{"action":"created","issue":{"url":"https://api.github.com/repos/skavanagh/KeyBox/issues/112","labels_url":"https://api.github.com/repos/skavanagh/KeyBox/issues/112/labels{/name}","comments_url":"https://api.github.com/repos/skavanagh/KeyBox/issues/112/comments","events_url":"https://api.github.com/repos/skavanagh/KeyBox/issues/112/events","html_url":"https://github.com/skavanagh/KeyBox/issues/112","id":113551578,"number":112,"title":"Other authentication methods ","user":{"login":"splashx","id":1154133,"avatar_url":"https://avatars.githubusercontent.com/u/1154133?v=3","gravatar_id":"","url":"https://api.github.com/users/splashx","html_url":"https://github.com/splashx","followers_url":"https://api.github.com/users/splashx/followers","following_url":"https://api.github.com/users/splashx/following{/other_user}","gists_url":"https://api.github.com/users/splashx/gists{/gist_id}","starred_url":"https://api.github.com/users/splashx/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/splashx/subscriptions","organizations_url":"https://api.github.com/users/splashx/orgs","repos_url":"https://api.github.com/users/splashx/repos","events_url":"https://api.github.com/users/splashx/events{/privacy}","received_events_url":"https://api.github.com/users/splashx/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-10-27T10:26:02Z","updated_at":"2015-10-29T18:44:21Z","closed_at":null,"body":"* Kerberos\r\nI have a use case where the Keybox would be seating behind a reverse proxy. Users are authenticated using Kerberos ([PKINIT](http://web.mit.edu/kerberos/krb5-1.13/doc/admin/pkinit.html)) - KeyBox in this  case could support [Kerberos Constrained Delegation](http://k5wiki.kerberos.org/wiki/Projects/ConstrainedDelegation).\r\n\r\n* Radius\r\n\r\nAny plans to extend authentication? :)"},"comment":{"url":"https://api.github.com/repos/skavanagh/KeyBox/issues/comments/152283584","html_url":"https://github.com/skavanagh/KeyBox/issues/112#issuecomment-152283584","issue_url":"https://api.github.com/repos/skavanagh/KeyBox/issues/112","id":152283584,"user":{"login":"splashx","id":1154133,"avatar_url":"https://avatars.githubusercontent.com/u/1154133?v=3","gravatar_id":"","url":"https://api.github.com/users/splashx","html_url":"https://github.com/splashx","followers_url":"https://api.github.com/users/splashx/followers","following_url":"https://api.github.com/users/splashx/following{/other_user}","gists_url":"https://api.github.com/users/splashx/gists{/gist_id}","starred_url":"https://api.github.com/users/splashx/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/splashx/subscriptions","organizations_url":"https://api.github.com/users/splashx/orgs","repos_url":"https://api.github.com/users/splashx/repos","events_url":"https://api.github.com/users/splashx/events{/privacy}","received_events_url":"https://api.github.com/users/splashx/received_events","type":"User","site_admin":false},"created_at":"2015-10-29T18:44:21Z","updated_at":"2015-10-29T18:44:21Z","body":"I may be mistaken, but not quite - the suggestion works when the user authenticates directly to KeyBox, e.g.:\r\n\r\nuser ----> https://keybox.example.com:8443/\r\n \r\nI myself have tried this setup and it works without changing the code. Steps:\r\n\r\n1. configure /etc/krb5.conf @ keybox (realm, kdc address etc) \r\n1. create a \"krb5\" block in jass.conf \r\n```\r\nkrb {\r\n com.sun.security.auth.module.Krb5LoginModule required;\r\n};\r\n```\r\n1. set \"jassModule\" to \"krb5\" on `KeyBoxConfig.properties`\r\n1. To login, the user enters `username@EXAMPLE.COM` (EXAMPLE.COM = realm) and the kerberos password\r\n\r\nIn cases where a reverse proxy is providing user the access, e.g.: \r\n\r\nuser -----> https://reverse-proxy.example.com/ -------> https://keybox.example.com:8443/\r\nin my case:\r\nuser -----> apache with ProxyPass+Kerberos(authn)+LDAP(authz) -----> keybox \r\n\r\nThe user doesn't really see the keybox address in the address bar  but reverse-proxy.example.com (that's good).\r\nHowever the authentication happens at the reverse proxy level (using mod_auth_kerb) - if authn is successful, the user is then forwarded to keybox:\r\nCURRENTLY: keybox presents the user with the standard username/password+otp login page \r\nDESIRED:  present the user to enter only the OTB code since the username/password authentication already happened before.\r\n\r\nThat is possible becuase the reverse proxy sends out extra header info via http (REMOTE_USER, etc), so Keybox should be able to work with that..."}}