Code Monkey home page Code Monkey logo

omniauth-kerberos's Introduction

Omniauth::Strategies::Kerberos

Build Status Code Climate Test Coverage

omniauth-kerberos is a simple OmniAuth strategy to authenticate using a Kerberos server. omniauth-kerberos can be used as an authenticator for OmniAuth MultiPassword.

Installation

Add this line to your application's Gemfile:

gem 'omniauth-kerberos'

And then execute:

$ bundle

Or install it yourself as:

$ gem install omniauth-kerberos

Kerberos development headers are required to build dependencies.

On Debian try:

$ sudo apt-get install libkrb5-dev

Usage

Use omniauth-kerberos like any other OmniAuth strategy:

Rails.application.config.middleware.use OmniAuth::Builder do
  provider :kerberos
end

You still need to configure your system for Kerberos usage like specifying realms. If you has your own login form you can specify the fields to use:

Rails.application.config.middleware.use OmniAuth::Builder do
  provider :kerberos, :fields => [ :login, :pwd ]
end

Options

** title ** The title text shown on default login form. (default: "Restricted Access")

** fields ** The request parameter names to fetch username and password. (default: [ "username", "password" ])

License

MIT License

Copyright (c) 2012, Jan Graichen

omniauth-kerberos's People

Contributors

jgraichen avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar

omniauth-kerberos's Issues

Bump timfel-krb5-auth version to 0.8.3

Hi,

Can you please bump your dependency on timfel-krb5-auth to the latest version? There has been a patch which resolves an issue when building timfel-krb5-auth on some systems. Version 0.8.3 resolves this issue.

Thanks!

Vulnerable to Zanarotti attack

As the MIT Kerberos docs say

Whenever a program grants access to a resource (such as a local login session on a desktop computer) based on a user successfully getting initial Kerberos credentials, it must verify those credentials against a secure shared secret (e.g., a host keytab) to ensure that the user credentials actually originate from a legitimate KDC. Failure to perform this verification is a critical vulnerability, because a malicious user can execute the “Zanarotti attack”: the user constructs a fake response that appears to come from the legitimate KDC, but whose contents come from an attacker-controlled KDC.

In other words: since omniauth-kerberos does not provide any way to verify the providence of the user credentials, it is vulnerable to spoofing the KDC.

Release new version

Hi,
I am packaging omniauth-kerberos for Debian, as part of GitLab packaging. I saw that you have added some tests (thanks for those, btw) after the last release. Can you cut a new release with these tests included? It would be a great help.

Thanks

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.