Basic auth fallback authentication without REALM #255

glorang · 2021-08-19T15:48:20Z

glorang
Aug 19, 2021

Now that Bullseye has landed we're switching from mod-auth-kerb to mod-auth-gssapi, at first sight everything works great, the only thing I cannot get to work is authentication without the REALM when using fallback basic auth.

e.g. DOMAIN\username, username@DOMAIN.COM and firstname.lastname@domain.com all work but I cannot get "username" to work.

Does it not take default_realm into account from krb5.conf's libdefaults ?
Our (simplified) krb5.conf:

[libdefaults]
        default_realm = DOMAIN.COM
        rdns = false

[realms]
        DOMAIN.COM = {
                kdc = server1.domain.com
                admin_server = server1.domain.com
        }

[domain_realm]
        domain.com = DOMAIN.COM
        .domain.com = DOMAIN.COM

In mod-auth-kerb we used to have:

AuthType Kerberos
AuthName "DOMAIN AD"
Krb5Keytab /etc/krb5.keytab
KrbServiceName host/server.domain.com
KrbLocalUserMapping on
KrbMethodNegotiate on
KrbMethodK5Passwd on
Require valid-user

In mod-auth-gssapi now we have

AuthType GSSAPI
AuthName "DOMAIN AD"
GssapiCredStore keytab:/etc/krb5.keytab
GssapiBasicAuth On
GssapiLocalName On
Require valid-user

When authenticating without REALM, error that is seen:

[Thu Aug 19 17:23:06.764284 2021] [auth_gssapi:error] [pid 261679] [client X.X.X.X:54259] GSS ERROR In Negotiate Auth: gss_accept_sec_context() failed: [An unsupported mechanism was requested (Unknown error)]

Any idea ? Many thanks and apologies if this is something straightforward I missed in the docs!

simo5 · 2021-10-20T13:16:07Z

simo5
Oct 20, 2021
Maintainer

The error you report means the client couldn't work out a ticket for the service and tried to fallback to NTLMSSP, which your GSSAPI has no support for.
You need to find out why the client can't acquire a proper ticket first.

7 replies

simo5 Oct 20, 2021
Maintainer

And this, you say, seem to work with mod_auth_krb ?

simo5 Oct 20, 2021
Maintainer

So when you say " which does work great when using DOMAIN\username ", do you mean that if the user types DOMAIN\username in the browser dialog box, then the browser will send basic auth credentials and mod_auth_gssapi successfully verifies then, but when a user types only "username" then the browser fails to send basic auth authentication?

glorang Oct 20, 2021
Author

Yes, exactly this.

simo5 Oct 20, 2021
Maintainer

If it work with mod_auth_kerb but not with mod_auth_gssapi I would love if you could take connection traces with both so I can see what are the differences and see if there is anything I can do in mod_auth_gssapi to help covering this gap.

glorang Oct 21, 2021
Author

Ok, so unfortunately the problem became very complicated with many different scenarios and errors :-\

In some cases username works, in some other DOMAIN\username , username@DOMAIN.COM seems to work in all scenarios. In the end we're only interested in getting username to work.

From my testing, this is the summary:

Scenario 1 - Firefox with mod_auth_kerb:

username works from first attempt
DOMAIN\username does not work

Scenario 2 - Firefox with mod_auth_gssapi:

username works from first attempt
DOMAIN\username does not work

Scenario 3 - Chrome with mod_auth_kerb:

username works from second attempt
DOMAIN\username works on first attempt

Scenario 4 - Chrome with mod_auth_gssapi:

username does not work at all
DOMAIN\username works on first attempt

This is the debug log:

Scenario 3 - Chrome with mod_auth_kerb - using username first attempt (does not work):

