Red Hat Summit Red Hat Summit지원콘솔개발자평가판 시작연락처

이 콘텐츠는 선택한 언어로 제공되지 않습니다.

Chapter 6. Configuring Applications for Single Sign-On

After a smart card is enrolled, the smart card can be used for SSL client authentication and S/MIME email applications. The PKCS #11 module used by these applications, by default, is located in /usr/lib/libcoolkeypk11.so.

6.1. Configuring Firefox to Use Kerberos for Single Sign-On
링크 복사

Firefox can use Kerberos for single sign-on to intranet sites and other protected websites. For Firefox to use Kerberos, it first has to be configured to send Kerberos credentials to the appropriate KDC.
  1. In the address bar of Firefox, type about:config to display the list of current configuration options.
  2. In the Filter field, type negotiate to restrict the list of options.
  3. Double-click the network.negotiate-auth.trusted-uris entry.
  4. Enter the name of the domain against which to authenticate.
  5. Next, configure the network.negotiate-auth.delegation-uris entry, using the same domain as for network.negotiate-auth.trusted-uris.

Note

Even after Firefox is configured to pass Kerberos credentials, it still requires a valid Kerberos ticket to use. To generate a Kerberos ticket, use the kinit command and supply the user password for the user on the KDC. 
[jsmith@host ~] $ kinit
Password for jsmith@EXAMPLE.COM:
Copy to Clipboard Toggle word wrap
If Kerberos authentication is not working, turn on verbose logging for the authentication process.
  1. Close all instances of Firefox.
  2. In a command prompt, export values for the NSPR_LOG_* variables: 
    export NSPR_LOG_MODULES=negotiateauth:5
export NSPR_LOG_FILE=/tmp/moz.log
    Copy to Clipboard Toggle word wrap
  3. Restart Firefox from that shell, and visit the website where Kerberos authentication is failing.
  4. Check the /tmp/moz.log file for error messages with nsNegotiateAuth in the message.
There are several common errors that occur with Kerberos authentication.
  • The first error says that no credentials have been found. 
    -1208550944[90039d0]: entering nsNegotiateAuth::GetNextToken()
-1208550944[90039d0]: gss_init_sec_context() failed: Miscellaneous failure
No credentials cache found
    Copy to Clipboard Toggle word wrap
    This means that there are no Kerberos tickets (meaning that they expired or were not generated). To fix this, run kinit to generate the Kerberos ticket and then open the website again.
  • The second potential error is if the browser is unable to contact the KDC, with the message Server not found in Kerberos database. 
    -1208994096[8d683d8]: entering nsAuthGSSAPI::GetNextToken()
-1208994096[8d683d8]: gss_init_sec_context() failed: Miscellaneous failure
Server not found in Kerberos database
    Copy to Clipboard Toggle word wrap
    This is usually a Kerberos configuration problem. The correct entries must be in the [domain_realm] section of the /etc/krb5.conf file to identify the domain. For example: 
    .example.com = EXAMPLE.COM
example.com = EXAMPLE.COM
    Copy to Clipboard Toggle word wrap
  • If there are no errors in the log, then the problem could be that an HTTP proxy server is stripping off the HTTP headers required for Kerberos authentication. Try to connect to the site using HTTPS, which allows the request to pass through unmodified.
Red Hat logoGithubredditYoutubeTwitter

자세한 정보

평가판, 구매 및 판매

커뮤니티

Red Hat 문서 정보

Red Hat을 사용하는 고객은 신뢰할 수 있는 콘텐츠가 포함된 제품과 서비스를 통해 혁신하고 목표를 달성할 수 있습니다. 최신 업데이트를 확인하세요.

보다 포괄적 수용을 위한 오픈 소스 용어 교체

Red Hat은 코드, 문서, 웹 속성에서 문제가 있는 언어를 교체하기 위해 최선을 다하고 있습니다. 자세한 내용은 다음을 참조하세요.Red Hat 블로그.

Red Hat 소개

Red Hat은 기업이 핵심 데이터 센터에서 네트워크 에지에 이르기까지 플랫폼과 환경 전반에서 더 쉽게 작업할 수 있도록 강화된 솔루션을 제공합니다.

Theme

© 2026 Red Hat맨 위로 이동