By jfrankman on

We have a website based on the PHP Drupal project hosted in Apache running on an IBM iSeries (AS/400). It is an internal wesite, so we use Kerberos authentication with Apache so that our user's do not need to sign on to the website. We are noticing the following strange behavior...

HTTP Post Fails after twenty minutes with IE:
If a user pulls up a form in Internet Explorer and takes longer than twenty minutes to post the form to iSeries Apache, the Kerberos authentication fails.

HTTP Post succeeds from Firefox, or if time length less than 20 minutes:
If a user pulls up a form in Firefox, or if the user fills in the form within twenty minutes, then the authentication succeeds.

Click a link to visit another page on the server always works:
If a user pulls up a form, or is on another page, the user can click any link and authentication works fine even if the browser is idle for longer than twenty minutes. The authentication only fails if the user is trying to post a form to the iSeries.

I have been working with IBM support on this, but their staff so far has not been able to help me out with this, and insist the problem is solely due to IE. Any thoughts or suggestions would be appreciated.

⋅ Categories: Drupal 4.6.x

Comments

styro’s picture

styro commented

I wasn't even aware you could even get everything Drupal requires running on an AS400 :)

How is your authentication working?

Do you use the Drupal webserver auth module?

Is the Kerberos realm Active Directory or something else?

How do the browsers authenticate to Apache/Kerberos? Do they do basic HTTP auth to the server and the server gets the ticket for them, or do they use wizzy transparent SPNEGO stuff?

If you have any IIS websites using Kerberos, does IE timeout after 20mins with them as well?

Will IE successfully connect again with the same ticket again afterwards? I'm not quite sure how you'd test that.

I don't really have any clue what is wrong, but thought I'd chime in as nobody else would be likely to and I might accidentally jog some ideas ;)

--
Anton
New to Drupal? | Forum posting tips | Troubleshooting FAQ
Example Knowledge Base built using Drupal

jfrankman’s picture

jfrankman commented

Styro,

Thanks for your comments. Here are the answers to your questions. Since I last posted the message we have found the problem, but we are not quite sure the best way to fix it.

[How is your authentication working?]
The authentication occurs through Active Directory:
1. Browser request page from Apache
2. Apache returns "negotiate" in header
3. Browser requests ticket from Active Directory
4. Active directory grants ticket
5. Ticket it forwarded by browser to Apache
6. Apache grants access.

[Do you use the Drupal webserver auth module?] Yes

[Is the Kerberos realm Active Directory or something else?] Active Directory

[How do the browsers authenticate to Apache/Kerberos? Do they do basic HTTP auth to the server and the server gets the ticket for them, or do they use wizzy transparent SPNEGO stuff? ] SPEGNO. You basically enter an entry on the AS400 called a "keytab" with a name and password. You then register the same name and password on in Active Directory.

[If you have any IIS websites using Kerberos, does IE timeout after 20mins with them as well?] No, but this was due to the nature of the bug we found in IE. If our IIS met the same conditions network configuration as our AS/400 I suspect we would have the same problem.

The problem basically boiled down to a bug in IE. See: http://support.microsoft.com/kb/899417/en-us#appliesto We have tried to work around this bug by altering our configuration, but have had only marginal success. We may be forced to apply Microsoft's hotfix to the problem.

phkramer’s picture

phkramer commented

have you checked to see how long the authentication ticket is valid for - there may be some timeout values associated with kerberos ticket. May want to check with IE on whether or not this is configurable.

phkramer’s picture

phkramer commented

have you checked to see how long the authentication ticket is valid for - there may be some timeout values associated with kerberos ticket. May want to check with IE on whether or not this is configurable.

ranj.sarraj’s picture

ranj.sarraj commented

I just want someone to show me how to config kerberos on apache2

thank you in advance

styro’s picture

styro commented

See: http://modauthkerb.sourceforge.net/

(Probably best to install from your distro packages though)

Note: Your web server will also need a keytab.

If all that stuff sounds like a foreign language, then you have a lot of learning ahead of you.