Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 2. Configuring Kerberos authentication for the Apache HTTP web server

To use the mod_auth_gssapi Apache module on Red Hat Enterprise Linux (RHEL), configure Kerberos authentication for the Apache HTTP web server. The Generic Security Services API (GSSAPI) is an interface for applications that make requests to use Kerberos security libraries.

2.1. Setting up gss-proxy in an IdM environment
Copy link

To enable secure and authenticated access to Kerberos-protected resources across various services and applications, you can set up the Generic Security Services Proxy (GSS-Proxy) on the Apache HTTP web server. You can implement the gssproxy service to enable privilege separation for the httpd server. gssproxy provides security optimization to this process. Note that the mod_auth_gssapi module replaces the mod_auth_kerb module, which is no longer available in the current version of Red Hat Enterprise Linux (RHEL).

Prerequisites

  • You have installed the httpd, mod_auth_gssapi and gssproxy packages.
  • You have set up and started the httpd service.

Procedure

  1. Enable access to the keytab file of the HTTP/<SERVER_NAME>@realm principal by creating the service principal: 

    # ipa service-add HTTP/<SERVER_NAME>
    Copy to Clipboard Toggle word wrap

  2. Retrieve the keytab for the principal stored in the /etc/gssproxy/http.keytab file: 

    # ipa-getkeytab -s $(awk '/^server =/ {print $3}' /etc/ipa/default.conf) -k /etc/gssproxy/http.keytab -p HTTP/$(hostname -f)
    Copy to Clipboard Toggle word wrap

    This step sets permissions to 400, therefore only the root user has access to the keytab file. The apache user does not.

  3. Create the /etc/gssproxy/80-httpd.conf file with the following content: 

    [service/HTTP]
  mechs = krb5
  cred_store = keytab:/etc/gssproxy/http.keytab
  cred_store = ccache:/var/lib/gssproxy/clients/krb5cc_%U
  euid = apache
    Copy to Clipboard Toggle word wrap

  4. Restart and enable the gssproxy service: 

    # systemctl restart gssproxy.service
# systemctl enable gssproxy.service
    Copy to Clipboard Toggle word wrap

Verification

  1. Obtain a Kerberos ticket: 

    # kinit
    Copy to Clipboard Toggle word wrap
  2. Open the URL to the protected directory in a browser.

For details, see gssproxy(8), gssproxy-mech(8), gssproxy.conf(5) man pages on your system.

To ensure only authorized users can access or modify contents in the /var/www/html/private/ directory, you can configure Kerberos authentication for this directory.

Prerequisites

  • You have installed the httpd, mod_auth_gssapi and gssproxy packages.
  • You have set up and started the httpd service.
  • You have configured and started the gssproxy service.

Procedure

  1. Configure the mod_auth_gssapi module to protect the /var/www/html/private/ directory: 

    <Location /var/www/html/private>
  AuthType GSSAPI
  AuthName "GSSAPI Login"
  Require valid-user
</Location>
    Copy to Clipboard Toggle word wrap

  2. Create system unit configuration drop-in file: 

    # systemctl edit httpd.service
    Copy to Clipboard Toggle word wrap

  3. Add the following parameter to the system drop-in file: 

    [Service]
Environment=GSS_USE_PROXY=1
    Copy to Clipboard Toggle word wrap

  4. Reload the systemd configuration: 

    # systemctl daemon-reload
    Copy to Clipboard Toggle word wrap

  5. Restart the httpd service: 

    # systemctl restart httpd.service
    Copy to Clipboard Toggle word wrap

Verification

  1. Obtain a Kerberos ticket: 

    # kinit
    Copy to Clipboard Toggle word wrap
  2. Open the URL to the protected directory in a browser.
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2026 Red HatBack to top