Kerberos/SSO on Debian Bullseye

[Boris]

Finally, Zammad 5.1 is running just fine on a Debian 11 environment with MariaDB and nginx, installed manually like following
https://docs.zammad.org/en/latest/install/package.html
.
Now the next goal should be SSO with Kerberos like explained in
Single Sign-On for Kerberos — Zammad documentation)
.
Unfortunately, I had to learn that the package libapache2-mod-auth-kerb is not part of Bullseye.

Now the question is: Is there a documented way to use SSO with Kerberos in nginx or any other recommended way to come around this?

Thanks,

Boris

[dvnkln]

Hey @Boris ,

either backport:

Debian 11 Support

That’s true. Just keep in mind that it’s no zammad issue per se. The libapache2-mod-auth-kerb package simply isn’t released for bullseye (yet). We ran into that issue with our monitoring software too.

If you know what you're doing

You’re perfectly able to backport the sid package though (<a href="https://packages.debian.org/sid/httpd/libapache2-mod-auth-kerb" class="inline-onebox" rel="noopener nofollow ugc">Debian -- Details of package libapache2-mod-aut…

or change the package:

FYI deb11 users with apache2 + sso

Hey there, for anyone running bullseye who needed to backport the libapache2-mod-auth-kerb package from sid: I moved to libapache2-mod-auth-gssapi with (currently) no problems. Since it doesn’t seem like they’re still putting a lot of work into that package (libapache-mod-auth-kerb - Debian Package Tracker) this could be a “more secure” sso approach for now. The process is pretty simple and can be done in even under 1 minute. You can try it on your own if you’d like to but keep in mind that …

cheers

[Boris]

Hej Devin,

thanks a lot for your reply!

I was reading a bit deeper into it and as far as I can sum up the statements, Debian feels Kerberos to be unsecure by design
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=976156

So, with that in mind, I tend to go with gssapi. But I have to get some knowledge about that first.

Thanks again,

Boris

[Boris]

Hej Devin,
hej all,

let me please put an additional question onto that topic:
Zammad installs on nginx by default. A Kerberos-package for nginx seems to be availabel on Bullseye - so why is it recommended to switch to Apache??

Thanks and regards

[dvnkln]

Hey Boris,

i don’t think it’s a recommendation per se. I guess zammad was kind enough to share a working guide in their docs - as is. You’re perfectly free to choose any approach you want to on your own as long as you can handle it or you can contact them as stated in their hint.

But those are just my thoughts. I’m in no means connected to the zammad team apart from beeing a customer.

cheers

[MrGeneration]

At the time this PoC was written, said modules were only available for apache on a wide range on the supported distributions of us. This is why the guide is fitted to Apache.

I currently have no plans on going through that weeks of kerberos hell again in the near future.
I simply have to much on my plate.

[Boris]

Hej Devin,
hej Marcel,

thanks for your lines!
‘Kerberos hell’ leaves me undecided concerning the motivation to work on that, but there are peaple around me wanting it…

Boris

[MrGeneration]

Hey Boris,

don’t get me wrong.
Pull Requests are always welcome.

However, the PoC as is technically works with the mentioned environment. It’s meant as pointer and doesn’t guruantee it’s working on every future OS. I’ve invested over 2 weeks pure work (8 hours, 5 days per week). So this was a quite expensive PoC as you can imagine.

Bests.