[Thu Oct 21 17:42:26.445673 2021] [auth_kerb:debug] [pid 32291] src/mod_auth_kerb.c(1963): [client A.B.C.D:55787] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos
[Thu Oct 21 17:42:33.965561 2021] [auth_kerb:debug] [pid 32318] src/mod_auth_kerb.c(1963): [client A.B.C.D:49581] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos
[Thu Oct 21 17:42:33.970977 2021] [auth_kerb:debug] [pid 32318] src/mod_auth_kerb.c(1963): [client A.B.C.D:49581] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos
[Thu Oct 21 17:42:33.971174 2021] [auth_kerb:debug] [pid 32318] src/mod_auth_kerb.c(1296): [client A.B.C.D:49581] Acquiring creds for host/kerb.domain.com
[Thu Oct 21 17:42:33.976648 2021] [auth_kerb:debug] [pid 32318] src/mod_auth_kerb.c(1719): [client A.B.C.D:49581] Verifying client data using KRB5 GSS-API
[Thu Oct 21 17:42:33.976833 2021] [auth_kerb:debug] [pid 32318] src/mod_auth_kerb.c(1735): [client A.B.C.D:49581] Client didn't delegate us their credential
[Thu Oct 21 17:42:33.976946 2021] [auth_kerb:debug] [pid 32318] src/mod_auth_kerb.c(1763): [client A.B.C.D:49581] Warning: received token seems to be NTLM, which isn't supported by the Kerberos module. Check your IE configuration.
[Thu Oct 21 17:42:33.977109 2021] [auth_kerb:debug] [pid 32318] src/mod_auth_kerb.c(1156): [client A.B.C.D:49581] GSS-API major_status:00010000, minor_status:00000000
[Thu Oct 21 17:42:33.977307 2021] [auth_kerb:error] [pid 32318] [client A.B.C.D:49581] gss_accept_sec_context() failed: An unsupported mechanism was requested (, Unknown error)

Scenario 3 - Chrome with mod_auth_kerb - using username second attempt (works):

[Thu Oct 21 17:43:06.540517 2021] [auth_kerb:debug] [pid 32294] src/mod_auth_kerb.c(1963): [client A.B.C.D:54670] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos
[Thu Oct 21 17:43:06.541743 2021] [auth_kerb:debug] [pid 32294] src/mod_auth_kerb.c(1046): [client A.B.C.D:54670] Using host/kerb.domain.com@DOMAIN.COM as server principal for password verification
[Thu Oct 21 17:43:06.541885 2021] [auth_kerb:debug] [pid 32294] src/mod_auth_kerb.c(752): [client A.B.C.D:54670] Trying to get TGT for user glorang@DOMAIN.COM
[Thu Oct 21 17:43:06.565880 2021] [auth_kerb:debug] [pid 32294] src/mod_auth_kerb.c(662): [client A.B.C.D:54670] Trying to verify authenticity of KDC using principal host/kerb.domain.com@DOMAIN.COM
[Thu Oct 21 17:43:06.576537 2021] [auth_kerb:debug] [pid 32294] src/mod_auth_kerb.c(1128): [client A.B.C.D:54670] kerb_authenticate_user_krb5pwd ret=0 user=glorang@DOMAIN.COM authtype=Basic
[Thu Oct 21 17:43:06.577267 2021] [auth_kerb:debug] [pid 32294] src/mod_auth_kerb.c(1869): [client A.B.C.D:54670] kerb_authenticate_a_name_to_local_name glorang@DOMAIN.COM -> glorang
[Thu Oct 21 17:43:06.577766 2021] [auth_kerb:debug] [pid 32294] src/mod_auth_kerb.c(1963): [client A.B.C.D:54670] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos
[Thu Oct 21 17:43:06.577861 2021] [auth_kerb:debug] [pid 32294] src/mod_auth_kerb.c(1901): [client A.B.C.D:54670] matched previous auth request
[Thu Oct 21 17:43:06.578480 2021] [auth_kerb:debug] [pid 32294] src/mod_auth_kerb.c(1869): [client A.B.C.D:54670] kerb_authenticate_a_name_to_local_name glorang@DOMAIN.COM -> glorang
[Thu Oct 21 17:43:06.603742 2021] [auth_kerb:debug] [pid 32294] src/mod_auth_kerb.c(1963): [client A.B.C.D:54670] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos, referer: https://kerb.company.com/
[Thu Oct 21 17:43:06.603940 2021] [auth_kerb:debug] [pid 32294] src/mod_auth_kerb.c(1901): [client A.B.C.D:54670] matched previous auth request, referer: https://kerb.company.com/
[Thu Oct 21 17:43:06.604852 2021] [auth_kerb:debug] [pid 32294] src/mod_auth_kerb.c(1869): [client A.B.C.D:54670] kerb_authenticate_a_name_to_local_name glorang@DOMAIN.COM -> glorang, referer: https://kerb.company.com/
[Thu Oct 21 17:43:06.671430 2021] [auth_kerb:debug] [pid 32294] src/mod_auth_kerb.c(1963): [client A.B.C.D:54670] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos, referer: https://kerb.company.com/
[Thu Oct 21 17:43:06.671665 2021] [auth_kerb:debug] [pid 32294] src/mod_auth_kerb.c(1901): [client A.B.C.D:54670] matched previous auth request, referer: https://kerb.company.com/
[Thu Oct 21 17:43:06.672630 2021] [auth_kerb:debug] [pid 32294] src/mod_auth_kerb.c(1869): [client A.B.C.D:54670] kerb_authenticate_a_name_to_local_name glorang@DOMAIN.COM -> glorang, referer: https://kerb.company.com/

