Wiki source code of Configure Kerberos SSO Authentication
Last modified by Eleni Cojocariu-testing account on 2026/08/11 00:45
Show last authors
| author | version | line-number | content |
|---|---|---|---|
| 1 | To let Apache HTTP Server authenticate users with [[Kerberos>>https://kerberos.org/docs/index.html]] and pass them on to XWiki: | ||
| 2 | |||
| 3 | 1. Create a principal and a keytab for the web server:((( | ||
| 4 | {{code language="none"}} | ||
| 5 | # kadmin | ||
| 6 | kadmin> addprinc -randkey HTTP/wiki.example.com | ||
| 7 | kadmin> ktadd -k /etc/apache2/ssl/wiki.keytab HTTP/wiki.example.com | ||
| 8 | kadmin> quit | ||
| 9 | {{/code}} | ||
| 10 | ))) | ||
| 11 | 1. Restrict the keytab to the user the web server runs as:((( | ||
| 12 | {{code language="bash"}} | ||
| 13 | chown www-data:www-data /etc/apache2/ssl/wiki.keytab | ||
| 14 | chmod 400 /etc/apache2/ssl/wiki.keytab | ||
| 15 | {{/code}} | ||
| 16 | ))) | ||
| 17 | 1. Install the Apache module for Kerberos authentication, (which on Debian and Ubuntu is ##libapache2-mod-auth-kerb##). | ||
| 18 | 1. Protect the wiki location in the virtual host configuration:((( | ||
| 19 | {{code language="apache"}} | ||
| 20 | <Location "/xwiki"> | ||
| 21 | AuthType Kerberos | ||
| 22 | AuthName "Kerberos Login" | ||
| 23 | KrbAuthRealms EXAMPLE.COM | ||
| 24 | Krb5Keytab "/etc/apache2/ssl/wiki.keytab" | ||
| 25 | KrbMethodK5Passwd off | ||
| 26 | KrbMethodNegotiate on | ||
| 27 | KrbSaveCredentials on | ||
| 28 | require valid-user | ||
| 29 | </Location> | ||
| 30 | {{/code}} | ||
| 31 | ))) | ||
| 32 | 1. Make the Servlet container trust that authentication. On Apache Tomcat, set ##tomcatAuthentication## to ##false## on the connector, in its ##server.xml## file:((( | ||
| 33 | {{code language="xml"}} | ||
| 34 | <Connector port="8009" address="127.0.0.1" enableLookups="false" tomcatAuthentication="false" redirectPort="8443" protocol="AJP/1.3"></Connector> | ||
| 35 | {{/code}} | ||
| 36 | ))) | ||
| 37 | 1. Set the Kerberos authenticator in the ##xwiki.cfg## file, together with the property that creates the authenticated users in the wiki:((( | ||
| 38 | {{code language="properties"}} | ||
| 39 | xwiki.authentication.authclass=com.xpn.xwiki.user.impl.xwiki.AppServerTrustedKerberosAuthServiceImpl | ||
| 40 | xwiki.authentication.createuser=empty | ||
| 41 | {{/code}} | ||
| 42 | ))) | ||
| 43 | 1. Restart Apache HTTP Server, the Servlet container and the wiki. | ||
| 44 | 1. Open the wiki from a workstation holding a Kerberos ticket and check that you are logged in without a login form, under the user name taken from your principal. |
