{"action":"created","issue":{"url":"https://api.github.com/repos/modauthgssapi/mod_auth_gssapi/issues/28","labels_url":"https://api.github.com/repos/modauthgssapi/mod_auth_gssapi/issues/28/labels{/name}","comments_url":"https://api.github.com/repos/modauthgssapi/mod_auth_gssapi/issues/28/comments","events_url":"https://api.github.com/repos/modauthgssapi/mod_auth_gssapi/issues/28/events","html_url":"https://github.com/modauthgssapi/mod_auth_gssapi/issues/28","id":75340376,"number":28,"title":"Basic auth failed","user":{"login":"pavel-jurasek-merck-com","id":7910967,"avatar_url":"https://avatars.githubusercontent.com/u/7910967?v=3","gravatar_id":"","url":"https://api.github.com/users/pavel-jurasek-merck-com","html_url":"https://github.com/pavel-jurasek-merck-com","followers_url":"https://api.github.com/users/pavel-jurasek-merck-com/followers","following_url":"https://api.github.com/users/pavel-jurasek-merck-com/following{/other_user}","gists_url":"https://api.github.com/users/pavel-jurasek-merck-com/gists{/gist_id}","starred_url":"https://api.github.com/users/pavel-jurasek-merck-com/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pavel-jurasek-merck-com/subscriptions","organizations_url":"https://api.github.com/users/pavel-jurasek-merck-com/orgs","repos_url":"https://api.github.com/users/pavel-jurasek-merck-com/repos","events_url":"https://api.github.com/users/pavel-jurasek-merck-com/events{/privacy}","received_events_url":"https://api.github.com/users/pavel-jurasek-merck-com/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":11,"created_at":"2015-05-11T20:03:53Z","updated_at":"2015-05-24T11:15:10Z","closed_at":null,"body":"@simo5 i figure out delegation credentials now i am stuck with fallback basic auth not working :/ Still getting 401 even if i use correct username and password:/\r\n\r\nApache2 config\r\n```\r\n<VirtualHost *:80>\r\n\tServerName  kerberos.mywork.merck.com\r\n        ServerAlias 54.40.221.55\r\n\r\n\tServerAdmin pavel.jurasek@merck.com\r\n\tDocumentRoot /var/www/html\r\n\r\n\tErrorLog ${APACHE_LOG_DIR}/error.log\r\n\tCustomLog ${APACHE_LOG_DIR}/access.log combined\r\n\r\n RewriteEngine On\r\n\r\n RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f\r\n RewriteRule ^/(.*)$ balancer://upstream%{REQUEST_URI} [P,QSA,L]\r\n\r\n     <Location />\r\n    AuthType GSSAPI\r\n    AuthName \"Login\"\r\n    Require valid-user\r\n\r\n    GssapiUseS4U2Proxy On\r\n    GssapiCredStore keytab:/etc/apache2/kerberos.mywork.service.keytab\r\n    GssapiCredStore client_keytab:/etc/apache2/kerberos.mywork.service.keytab\r\n    GssapiDelegCcacheDir /home/admin\r\n    GssapiBasicAuth On\r\n    RequestHeader set REMOTE_USER %{REMOTE_USER}s\r\n    RequestHeader set AUTH_TYPE %{AUTH_TYPE}s\r\n    RequestHeader set KRB5CCNAME %{KRB5CCNAME}s\r\n</Location>\r\n\r\n<Proxy balancer://upstream>\r\n  BalancerMember http://0.0.0.0:9999\r\n </Proxy>\r\n\r\n ProxyRequests Off\r\n ProxyVia On\r\n ProxyPreserveHost On\r\n\r\n <Proxy *>\r\n  Require all granted\r\n </Proxy>\r\n\r\n <Directory /var/www/html>\r\n  Options -MultiViews\r\n  Require all granted\r\n </Directory>\r\n\r\n</VirtualHost>\r\n```\r\n\r\nLocal klist -f -> verify that i do not have ticket\r\n\r\n```\r\nklist -f\r\nCredentials cache: API:1C2F03F8-3ECC-4EE4-B82E-F616A881F691\r\n        Principal: jurasek@MERCK.COM\r\n\r\n  Issued    Expires  Flags    Principal\r\n```\r\n\r\nCurl to server:\r\n\r\n```\r\ncurl --verbose -u <username>:<password> http://kerberos.mywork.merck.com\r\n* Adding handle: conn: 0x7fec40804000\r\n* Adding handle: send: 0\r\n* Adding handle: recv: 0\r\n* Curl_addHandleToPipeline: length: 1\r\n* - Conn 0 (0x7fec40804000) send_pipe: 1, recv_pipe: 0\r\n* About to connect() to kerberos.mywork.merck.com port 80 (#0)\r\n*   Trying 54.40.222.179...