Scenario 4 - Chrome with mod_auth_gssapi - using username (does not work) - the error remains the same for every subsequent request:

[Thu Oct 21 17:44:19.570269 2021] [auth_gssapi:debug] [pid 3734291] mod_auth_gssapi.c(904): [client A.B.C.D:61927] URI: /hg/, no main, no prev
[Thu Oct 21 17:44:19.570300 2021] [auth_gssapi:info] [pid 3734291] [client A.B.C.D:61927] NO AUTH DATA Client did not send any authentication headers
[Thu Oct 21 17:44:26.750260 2021] [auth_gssapi:debug] [pid 3734287] mod_auth_gssapi.c(904): [client A.B.C.D:52749] URI: /hg/, no main, no prev
[Thu Oct 21 17:44:26.750282 2021] [auth_gssapi:info] [pid 3734287] [client A.B.C.D:52749] NO AUTH DATA Client did not send any authentication headers
[Thu Oct 21 17:44:26.754748 2021] [auth_gssapi:debug] [pid 3734287] mod_auth_gssapi.c(904): [client A.B.C.D:52749] URI: /hg/, no main, no prev
[Thu Oct 21 17:44:26.763875 2021] [auth_gssapi:error] [pid 3734287] [client A.B.C.D:52749] GSS ERROR In Negotiate Auth: gss_accept_sec_context() failed: [An unsupported mechanism was requested (Unknown error)]

Scenario 4 - Chrome with mod_auth_gssapi - using DOMAIN\username (works):

