Ask Your Question

kerberos (krb5) support?

asked 2011-12-05 04:56:03 -0600

drpoovilleorg's avatar

updated 2011-12-05 07:02:00 -0600

Evgeny's avatar

Is krb5 kerberos login supported? Any pointers to instructions for setting it up?

edit retag flag offensive close merge delete

2 Answers

Sort by ยป oldest newest most voted

answered 2011-12-05 07:07:27 -0600

Evgeny's avatar

updated 2011-12-05 07:10:40 -0600

This is not supported yet.

There are several python modules that I could find:

pykpass seems to have very simple usage: Maybe you could test this one and others against your server on in the python shell and tell which one works?

We could add that method to supported password authentication methods.

edit flag offensive delete link more


Understood. i'll explore then and post back an answer once i've got something up and running. Thanks!

drpoovilleorg's avatar drpoovilleorg  ( 2011-12-05 07:26:26 -0600 )edit

answered 2011-12-05 10:38:48 -0600

drpoovilleorg's avatar

Seems it works with Django 1.3 out of the box, in fact! :) With the right apache config + instructions from django docs. eg,

and in your httpd/conf.d/askbot.conf


AuthType Kerberos

AuthName "YOURDOMAIN.COM Kerberos Login"

KrbMethodNegotiate On

KrbMethodK5Passwd On


KrbVerifyKDC off

Krb5Keytab /etc/krb5.keytab


require valid-user

edit flag offensive delete link more


This requires apache, which is not optimal. We are now switching to nginx, because it is much faster. However, we should add this to the docs - is this all that is needed? Which module for apache is necessary?

Evgeny's avatar Evgeny  ( 2011-12-05 10:55:49 -0600 )edit

mod auth kerb

drpoovilleorg's avatar drpoovilleorg  ( 2011-12-06 08:07:49 -0600 )edit

you can use backticks to escape markdown processing. the underscores make a word in the middle italic.

Evgeny's avatar Evgeny  ( 2011-12-06 08:12:10 -0600 )edit

There are probably a few quirks that will need to be ironed out, since when this is enabled globally, you log in automatically... so for example, 'log out' doesn't work as expected... you just stay logged in :) but yes, otherwise, it seems to work like a charm.

drpoovilleorg's avatar drpoovilleorg  ( 2011-12-06 08:24:14 -0600 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2011-12-05 04:56:03 -0600

Seen: 559 times

Last updated: Dec 05 '11