RHEL8环境Apache配置GSSAPI Kerberos SSO认证失效问题

AI 小北

2026-8-30

RHEL8 Apache mod_auth_gssapi Kerberos SSO失效排查

环境说明

部署环境为运行Red Hat Enterprise Linux release 8.5 (Ootpa)的服务器，Apache虚拟主机使用mod_auth_gssapi（替代旧版mod_auth_kerb）实现Kerberos单点登录，同时通过mod_ldap配置LDAP组规则完成用户授权校验。
前期已完成如下配置且验证正常：

Kerberos客户端配置/etc/krb5.conf内容如下，语法、域配置均正确：

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 default_realm = MY.DOMAIN
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 forwardable = yes

[realms]
 MY.DOMAIN = {
  kdc = ADserver.my.domain
  a_server = ADserver.my.domain
  default_domain = my.domain
 }

[domain_realm]
 .kerberos.server = MY.DOMAIN
 .my.domain = MY.DOMAIN

[appdefaults]
 pam = {
 debug = false
 ticket_lifetime = 36000
 renew_lifetime = 36000
 forwardable = true
 krb4_convert = false
 }

AD侧已创建专用服务账号usersso，SPN配置正确无重复，查询结果如下：

C:\Users\me>setspn -L usersso
Registered ServicePrincipalNames for CN=UserSso,OU=Users,DC=MY,DC=DOMAIN:
        HTTP/myserver.my.domain

C:\Users\me>setspn -Q HTTP/myserver.my.domain
Checking domain DC=MY,DC=DOMAIN
CN=UserSso,OU=Users,DC=MY,DC=DOMAIN
        HTTP/myserver.my.domain

Existing SPN found!

生成的keytab已上传至Apache服务器，文件内主体、加密类型匹配要求：

[root@myserver conf.d]# klist -ek /etc/httpd/usersso.keytab
Keytab name: FILE:/etc/httpd/usersso.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   4 HTTP/myserver.my.domain@MY.DOMAIN (aes256-cts-hmac-sha1-96)

keytab有效性验证通过，可正常获取Kerberos票据：

[root@myserver httpd]# kinit -V -kt /etc/httpd/usersso.keytab -p HTTP/myserver.my.domain@MY.DOMAIN
Using default cache: /tmp/krb5cc_0
Using principal: HTTP/myserver.my.domain@MY.DOMAIN
Using keytab: /etc/httpd/usersso.keytab
Authenticated to Kerberos v5

[root@myserver httpd]# klist -Af
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: HTTP/myserver.my.domain@MY.DOMAIN

Valid starting       Expires              Service principal
16/06/2022 13:03:23  16/06/2022 23:03:23  krbtgt/MY.DOMAIN@MY.DOMAIN
        renew until 17/06/2022 13:03:23, Flags: FPRIA

故障现象

Apache虚拟主机配置如下：

<VirtualHost 192.168.168.168:80>
    ServerName              myserver.my.domain

    ErrorLog             /var/log/httpd/myserver.my.domain_error.log
    TransferLog          /var/log/httpd/myserver.my.domain_access.log
    LogLevel             debug

    <Location />
      AuthType GSSAPI
      AuthName "GSSAPI Single Sign On Login"
      GssapiBasicAuth On
      GssapiBasicAuthMech krb5
      GssapiAllowedMech krb5
      GssapiCredStore keytab:/etc/httpd/usersso.keytab
      GssapiLocalName On
      BrowserMatch Windows gssapi-no-negotiate

      AuthLDAPURL ldap://ldapserver:10400/ou=users,o=enterprise,dc=city,dc=fr?uid?sub?(objectclass=person)
      AuthLDAPGroupAttribute member
      AuthLDAPBindDN "cn=apache,ou=users,o=enterprise,dc=city,dc=fr"
      AuthLDAPBindPassword "XXXX"
      AuthzSendForbiddenOnFailure On

      Require ldap-group cn=group_to_authenticate_users,ou=Groupe,ou=Profil,o=enterprise,dc=city,dc=fr
    </Location>