[Thu Oct 21 17:45:33.581577 2021] [auth_gssapi:debug] [pid 3734309] mod_auth_gssapi.c(904): [client A.B.C.D:62756] URI: /hg/, no main, no prev
[Thu Oct 21 17:45:33.581597 2021] [auth_gssapi:info] [pid 3734309] [client A.B.C.D:62756] NO AUTH DATA Client did not send any authentication headers
[Thu Oct 21 17:45:33.709749 2021] [auth_gssapi:debug] [pid 3734309] mod_auth_gssapi.c(904): [client A.B.C.D:62756] URI: /hg/, no main, no prev
[Thu Oct 21 17:45:33.714069 2021] [auth_gssapi:debug] [pid 3734309] mod_auth_gssapi.c(737): [client A.B.C.D:62756] GSSapiImpersonate not On, skipping impersonation.
[Thu Oct 21 17:45:34.170590 2021] [auth_gssapi:debug] [pid 3734309] mod_auth_gssapi.c(904): [client A.B.C.D:62756] URI: /hg/static/style-gitweb.css, no main, no prev, referer: https://gssapi.company.com/hg/
[Thu Oct 21 17:45:34.170602 2021] [auth_gssapi:info] [pid 3734309] [client A.B.C.D:62756] NO AUTH DATA Client did not send any authentication headers, referer: https://gssapi.company.com/hg/
[Thu Oct 21 17:45:34.195245 2021] [auth_gssapi:debug] [pid 3734309] mod_auth_gssapi.c(904): [client A.B.C.D:62756] URI: /hg/static/style-gitweb.css, no main, no prev, referer: https://gssapi.company.com/hg/
[Thu Oct 21 17:45:34.197250 2021] [auth_gssapi:debug] [pid 3734309] mod_auth_gssapi.c(737): [client A.B.C.D:62756] GSSapiImpersonate not On, skipping impersonation., referer: https://gssapi.company.com/hg/
[Thu Oct 21 17:45:34.197475 2021] [auth_gssapi:debug] [pid 3734309] mod_auth_gssapi.c(737): [client A.B.C.D:62756] GSSapiImpersonate not On, skipping impersonation., referer: https://gssapi.company.com/hg/
[Thu Oct 21 17:45:34.197934 2021] [auth_gssapi:debug] [pid 3734290] mod_auth_gssapi.c(904): [client A.B.C.D:64156] URI: /hg/static/mercurial.js, no main, no prev, referer: https://gssapi.company.com/hg/
[Thu Oct 21 17:45:34.197962 2021] [auth_gssapi:info] [pid 3734290] [client A.B.C.D:64156] NO AUTH DATA Client did not send any authentication headers, referer: https://gssapi.company.com/hg/
[Thu Oct 21 17:45:34.199639 2021] [auth_gssapi:debug] [pid 3734290] mod_auth_gssapi.c(904): [client A.B.C.D:64156] URI: /hg/static/mercurial.js, no main, no prev, referer: https://gssapi.company.com/hg/
[Thu Oct 21 17:45:34.201683 2021] [auth_gssapi:debug] [pid 3734290] mod_auth_gssapi.c(737): [client A.B.C.D:64156] GSSapiImpersonate not On, skipping impersonation., referer: https://gssapi.company.com/hg/
[Thu Oct 21 17:45:34.201960 2021] [auth_gssapi:debug] [pid 3734290] mod_auth_gssapi.c(737): [client A.B.C.D:64156] GSSapiImpersonate not On, skipping impersonation., referer: https://gssapi.company.com/hg/
[Thu Oct 21 17:45:34.519471 2021] [auth_gssapi:debug] [pid 3734309] mod_auth_gssapi.c(904): [client A.B.C.D:62756] URI: /hg/static/hgicon.png, no main, no prev, referer: https://gssapi.company.com/hg/
[Thu Oct 21 17:45:34.519505 2021] [auth_gssapi:info] [pid 3734309] [client A.B.C.D:62756] NO AUTH DATA Client did not send any authentication headers, referer: https://gssapi.company.com/hg/
[Thu Oct 21 17:45:34.546179 2021] [auth_gssapi:debug] [pid 3734309] mod_auth_gssapi.c(904): [client A.B.C.D:62756] URI: /hg/static/hgicon.png, no main, no prev, referer: https://gssapi.company.com/hg/
[Thu Oct 21 17:45:34.548474 2021] [auth_gssapi:debug] [pid 3734309] mod_auth_gssapi.c(737): [client A.B.C.D:62756] GSSapiImpersonate not On, skipping impersonation., referer: https://gssapi.company.com/hg/
[Thu Oct 21 17:45:34.548675 2021] [auth_gssapi:debug] [pid 3734309] mod_auth_gssapi.c(737): [client A.B.C.D:62756] GSSapiImpersonate not On, skipping impersonation., referer: https://gssapi.company.com/hg/

Apologies if this is too confusing or complicated, I tried to explain it as clear as possible. Seeing it actually works in Firefox I'm unsure who or what is at fault here...
For us it's more to cover the rare edge cases but it might not be worth a lot of your (and mine) time.

I think the problem is somewhere in Chrome's code on how it handles the WWW-Authenticate headers. On the first request Apache responds with two WWW-Authenticate headers, One with value Negotiate and another with value Basic. When you enter your username and password here you'll get a new password prompt but this time with only one WWW-Authenticate header with value Basic.

Hope this helps in some way.

simo5 · 2021-10-21T16:55:16Z

simo5
Oct 21, 2021
Maintainer

It does help, however what would help even more is if you could dump what headers are sent/received by the two browsers during these calls rather than the log output of the modules.
Specifically if you could show me the difference in chrome between mod_auth_kerba nd mod_auth_gssapi I can try to make mod_auht_gssapi at least work on second attempt for username, if first attempt can't be worked out.

1 reply

glorang Oct 26, 2021
Author

Sure, I've captured all scenarios with mod_dumpio. Output is a bit trimmed for readability and confidentiality but nothing crucial should be lost.

