Entry

How can I do Kerberos authentication from PHP?

Jan 27th, 2000 22:46
Nathan Wallace, Chad Cunningham

Well, we use kerberos for authentication to our web apps, but do it a
bit different. Basically we use DCE (http://www.opengroup.org/dce/) to
communicate with the university's kerberos server. We use an in-house
apache module to do this. Basically when you hit a protected page, you
are redirected to a university page where you login. When the user is
sent back, they have authentication tokens in the header, and each
further request they make is run through the apache module which uses
DCE to connect to the kerberos server to verify that they are
authenticated. 

As far as a PHP interface goes, I dunno... Seeing as *shudder* Win2k
works on a Kerberos Schema, it's something that would be nice to have
I'm sure. For Unix folk though, I think the easier way would be with
PAM. You could use mod_auth_pam now, with a kerberos pam module to do
this. Or, someone posted code for a PHP extension to do PAM to the list
a bit ago. Of course, this limits you to using a system with PAM
support. There is also mod_auth_kerberos

    http://stonecold.unity.ncsu.edu/software/mod_auth_kerb/index.html

Come to think of it, it might not be so bad to make a php extension...
The mod_auth_pam source code doesn't look too bad...