Take the 2-minute tour ×  I've been considering deploying
mod_auth_kerb on our internal web servers to enable SSO. The one
obvious problem I can see is that it's an all-or-nothing
approach, either all your domain users can access a site or not.
Is it possible to combine mod_auth_kerb with something like
mod_authnz_ldap to check for group membership in a particular
group in LDAP? I'm guessing the KrbAuthoritative option would
have something to do with this?  Also, as I understand it, the
module sets the username to be username@REALM after
authentication, but of course in the directory the users are
stored as the username only. Furthermore, some internal sites we
run such as trac already have a user profile linked to each
username. Is there a way to resolve this, perhaps by stripping
off the realm bit after authentication somehow?  share|improve
this question Just a question regarding implementation, are you
using a Windows ADS for the kerberos realm or some other
implementation? –  Jeremy Bouse Jul 6 '09 at 1