Chrome - mod_auth_kerb - using username :

[Tue Oct 26 12:31:47.745623 2021] mod_dumpio:  dumpio_in (data-TRANSIENT): GET / HTTP/1.1\r\n
[Tue Oct 26 12:31:47.769788 2021] mod_dumpio:  dumpio_out (data-HEAP): HTTP/1.1 401 Unauthorized\r\nDate: Tue, 26 Oct 2021 10:31:47 GMT\r\nServer: Apache/2.4.38 (Debian)\r\nWWW-Authenticate: Negotiate\r\nWWW-Authenticate: Basic realm="DOMAIN AD"\r\nContent-Length: 470\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n
[Tue Oct 26 12:31:47.774752 2021] mod_dumpio:  dumpio_in (data-TRANSIENT): GET / HTTP/1.1\r\n
[Tue Oct 26 12:31:47.776413 2021] mod_dumpio:  dumpio_in (data-TRANSIENT): Authorization: Negotiate TlRMTVNTUAABAAAAl4II4gAAAAAAAAAAAAAAAAAAAAAGAbAdAAAADw==\r\n
[Tue Oct 26 12:31:47.793334 2021] mod_dumpio:  dumpio_out (data-HEAP): HTTP/1.1 401 Unauthorized\r\nDate: Tue, 26 Oct 2021 10:31:47 GMT\r\nServer: Apache/2.4.38 (Debian)\r\nWWW-Authenticate: Basic realm="DOMAIN AD"\r\nContent-Length: 470\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n
[Tue Oct 26 12:31:53.586844 2021] mod_dumpio:  dumpio_in (data-TRANSIENT): GET / HTTP/1.1\r\n
[Tue Oct 26 12:31:53.588586 2021] mod_dumpio:  dumpio_in (data-TRANSIENT): Authorization: Basic <base64 username:password>\r\n

Firefox - mod_auth_kerb - using username :

[Tue Oct 26 12:25:36.339648 2021] mod_dumpio:  dumpio_in (data-TRANSIENT): GET / HTTP/1.1\r\n
[Tue Oct 26 12:25:36.362098 2021] mod_dumpio:  dumpio_out (data-HEAP): HTTP/1.1 401 Unauthorized\r\nDate: Tue, 26 Oct 2021 10:25:36 GMT\r\nServer: Apache/2.4.38 (Debian)\r\nWWW-Authenticate: Negotiate\r\nWWW-Authenticate: Basic realm="DOMAIN AD"\r\nContent-Length: 470\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n
[Tue Oct 26 12:26:16.140712 2021] mod_dumpio:  dumpio_in (data-TRANSIENT): GET / HTTP/1.1\r\n
[Tue Oct 26 12:26:16.147483 2021] mod_dumpio:  dumpio_in (data-TRANSIENT): Authorization: Basic <base64 username:password>\r\n

Chrome - mod_auth_gssapi - using username :