\r\n* Connected to kerberos.mywork.merck.com (54.40.222.179) port 80 (#0)\r\n* Server auth using Basic with user '<username>'\r\n> GET / HTTP/1.1\r\n> Authorization: Basic PHVzZXJuYW1lPjo8cGFzc3dvcmQ+\r\n> User-Agent: curl/7.30.0\r\n> Host: kerberos.mywork.merck.com\r\n> Accept: */*\r\n>\r\n< HTTP/1.1 401 Unauthorized\r\n< Content-Type: text/html; charset=iso-8859-1\r\n< Date: Mon, 11 May 2015 20:01:13 GMT\r\n* Server Apache/2.4.10 (Debian) is not blacklisted\r\n< Server: Apache/2.4.10 (Debian)\r\n< WWW-Authenticate: Negotiate\r\n* Authentication problem. Ignoring this.\r\n< WWW-Authenticate: Basic realm=\"Login\"\r\n< Content-Length: 472\r\n< Connection: keep-alive\r\n<\r\n<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">\r\n<html><head>\r\n<title>401 Unauthorized</title>\r\n</head><body>\r\n<h1>Unauthorized</h1>\r\n<p>This server could not verify that you\r\nare authorized to access the document\r\nrequested.  Either you supplied the wrong\r\ncredentials (e.g., bad password), or your\r\nbrowser doesn't understand how to supply\r\nthe credentials required.</p>\r\n<hr>\r\n<address>Apache/2.4.10 (Debian) Server at kerberos.mywork.merck.com Port 80</address>\r\n</body></html>\r\n* Connection #0 to host kerberos.mywork.merck.com left intact\r\n```\r\n\r\nApache2 - Access log\r\n\r\n```\r\n54.40.222.179 - - [11/May/2015:20:01:13 +0000] \"GET / HTTP/1.1\" 401 760 \"-\" \"curl/7.30.0\"\r\n```\r\n\r\n\r\nApache2 - Error log\r\n\r\n```\r\n[Mon May 11 20:01:13.248338 2015] [auth_gssapi:error] [pid 13516] [client 54.40.222.179:3540] gss_init_sec_context() failed: [Unspecified GSS failure.  Minor code may provide more information (Server not found in Kerberos database)]\r\n```"},"comment":{"url":"https://api.github.com/repos/modauthgssapi/mod_auth_gssapi/issues/comments/105002898","html_url":"https://github.com/modauthgssapi/mod_auth_gssapi/issues/28#issuecomment-105002898","issue_url":"https://api.github.com/repos/modauthgssapi/mod_auth_gssapi/issues/28","id":105002898,"user":{"login":"frenche","id":7945916,"avatar_url":"https://avatars.githubusercontent.com/u/7945916?v=3","gravatar_id":"","url":"https://api.github.com/users/frenche","html_url":"https://github.com/frenche","followers_url":"https://api.github.com/users/frenche/followers","following_url":"https://api.github.com/users/frenche/following{/other_user}","gists_url":"https://api.github.com/users/frenche/gists{/gist_id}","starred_url":"https://api.github.com/users/frenche/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/frenche/subscriptions","organizations_url":"https://api.github.com/users/frenche/orgs","repos_url":"https://api.github.com/users/frenche/repos","events_url":"https://api.github.com/users/frenche/events{/privacy}","received_events_url":"https://api.github.com/users/frenche/received_events","type":"User","site_admin":false},"created_at":"2015-05-24T11:15:10Z","updated_at":"2015-05-24T11:15:10Z","body":"@simo5 I think I can reproduce this when 'GssapiUseS4U2Proxy' is on.\r\n\r\nIt looks like the reason is because when 'use_s4u2proxy' is true we set 'cred_usage' to 'GSS_C_BOTH', later we do 'gss_acquire_cred[from]' and then we do 'gss_inquire_cred' in order to get the 'server' name which we later use as the target name in 'gss_init_sec_context' call.\r\n\r\nBut when 'cred_usage' is set to 'GSS_C_BOTH' in my lab I get the *client* name inside the 'server' when calling 'gss_inquire_cred' which then cause  'gss_init_sec_context' to fail with \"Server not found in Kerberos database\" error.\r\n\r\nHTH,\r\nIsaac B."}}