>> I wanted to use Kerberos to authenticate the user. After research, I >> thought this would make sense. I saw some suggestions using CoSign or >> WebAuth. I can't use WebAuth because it is only for Linux, and CoSign is >> written for Apache (but there are ISAPI filters i guess for IIS) and I am >> running off of Microsoft IIS. >> [...] > > You may want to search for SPNEGO and mod_auth_kerb. Windows IE and IIS > have SPNEGO built in, and can use the Kerberos in Active Directory. > Apache can use mod_auth_kerb that supports SPNEGO. With FireFox 2 on any > platform > see the about:config and the network.negotiate-auth.trusted-uris option. >
The main (and probably only) drawback of this method is that is all about HTTP basic authentication, and most of applications only allow some kind of cookie based auth. You might want to look at PAPI (http://papi.rediris.es), it only provides Web SSO, but I think is enough for you. Allows multiple authentication backends, and although it is not packaged as default it is possible to use Kerberos (actually, I tested it successfully against a W3K domain controller). On the authentication server side, as far as I remember it forces you to use apache (but apache for Windows is OK). And regarding the application side, the IIS might be a problem, except if the code is PHP. But you can integrate it with Java (a tomcat filter at least). Hope this helps. Javier Palacios ________________________________________________ Kerberos mailing list [email protected] https://mailman.mit.edu/mailman/listinfo/kerberos
