SID-02237: Authentication against Windows 2012AD from Linux install

Status:	Answered	TWiki version:	6.0.2	Perl version:
Category:	CategoryAuthentication	Server OS:	Debian 8	Last update:	10 years ago

Hello

Pretty new here so please bear with me.

I'd like to setup a Twiki instance (latest version on Debian) which would authenticate against our windows server2012r2.

what would be the best practice in doing so ?

I see that there is a lot of question / information on the topic, but most is 8-10 year old...

Did I miss the current, up to date and hopefully easy way to do this ?

-- Alexandre Takacs - 2016-08-09

Discussion and Answer

I'd guess that the recipe from ten years ago still works (it does for me)... It is just less cumbersome than it was back then.

• I guess you're using Apache as web server? If so, install libapache2-mod-auth-kerb. If you use Debian's a2enmod command to activate the module, you don't have to fiddle with Apache config files at all.
  • An introduction and configuration guide for mod_auth_kerb is here: http://modauthkerb.sourceforge.net. Note that with Debian there is no need to reconfigure or recompile Apache. The Debian packages "just work".
• Install either MIT (krb5-user, krb5-config) or Heimdal (heimdal-clients) Kerberos. You need the client packages.
  • In today's Windows ecosystems, you should not need to ever fiddle with krb5.conf. In the past 10 years, the practice of asking DNS where the Kerberos servers are has been widely adopted (See https://technet.microsoft.com/en-us/library/cc961719.aspx for an Article dating back to Win2000).
• For your Debian machine, get a "service account" in Active Directory. You need support by Windows admins for that.
  • The command you need the Windows admins to enter is described here: https://technet.microsoft.com/en-us/library/cc753771%28v=ws.11%29.aspx. The output file of that command needs to be used as Krb5Keytab in the modauthkerb configuration (which goes into the TWiki section of Apache config).

If you use the KrbMethodNegotiate feature of modauthkerb, your users don't have to enter their password to identify, which is really convenient. Apache does not have to contact the domain controller for every request, so it is pretty fast, too. Plus, from Linux desktops you can still access TWiki with the same account if the Linux users say kinit to their computer, using their domain userid and password. That's a big plus over all the NTLM stuff.

If you for whatever reason need to fall back to KrbMethodK5Passwd, then serving TWiki over HTTPS is a must. That's the domain password going over the network which is used for a lot of other things and not just for TWiki.

A lot of background for the Apache/Kerberos/Windows combination can be found at http://www.grolmsnet.de/kerbtut/, but indeed, it has not been updated since five years. I admit that I haven't touched my installation since several years, too

There are two gotchas to keep in mind:

• Windows login is case-insensitive, TWiki's isn't. If your windows user ids contain innovative mIxEdcAse strings there might be dragons. I think making case insensitivity configurable was a feature under discussion for TWiki some years ago but apparently it hasn't made it into a release.
• TWiki unfortunately shows Kerberos principals as Mail addresses because they have a similar syntax. I seem to recall that there's a plugin to cover for that, but have to admit that I simply patched TWiki to cover that.

A totally different approach (with which I am not familiar at all) is using LDAP, another protocol supported by both Apache and Windows domain controllers. It is slower (because TWiki needs to query the LDAP server for every login) and less convenient (because users need to enter the password), but has benefits if you want to use Active Directory groups in TWiki.

-- Harald Jörg - 2016-08-09

I did a number of AD based LDAP integrations using the LdapContrib. This works well for Linux-based TWiki installations. Logged-in users are tracked by session, e.g. browsing after login is as fast as with a TWiki internal password manager.

-- Peter Thoeny - 2016-08-10

If you answer a question - or someone answered one of your questions - please remember to edit the page and set the status to answered. The status selector is below the edit box.