Apache2，Kerberos，SSI：如何在其他用户下登录

Question

I have web-app with authorization by REMOTE_USER header. If apache2 + mod_auth_kerb set REMOTE_USER by some ActiveDirectory username, my web-app know that user with such username is logged in. I have single sign on ( SSI ) and it works perfect, but what should I do when I want to login as another user? How to force kerberos relogin (via basic auth, for example)?

If it isn't possible by mod_auth_kerb, but possible by some other apache (or nginx) mod, it is totally ok!

PS By the way, is it safe to rely on REMOTE_USER HTTP header in authorization process?

Answer 1

There is no way to log a user out if they were authenticated via browser-type basic auth.

Try using Stanford WebAuth . This allows you to present an in-browser login page and still use the user's Kerberos creds (at your option using SPNEGO for a no-password login). It provides comprehensive logout functionality as well - the user's browser won't stop being authenticated Kerberos-wise, but it will stop being WebAuth logged-in.

It is safe to rely on the REMOTE_USER server variable . It is not an HTTP header - in PHP, it would be $_SERVER['REMOTE_USER'] , not $_REQUEST['REMOTE_USER'] . It's set by server-side code.