Hi all,

Some days ago i've said on freeipa IRC channel that the documentation on 
freeipa + apache + SNI (located here 
http://freeipa.org/page/Apache_SNI_With_Kerberos) was wrong. 
I've set up a apache server with SNI and tested sso with mit kerberos on 
windows 7 64bits + firefox . On my windows 7 client, sso don't work if i set 
"dummyhost" apache virtualhost Krb5KeyTab and KrbServiceName, but works if 
Krb5KeyTab and KrbServiceName are those of real host. This behavior is reversed 
with fedora 17 + firefox client: sso works only if "dummyhost" apache 
virtualhost Krb5KeyTab and KrbServiceName are those of the "dummyhost".

So, the conclusion is: the documentation is good for linux clients (at least on 
fedora 17 + firefox), but not for windows clients

I think it will be good to have the same behavior on linux and windows client 
because it will be painful in cross platform environments if it stay as this.

rcrit said on IRC that you are working on v3 at this time, it will be good to 
know if the v3.0 have the same behavior, but i don't have resources at this 
time to setup another test environment with v3 beta.

Detailed test configuration:

(see attached apache config extract for virtualhost configuration)

IPA server:
OS: CentOS 6.3
IPA: ipa-server.x86_64      2.2.0-16.el6
389 ds: 389-ds-base.x86_64


Apache SNI server:
OS: CentOS 6.3
real hostname: projects.foo.example.com
dummy host 1: svn.example.com
dummy host 2: redmine.example.com

Windows client:
OS: Windows 7 64Bits.
Browser: Firefox 15.0.1, 14.0.x (32bits)
MIT Kerberos dist: 3.2.2 (32bits) (http://web.mit.edu/kerberos/dist/)

GNU/Linux client:
OS: Fedora 17 x86_64
Browser: Firefox 15 (latest provided by fedora)
Kerberos: (latest provided by fedora)

Have a nice day.



Attachment: works_with_linux_clients.conf
Description: Binary data

Attachment: works_with_windows7_clients.conf
Description: Binary data

Freeipa-users mailing list

Reply via email to