Question

我正在编写一个PHP Web应用程序，它必须使用Kerberos 5身份验证（Active Directory）连接到Web服务。我的PHP网站托管在IIS 7.5上，PHP 5.5。应用程序池在Active Directory中授权的帐户和目标Web服务下运行。

我尝试了在本网站和其他网站上找到的每个示例代码但无济于事。

这是我现在使用的PHP代码：

$url = 'http://mywebservice/login/kerberos';

$ch = curl_init();

    $options = [
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_VERBOSE        => true,
        CURLOPT_HTTPAUTH       => CURLAUTH_GSSNEGOTIATE,
        CURLOPT_HTTPHEADER     => ['Authorization: Negotiate'],
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_USERPWD        => 'myuser',
        CURLOPT_URL            => $url,
        CURLOPT_HEADER         => 1
    ];

    curl_setopt_array( $ch, $options);

    $result = curl_exec($ch);



$header_size = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
$header = substr($result, 0, $header_size);
$body = substr($result, $header_size);

print $result;

这给了我以下信息：

HTTP/1.1 302 Found Date: Fri, 21 Oct 2016 14:49:15 GMT X-Robots-Tag: noindex,nofollow WWW-Authenticate: Location: http://mywebservice/login?login_fail Content-Length: 0

当我删除CURLOPT_HTTPHEADER =＆gt; [＆＃39;授权：协商＆＃39;]我从curl模块收到内部服务器错误。

当我使用curl命令行时，我得到以下结果：

curl --negotiate http://mywebservice/login/kerberos -umyuser@mydomain --verbose -c "c:\cookie.txt" -b "c:\cookie.txt"

Enter host password for user 'myuser@mydomain':
*   Trying (192.168.1.1...
* Connected to mywebservice (192.168.1.1) port 80 (#0)
> GET /login/kerberos HTTP/1.1
> User-Agent: curl/7.41.0
> Host: mywebservice 
> Accept: */*
> Cookie: JSESSIONID_PUBLIC=X(MASKED)XXXXXXXXXXXXXXXXX
>
< HTTP/1.1 401 Unauthorized
< Date: Fri, 21 Oct 2016 14:52:46 GMT
< X-Robots-Tag: noindex,nofollow
< WWW-Authenticate: Negotiate
< Expires: Thu, 01 Jan 1970 00:00:00 GMT
< Last-Modified: Thu, 20 Oct 2016 14:52:46 GMT
< Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
< Pragma: no-cache
< P3P: CP=CAO PSA OUR
< Content-Type: text/html; charset=UTF-8
< Content-Length: 3643
<
* Ignoring the response-body
* Connection #0 to host mywebservice left intact
* Issue another request to this URL: 'http://mywebservice/login/kerberos'
* Found bundle for host mywebservice: 0xXXXXXXX
* Re-using existing connection! (#0) with host mywebservice
* Connected to mywebservice (192.168.1.1) port 80 (#0)
* Server auth using Negotiate with user 'myuser@mydomain'
> GET /login/kerberos HTTP/1.1
> Authorization: Negotiate X(MASKED)XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXD
w==

> User-Agent: curl/7.41.0
> Host: mywebservice
> Accept: */*
> Cookie: JSESSIONID_PUBLIC=X(MASKED)XXXXXXXXXXXXXXXXX
>
< HTTP/1.1 302 Found
< Date: Fri, 21 Oct 2016 14:52:46 GMT
< X-Robots-Tag: noindex,nofollow
< WWW-Authenticate:
< Location: http://mywebservice/?login_fail
< Content-Length: 0
<
* Connection #0 to host mywebservice left intact

当我使用KerberosAuthenticationTester工具（http://blog.michelbarneveld.nl/michel/archive/2009/12/05/kerberos-authentication-tester.aspx）进行测试时，我会在传递网址和凭据时立即对我进行身份验证。

我认为它不起作用，因为我错过了krb5库。我找不到它作为DLL，所以我尝试在Visual Studio中使用PHP源重新编译它。这对我来说也不起作用，我缺少config.w32文件。如果有必要，我可以详细说明，但首先我想知道这是否真的需要。我还安装了MIT Kerberos，但这并没有帮助。

我需要krb5 DLL是正确的，还是我在错误的轨道上？如果我需要这个DLL，我在哪里可以得到它或如何编译它？如果有另一种解决方案，我会很高兴听到它。感谢大家花时间和我一起回复！

在IIS中使用PHP中的Kerberos对Web服务进行身份验证

0 个答案: