Setup Kerberos/NTLM SSO with Apache on Windows

Overview

step-by-step guidelines for setting up Kerberos Authentication on windows with apache. Learn how to configure Kerberos for secure and seamless user authentication, including initial setup, settings, browser configurations.

SSO with Apache on Windows Xampp Server:

• Open Command prompt in Administrator mode.
• Execute the following command to add Service Principal Name (SPN) for the service account.
Setspn -s http/<computer-name>.<domain-name> <domain-user-account>


Example: C:\Users\Administrator> setspn -S HTTP/machinename.domain.com service_account





Note:"machinename.domain.com" here is computer-name. Make sure it's resolvable on the Windows server running AD service.



• Verify whether this has been properly set by running the following command:
setspn -l domain\service_account

• The result should list http/machinename.domain.com
• Open Active Directory Users and Computers and from the top menu select View >> Advanced features.
• Open the service account and go to the attribute editor tab, browse to the servicePrincipalName to verify the SPN entry.
• Navigate to the Delegation tab.
• Select Trust this user for delegation to any service (Kerberos only).



• Click Apply.
• Click Here to download the apache module.
• Copy the mod_authnz_sspi.so from Apache24 > modules folder and place it in the modules (C:\xampp\apache\modules) directory.
• Copy the sspipkgs.exe file from Apache24 -> bin folder and place it in the bin folder of your Xampp apache folder (.....\xampp\apache\bin) on your webserver.
• Open httpd.conf (.....\xampp\apache\conf) and place the below line of code in the LoadModule section.
LoadModule authnz_sspi_module modules/mod_authnz_sspi.so

• Make sure that the following modules are uncommented:
LoadModule authn_core_module modules/mod_authn_core.so
LoadModule authz_core_module modules/mod_authz_core.so

• Also, make sure to enable ldap extension.
• Open the httpd.conf file from (.....\xampp\apache\conf\httpd.conf).
  Go to and paste the below lines after #Require all grants.
<Directory "...../xampp/htdocs">
......
......
#Require all granted
AllowOverride None Options None
AuthType SSPI
SSPIAuth On
SSPIAuthoritative On
Require valid-user
</Directory>

• Restart your Apache Server.

Configure browsers for Kerberos SSO:

General Kerberos SSO Configuration for all Browsers:

• Go to Control Panel and click on Network and Internet >> Internet Options.
• This will open a Internet Properties window. Click on Security >> Local Intranet >> Sites.



• After that, click on the Advanced button.



• In the Add this website to the zone section add the website URL that you wish to login with SSO.



• Click Tools > Internet Options > Security > Local intranet > Custom Level.
• Scroll down to the User Authentication options and select Automatic logon only in the Intranet zone.



• Click on Ok button and then restart your browser.

Once done with the above settings, you need not to configure the browser settings for internet explorer, Google Chrome and Apple Safari.

• Internet Explorer
• Google Chrome
• Mozilla Firefox
• Apple Safari

Internet Explorer:

By default the general browser configuration settings will be applicable, no more additional settings are required for Internet Explorer.

Google Chrome:

By default the general browser configuration settings will be applicable, no more additional settings are required for Google Chrome.

Mozilla Firefox:

• Open Mozilla Firefox browser and enter about:config in the address bar.
• Search for network.negotiate-auth.trusted-uris Preference Name, and click on Edit. enter the hostname or the domain of the web server that is protected by Kerberos HTTP SPNEGO. Specify multiple domains and hostnames separated with a comma.



• Search for network.automatic-ntlm-auth.trusted-uris Preference Name, and click on Edit. enter the hostname or the domain of the web server that is protected by Kerberos HTTP SPNEGO. Specify multiple domains and hostnames separated with a comma.



• Click OK and then restart your browser.

Apple Safari:

Safari on windows supports SPNEGO with no furthere configuration. It supports both kerberos and NTLM as sub mechanism of SPENGO.