Kerberos 5 authentication module for SimpleSAMLphp
This document assumes that you already have the kerberos client on your server and have properly configured your
/etc/krb5.conf file. If you are able to obtain a TGT from your KDC using the
kinit command, you can continue with the installation of this module.
You will need to add support for Kerberos to your PHP instllation. By default, PHP does not ship with this functionality. You can obtain the krb5 module from PECL here. This document will not go through installing the module or enabling it in your PHP configuration.
Configuring the module
First you need to enable the kerberos module, touch an
enable file, in the
Then you need to setup your authsource in the
// An authentication source which can authenticate against a MIT Kerberos v5 KDC 'kerb' => array( 'kerberos:Krb5', // The Kerberos realm // Do not include a leading @. 'realm' => 'EXAMPLE.COM', // Strip realm // Remove the realm when passing the principal name into the UID attribute 'stripRealm' => true, ),
You will need to supply a realm. The realm configured here should not include a leading @ symbol, and must be configured in your
Using the module
Once you have configured the module, you can test it on the "Test Configured Authentication Sources" page within SimpleSAMLphp. This module will only return a uid value which is the principal from Kerberos.
Note: When a user is authenticating, if they supply a firstname.lastname@example.org, the @scope.com will be removed and will be replaced with the configured realm.