Steps

To let Apache HTTP Server authenticate users with Kerberos and pass them on to XWiki:

1. Create a principal and a keytab for the web server:

   # kadmin
   kadmin> addprinc -randkey HTTP/wiki.example.com
   kadmin> ktadd -k /etc/apache2/ssl/wiki.keytab HTTP/wiki.example.com
   kadmin> quit

2. Restrict the keytab to the user the web server runs as:

   chown www-data:www-data /etc/apache2/ssl/wiki.keytab
   chmod 400 /etc/apache2/ssl/wiki.keytab

3. Install the Apache module for Kerberos authentication, (which on Debian and Ubuntu is libapache2-mod-auth-kerb).
4. Protect the wiki location in the virtual host configuration:

   <Location "/xwiki">
     AuthType Kerberos
     AuthName "Kerberos Login"
     KrbAuthRealms EXAMPLE.COM
     Krb5Keytab "/etc/apache2/ssl/wiki.keytab"
     KrbMethodK5Passwd off
     KrbMethodNegotiate on
     KrbSaveCredentials on
     require valid-user
   </Location>

5. Make the Servlet container trust that authentication. On Apache Tomcat, set tomcatAuthentication to false on the connector, in its server.xml file:

   <Connector port="8009" address="127.0.0.1" enableLookups="false" tomcatAuthentication="false" redirectPort="8443" protocol="AJP/1.3"></Connector>

6. Set the Kerberos authenticator in the xwiki.cfg file, together with the property that creates the authenticated users in the wiki:

   xwiki.authentication.authclass=com.xpn.xwiki.user.impl.xwiki.AppServerTrustedKerberosAuthServiceImpl
   xwiki.authentication.createuser=empty

7. Restart Apache HTTP Server, the Servlet container and the wiki.
8. Open the wiki from a workstation holding a Kerberos ticket and check that you are logged in without a login form, under the user name taken from your principal.

FAQ

Why does the browser still ask for credentials?

The browser has to be allowed to negotiate on that host: in Firefox, add the wiki URL to the network.negotiate-auth.trusted-uris preference.

Is an extra jar needed?

No, the authenticator is part of XWiki, so nothing has to be copied into the WEB-INF/lib directory.

Related

• Authentication Types.
• Configure Container Authentication.