[Tue Oct 26 12:43:01.453927 2021] mod_dumpio:  dumpio_in (data-TRANSIENT): GET /hg/ HTTP/1.1\r\n
[Tue Oct 26 12:43:01.457208 2021] auth_gssapi: NO AUTH DATA Client did not send any authentication headers
[Tue Oct 26 12:43:01.457522 2021] mod_dumpio:  dumpio_out (data-HEAP): HTTP/1.1 401 Unauthorized\r\nDate: Tue, 26 Oct 2021 10:43:01 GMT\r\nServer: Apache/2.4.51 (Debian)\r\nWWW-Authenticate: Negotiate\r\nWWW-Authenticate: Basic realm="DOMAIN AD"\r\nContent-Length: 465\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n
[Tue Oct 26 12:43:18.776299 2021] mod_dumpio:  dumpio_in (data-TRANSIENT): GET /hg/ HTTP/1.1\r\n
[Tue Oct 26 12:43:18.778459 2021] auth_gssapi: NO AUTH DATA Client did not send any authentication headers
[Tue Oct 26 12:43:18.778687 2021] mod_dumpio:  dumpio_out (data-HEAP): HTTP/1.1 401 Unauthorized\r\nDate: Tue, 26 Oct 2021 10:43:18 GMT\r\nServer: Apache/2.4.51 (Debian)\r\nWWW-Authenticate: Negotiate\r\nWWW-Authenticate: Basic realm="DOMAIN AD"\r\nContent-Length: 465\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n
[Tue Oct 26 12:43:18.780789 2021] mod_dumpio:  dumpio_in (data-TRANSIENT): GET /hg/ HTTP/1.1\r\n
[Tue Oct 26 12:43:18.781172 2021] mod_dumpio:  dumpio_in (data-TRANSIENT): Authorization: Negotiate TlRMTVNTUAABAAAAl4II4gAAAAAAAAAAAAAAAAAAAAAGAbAdAAAADw==\r\n
[Tue Oct 26 12:43:18.784727 2021] auth_gssapi: GSS ERROR In Negotiate Auth: gss_accept_sec_context() failed: [An unsupported mechanism was requested (Unknown error)]
[Tue Oct 26 12:43:18.785188 2021] mod_dumpio:  dumpio_out (data-HEAP): HTTP/1.1 401 Unauthorized\r\nDate: Tue, 26 Oct 2021 10:43:18 GMT\r\nServer: Apache/2.4.51 (Debian)\r\nWWW-Authenticate: Negotiate\r\nWWW-Authenticate: Basic realm="DOMAIN AD"\r\nContent-Length: 465\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n
[Tue Oct 26 12:43:24.331288 2021] mod_dumpio:  dumpio_in (data-TRANSIENT): GET /hg/ HTTP/1.1\r\n
[Tue Oct 26 12:43:24.332965 2021] auth_gssapi: NO AUTH DATA Client did not send any authentication headers
[Tue Oct 26 12:43:24.333113 2021] mod_dumpio:  dumpio_out (data-HEAP): HTTP/1.1 401 Unauthorized\r\nDate: Tue, 26 Oct 2021 10:43:24 GMT\r\nServer: Apache/2.4.51 (Debian)\r\nWWW-Authenticate: Negotiate\r\nWWW-Authenticate: Basic realm="DOMAIN AD"\r\nContent-Length: 465\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n
[Tue Oct 26 12:43:24.334428 2021] mod_dumpio:  dumpio_in (data-TRANSIENT): GET /hg/ HTTP/1.1\r\n
[Tue Oct 26 12:43:24.334905 2021] mod_dumpio:  dumpio_in (data-TRANSIENT): Authorization: Negotiate TlRMTVNTUAABAAAAl4II4gAAAAAAAAAAAAAAAAAAAAAGAbAdAAAADw==\r\n
[Tue Oct 26 12:43:24.337660 2021] auth_gssapi: GSS ERROR In Negotiate Auth: gss_accept_sec_context() failed: [An unsupported mechanism was requested (Unknown error)]

Firefox - mod_auth_gssapi - using username :

[Tue Oct 26 12:54:11.804977 2021] mod_dumpio:  dumpio_in (data-TRANSIENT): GET /hg/ HTTP/1.1\r\n
[Tue Oct 26 12:54:11.805996 2021] mod_dumpio:  dumpio_out (data-HEAP): HTTP/1.1 401 Unauthorized\r\nDate: Tue, 26 Oct 2021 10:54:11 GMT\r\nServer: Apache/2.4.51 (Debian)\r\nWWW-Authenticate: Negotiate\r\nWWW-Authenticate: Basic realm="DOMAIN AD"\r\nContent-Length: 465\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n
[Tue Oct 26 12:54:32.836791 2021] mod_dumpio:  dumpio_in (data-TRANSIENT): GET /hg/ HTTP/1.1\r\n
[Tue Oct 26 12:54:32.837865 2021] mod_dumpio:  dumpio_in (data-TRANSIENT): Authorization: Basic <base64 username:password>\r\n

Chrome - mod_auth_gssapi - using DOMAIN\username:

[Tue Oct 26 12:57:49.317791 2021] mod_dumpio:  dumpio_in (data-TRANSIENT): GET /hg/ HTTP/1.1\r\n
[Tue Oct 26 12:57:49.319159 2021] mod_dumpio:  dumpio_out (data-HEAP): HTTP/1.1 401 Unauthorized\r\nDate: Tue, 26 Oct 2021 10:57:49 GMT\r\nServer: Apache/2.4.51 (Debian)\r\nWWW-Authenticate: Negotiate\r\nWWW-Authenticate: Basic realm="DOMAIN AD"\r\nContent-Length: 465\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n
[Tue Oct 26 12:58:06.294858 2021] mod_dumpio:  dumpio_in (data-TRANSIENT): GET /hg/ HTTP/1.1\r\n
[Tue Oct 26 12:58:06.295829 2021] mod_dumpio:  dumpio_out (data-HEAP): HTTP/1.1 401 Unauthorized\r\nDate: Tue, 26 Oct 2021 10:58:06 GMT\r\nServer: Apache/2.4.51 (Debian)\r\nWWW-Authenticate: Negotiate\r\nWWW-Authenticate: Basic realm="DOMAIN AD"\r\nContent-Length: 465\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n
[Tue Oct 26 12:58:06.427911 2021] mod_dumpio:  dumpio_in (data-TRANSIENT): GET /hg/ HTTP/1.1\r\n
[Tue Oct 26 12:58:06.428058 2021] mod_dumpio:  dumpio_in (data-TRANSIENT): 5551 bytes
[Tue Oct 26 12:58:06.428066 2021] mod_dumpio:  dumpio_in (data-TRANSIENT): Authorization: Negotiate <5551 bytes long valid krb ticket in base64>
[Tue Oct 26 12:58:07.371671 2021] mod_dumpio:  dumpio_out (data-HEAP): HTTP/1.1 200 Script output follows\r\nDate: Tue, 26 Oct 2021 10:58:06 GMT\r\nServer: Apache/2.4.51 (Debian)\r\nWWW-Authenticate: Negotiate <krb ticket>\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nContent-Length: 1424\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n

