = {
    kdc_ports = 88,750
    kadmind_port = 749
    kdc = 172.17.0.2:88
    admin_server = 172.17.0.2:749
  }

[domain_realms]
  .server.local = SERVER.LOCAL
  server.local = SERVER.LOCAL

这是主体和keytab配置（keytab被复制到 /etc/krb5.keytab下的web容器）

rep ~/project * rep_krb_test $ kadmin -p kadmin/[e-mail] -w hunter2
Authenticating as principal kadmin/[e-mail] with password.
kadmin:  list_principals
K/[e-mail]
kadmin/[e-mail]
kadmin/[e-mail]
kadmin/[e-mail]
krbtgt/[e-mail]
[e-mail]
[e-mail]
kadmin:  q

rep ~/project * rep_krb_test $ ktutil
ktutil:  addent -password -p [e-mail] -k 1 -f
Password for [e-mail]:
ktutil:  wkt krb5.keytab
ktutil:  q

rep ~/project * rep_krb_test $ kinit -C -p [e-mail]
Password for [e-mail]:

rep ~/project * rep_krb_test $ klist
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: [e-mail]

Valid starting     Expires            Service principal
02/07/20 04:27:44  03/07/20 04:27:38  krbtgt/[e-mail]

相关的nginx配置：

server {

  location / {
    uwsgi_pass  django;
    include     /usr/lib/proj/lib/wsgi/uwsgi_params;

    auth_gss on;
    auth_gss_realm SERVER.LOCAL;
    auth_gss_service_name HTTP;
  }
}

最后，etc/主机

# use alternate local IP address
127.0.0.2 server.local server

现在，我尝试使用curl访问此项：

*   Trying 127.0.0.2:80...
* Connected to server.local (127.0.0.2) port 80 (#0)
* gss_init_sec_context() failed: Server krbtgt/[e-mail] not found in Kerberos database.
* Server auth using Negotiate with user ''
> GET / HTTP/1.1
> Host: server.local
> User-Agent: curl/7.71.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
....

正如您所看到的，它正在尝试使用SPN“krbtgt/[e-mail]而kinit有“krbtgt/SERVER”。[e-mail]“作为SPN

我怎样才能让它工作？

提前感谢...

Answer 1

所以我需要

auth_gss_service_name HTTP/server.local;

遇到问题的其他提示：

1. 确保keytab文件可被用户www数据或任何用户的Web服务器进程读取
2. 确保keytab主体的顺序正确
3. 使用exportKRB5_TRACE=/dev/stderr和curl来测试-kerberos给出了它正在做什么以及失败原因的非常详细的日志