Authenticating questions, possible to bridge kerberos to oauth?

user_9067048 0
Viewed 206

First of all I just want to mention that I haver really bad knowledge of this topic. But my problem is that I have an grafana-instance running in openshift that is using oauth-proxy for authentication.

On my company we are using a Kerberos-solution to automaticly authenticate users accessing company domains. The problem is that we want to manage what groups that have access to the grafana-instance and if possible authenticate in the background without the users having to enter any usernames/passwords.

As I understand the current kerberos solution works like this:

User -> company.com -> SSO-server -> [fetch user from LDAP] -> If Authenticated, Redirect to company.com

Is it somehow possible to do something similar:

  • User navigates to grafana.company.com
  • grafana.company.com redirects to sso-server
  • Magic kerberos authentication occurs
  • Redirects back to grafana.company.com
  • someway authenticates the user directly from grafana or oauth-proxy
openshift oauth-2.0 kerberos
1 Answers

It is possible; any web-based SSO system that asks you for username/password can instead ask for a Kerberos ticket at the same point. (The latter is done using HTTP-level "Negotiate" authentication, also known as "SPNEGO".) Once the SSO system has established your identity, it'll happily issue the same OIDC or SAML tokens regardless of what kind of authentication was used.

For example, the Keycloak OIDC IdP has built-in support for HTTP Negotiate; search the docs for "SPNEGO". Shibboleth IdP (for SAML) has SPNEGO support as well.

Also, any SSO system that supports getting the 'REMOTE_USER' assertion from the web server (instead of using its own credential prompts) can be used with Kerberos, using e.g. Apache mod_auth_gssapi or Nginx spnego-http-auth modules.

user_498490
Related