From: Dan Langille (dalangil) <dalangil@cisco.com>
Date: Thu, 18 Dec 2014 22:19:19 GMT
Subject: git-http-backend auth via Kerberos
Message-ID: <540A8740-B240-40FF-BB50-0D90DEA04031@cisco.com>

I am trying to get http://git-scm.com/docs/git-http-backend to auth via Kerberos.

I have success when a Kerberos ticket is present.

I am trying to get git to authenticate with Kerberos when a ticket is not present.

Here is what succeeds with a ticket:

<Location /git>
  SSLOptions +StdenvVars
  Options +ExecCGI +FollowSymLinks +SymLinksIfOwnerMatch

    # By default, allow access to anyone.
    Order allow,deny
    Allow from All

    # Enable Kerberos authentication using mod_auth_kerb.
    AuthType Kerberos
    AuthName “us.example.com"
    KrbAuthRealm us.example.com
    Krb5KeyTab /usr/local/etc/apache22/repo-test.keytab
    KrbMethodNegotiate on
    KrbSaveCredentials on
    KrbVerifyKDC on
    KrbServiceName Any
    Require valid-user
</Location>

This is what happens without a valid ticket:

$ git clone https://us.example.com/git/clamav-bytecode-compiler
Cloning into 'clamav-bytecode-compiler'...
Username for 'https://us.example.com': dan
Password for 'https://dan@us.example.com': 
fatal: Authentication failed for 'https://us.example.com/git/clamav-bytecode-compiler/'

Of note, I see this in the Apache logs:

Thu Dec 18 16:43:35 2014] [debug] src/mod_auth_kerb.c(1749): [client 10.7.69.10] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos

Ideas?  Suggestions?  Hints?  Thanks.

— 
Dan Langille
Infrastructure & Operations
Talos Group
Sourcefire, Inc.