The main idea:
- I have windows application (maybe IIS site, maybe standalone) that natively accepts Kerberos authentication and impersonates user.
- Kerberos token sent by client to app already has information about user's groups SIDs, user's SID, etc.
- On each request, from
HttpContext.Current.UserI get information about user's groups' SIDs, user SID, translate it to 'plaintext' and pass to non-windows backend (as header, for example). - Backend (which can not do kerberos) can read claims added by App from proxied request and send answer, which will be passed to app and then to user (backend->app->user)
Well, what's wrong with this concept?
Why I can not find any existing apps that can work similar way?
The only thing I found is FASTCGI\CGI, which sets REMOTE_USER variable, but this is not enough - frontend had Kerberos with huge amount of data which is dropped by the way to backend.