From my understanding:

mod_auth_kerb removes the Negotiate header after the first failed attempt which allows Chrome to authenticate using Basic fallback on the second attempt
mod_auth_gssapi does not do this and hence Chrome stays in an authentication loop where it keeps on trying NTLMSSP which never succeeds
In all cases Firefox ignores the Negotiate header all together and is always using the Basic fallback, this is why it works from the first time

adamel · 2022-08-08T09:45:55Z

adamel
Aug 8, 2022

Has anyone gotten this to work yet?

1 reply

adamel Sep 9, 2022

Yes! Just add GssapiNegotiateOnce on to your config and it works.

LucidityCrash · 2022-09-09T12:28:34Z

LucidityCrash
Sep 9, 2022

I'm seeing exactly the same issue anyone got any ideas ?

1 reply

adamel Sep 9, 2022

Yes! Just add GssapiNegotiateOnce on to your config and it works.

LucidityCrash · 2022-09-10T08:35:27Z

LucidityCrash
Sep 10, 2022

I'm pretty sure I trried that it doesn't seem to work for my situation ... if kerb auth failed, which it does on non domain machines, then I thought it just stops and doesn't prompt for basic auth. But I tried lots of things so maybe I'm mistaken. I'll try again soon.

…

On Fri, 9 Sept 2022, 16:30 Marcus Sundberg, ***@***.***> wrote: Yes! Just add GssapiNegotiateOnce on to your config and it works. — Reply to this email directly, view it on GitHub <#255 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ALWZJKZCXNBFABH7OPJUY33V5NJ3HANCNFSM5COQH5GA> . You are receiving this because you commented.Message ID: ***@***.***>

0 replies

glorang · 2022-09-26T13:45:37Z

glorang
Sep 26, 2022
Author

Oh, awesome. Unsure how I didn't see that in the docs. I can confirm GssapiNegotiateOnce on fixes the issue for us.

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Basic auth fallback authentication without REALM #255

{{title}}

Replies: 6 comments 10 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

Basic auth fallback authentication without REALM #255

glorang Aug 19, 2021

Replies: 6 comments · 10 replies

simo5 Oct 20, 2021 Maintainer

simo5 Oct 20, 2021 Maintainer

simo5 Oct 20, 2021 Maintainer

glorang Oct 20, 2021 Author

simo5 Oct 20, 2021 Maintainer

glorang Oct 21, 2021 Author

simo5 Oct 21, 2021 Maintainer

glorang Oct 26, 2021 Author

adamel Aug 8, 2022

adamel Sep 9, 2022

LucidityCrash Sep 9, 2022

adamel Sep 9, 2022

LucidityCrash Sep 10, 2022

glorang Sep 26, 2022 Author

glorang
Aug 19, 2021

Replies: 6 comments 10 replies

simo5
Oct 20, 2021
Maintainer

simo5 Oct 20, 2021
Maintainer

simo5 Oct 20, 2021
Maintainer

glorang Oct 20, 2021
Author

simo5 Oct 20, 2021
Maintainer

glorang Oct 21, 2021
Author

simo5
Oct 21, 2021
Maintainer

glorang Oct 26, 2021
Author

adamel
Aug 8, 2022

LucidityCrash
Sep 9, 2022

LucidityCrash
Sep 10, 2022

glorang
Sep 26, 2022
Author