Red Hat Bugzilla – Bug 570191
PRD35 - [RFE] [AAA] support Kerberos authentication (for REST API)
Last modified: 2016-02-10 14:44:36 EST
The AutoLogin command allows users on the same machine as the RHEV-M backend to avoid re-authenticating because RHEV-M can use the ServiceSecurityContext::WindowsIdentity property to check the calling user's identity. No similar API exists in Java/JBoss, so this functionality has been disabled. This thread on the mailing list discusses the need for the functionality and some ideas for how it might be implemented: http://post-office.corp.redhat.com/archives/rhev-x/2010-March/thread.html#00022
Two issues here: 1. CLI (and maybe SDK) need to support implicit, persistent login in case of session failure[1]. 2. CLI (and maybe SDK) need to support kerberos authentication for currently logged in windows/linux user [1] pay attention the current implementation in 2.2 windows powershell is actually not correct. consider the following use case: a. user is logged in to windows with domain\xxx b. user opens powershell and runs a script which will login-user domain\yyy. c. after several commands the session breaks, and implicit auto authentication will re-authenticate the user, but with the windows logged in user of domain\xxx, rather than the last user the user logged in with. fixing #1 is relatively easy, since all we need to do is keep the login-user parameters and re-use them on session failure. fixing #2 actually requires kerberos support from windows-->jboss-->AD (and later for linux-->jboss>AD/RHDS
this is basically "support kerberos authentication" by backend
*** Bug 746706 has been marked as a duplicate of this bug. ***
related to bug 884653
Relates to: bug#958874
Relates to: bug#958861
Authentication is now external to the RESTAPI.
Working with mod_auth_kerb, implies that kerberos is enforced, no other method is enabled.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2015-0158.html