I have a website running on a Linux computer using Apache. I've employed mod_auth_kerb for single-sign-on Kerberos authentication against a Windows Active Directory server.

In order for Kerberos to work correctly, I've created a service account in Active Directory called dummy.

I've generated a keytab for the Linux web server using ktpass.exe on the Windows AD server using this command:

ktpass /out C:\krb5.keytab /princ HTTP/[email protected] /mapuser [email protected] /crypto RC4-HMAC-NT /ptype KRB5_NT_PRINCIPAL /pass xxxxxxxxx

I can successfully get a ticket from the Linux web server using this command:

kinit -k -t /path/to/keytab HTTP/[email protected]

... and view the ticket with klist.

I have also configured my web server with these Kerberos properties:

<Directory />
    AuthType                Kerberos
    AuthName                "Example.com Kerberos domain"
    KrbMethodK5Passwd       Off
    KrbAuthRealms           EXAMPLE.COM
    KrbServiceName          HTTP/[email protected]
    Krb5KeyTab              /path/to/keytab
    Require                 valid-user
    SSLRequireSSL
    <Files wsgi.py>
            Order deny,allow
            Allow from all
    </Files>
</Directory>

However, when I attempt to log in to the website (from another Desktop with username 'Jeff') my Kerberos credentials are not automatically accepted by the web server. It should grant me access immediately after that, but it does not. The only information I get from the mod_auth_kerb logs is:

kerb_authenticate_user entered with user (NULL) and auth_type Kerberos

However, more information is revealed when I change the mod_auth_kerb setting KrbMethodK5Passwd to On:

[Fri Oct 18 17:26:44 2013] [debug] src/mod_auth_kerb.c(1939): [client xxx.xxx.xxx.xxx] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos
[Fri Oct 18 17:26:44 2013] [debug] src/mod_auth_kerb.c(1031): [client xxx.xxx.xxx.xxx] Using HTTP/[email protected] as server principal for password verification
[Fri Oct 18 17:26:44 2013] [debug] src/mod_auth_kerb.c(735): [client xxx.xxx.xxx.xxx] Trying to get TGT for user [email protected]
[Fri Oct 18 17:26:44 2013] [debug] src/mod_auth_kerb.c(645): [client xxx.xxx.xxx.xxx] Trying to verify authenticity of KDC using principal HTTP/[email protected]
[Fri Oct 18 17:26:44 2013] [debug] src/mod_auth_kerb.c(1110): [client xxx.xxx.xxx.xxx] kerb_authenticate_user_krb5pwd ret=0 [email protected] authtype=Basic

What am I missing? I've studied a lot of online tutorials and cannot find a reason why the Kerberos credentials are not allowing access.