# tag::TLSClient[]
    SSLProxyEngine on
    SSLProxyProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
    SSLProxyCipherSuite HIGH:!aNULL:!MD5
    SSLProxyCheckPeerCN off
    SSLProxyCheckPeerName off
    SSLProxyCheckPeerExpire off
    SSLProxyVerifyDepth 10
    SSLOCSPEnable off
# end::TLSClient[]

    ProxyPass               / https://anotherserver:443/
    ProxyPassReverse        / https://anotherserver:443/

</VirtualHost>

访问站点时出现异常：

请求未转发到后端anotherserver，Chrome直接弹出身份认证窗口，Kerberos单点登录未触发
手动在弹窗输入账号密码可正常通过LDAP组校验，访问后端服务，说明LDAP授权逻辑正常
访问日志返回401状态码：

10.10.10.10(me) - - [16/Jun/2022:11:53:21 +0200] "GET / HTTP/1.1" 401 381

Apache错误日志明确提示客户端未发送任何认证头：

[Thu Jun 16 12:49:42.867213 2022] [authz_core:debug] [pid 8154:tid 139726585538304] mod_authz_core.c(820): [client 10.10.10.10:62252] AH01626: authorization result of Require ldap-group cn=group_to_authenticate_users,ou=Groupe,ou=Profil,o=enterprise,dc=city,dc=fr: denied (no authenticated user yet)
[Thu Jun 16 12:49:42.867231 2022] [authz_core:debug] [pid 8154:tid 139726585538304] mod_authz_core.c(820): [client 10.10.10.10:62252] AH01626: authorization result of <RequireAny>: denied (no authenticated user yet)
[Thu Jun 16 12:49:42.867256 2022] [auth_gssapi:debug] [pid 8154:tid 139726585538304] mod_auth_gssapi.c(901): [client 10.10.10.10:62252] URI: /, no main, no prev
[Thu Jun 16 12:49:42.867273 2022] [auth_gssapi:info] [pid 8154:tid 139726585538304] [client 10.10.10.10:62252] NO AUTH DATA Client did not send any authentication headers

curl测试确认服务端已正常返回WWW-Authenticate: Negotiate响应头：

curl -k -L http://myserver.my.domain/ -v
*   Trying 192.168.168.168:80...
* TCP_NODELAY set
* Connected to myserver.my.domain (192.168.168.168) port 80 (#0)
> GET / HTTP/1.1
> Host: myserver.my.domain
> User-Agent: curl/7.65.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 401 Unauthorized
< Date: Thu, 16 Jun 2022 10:57:31 GMT
< Server: Apache/2.4.37 (Red Hat Enterprise Linux) OpenSSL/1.1.1k mod_auth_gssapi/1.6.1
< WWW-Authenticate: Negotiate
< WWW-Authenticate: Basic realm="GSSAPI Single Sign On Login"
< Content-Length: 381
< Content-Type: text/html; charset=iso-8859-1
<
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>401 Unauthorized</title>
</head><body>
<h1>Unauthorized</h1>
<p>This server could not verify that you
are authorized to access the document
requested.  Either you supplied the wrong
credentials (e.g., bad password), or your
browser doesn't understand how to supply
the credentials required.</p>
</body></html>
* Connection #0 to host myserver.my.domain left intact

解决步骤

按如下顺序修改配置即可恢复Kerberos SSO功能：

删除Apache虚拟主机配置中的BrowserMatch Windows gssapi-no-negotiate规则，该规则会强制Windows客户端跳过Negotiate协商流程，直接触发基础认证弹窗
停止并禁用系统默认的gssproxy服务，RHEL 8.x版本下该服务与mod_auth_gssapi对接AD Kerberos的场景存在适配问题，会中断GSSAPI认证流程：

systemctl stop gssproxy
systemctl disable gssproxy

修改Apache服务环境变量，将GSS_USE_PROXY参数设为0，彻底禁止Apache调用gssproxy，同时避免错误日志出现gss_localname() input error报错。直接编辑/etc/sysconfig/httpd文件，追加如下配置：

GSS_USE_PROXY=0

所有配置修改完成后重启httpd服务生效：

systemctl restart httpd

内容的提问来源于stack exchange，提问作者Wrest

RHEL8环境Apache配置GSSAPI Kerberos SSO认证失效问题

环境说明 #

故障现象 #

解决步骤 #

环境说明

故障现象

解决步骤