WWW-Authenticate in 200 OK response

[Maxim Dounin]

Hello!

On Mon, Sep 17, 2018 at 09:18:51PM +0000, Nica, George via nginx wrote:

> Thank you Maxim.
> We are using Kerberos, on Linux. And per-request authentication, we are not trying to use session-level authentication.
> Would the ntlm module help here?

The problem is with "WWW-Authenticate: Negotiate".  As it is 
specified by rfc4559, and it's screwed up: it authenticates a 
connection, and hence cannot properly work through proxies.  See 
further details here in the RFC, and errata notice for it:

https://tools.ietf.org/html/rfc4559#section-6
https://www.rfc-editor.org/errata_search.php?rfc=4559

If you are trying to proxy to a backend which uses 
"WWW-Authenticate: Negotiate", this is likely the problem you are 
facing: it cannot work though a proxy.  If it's the case, the 
"ntlm" directive will help.

But if you are instead trying to authenticate clients on nginx side, 
proxying is probably not relevant, see below.

> We are already using spnego-http-auth-nginx-module to help with SPNego/GSSAPI.
> So our issue/incompatibility seems to be between backend / nginx with spnego-http-auth-nginx-module / client. The first two sending/passing the extra headers on the response and the client getting confused by it.
> As you say, nginx is a generic HTTP proxy here, so we will have to figure things out with our server / client / spnego-http-auth-nginx-module.
> Are there any other suggested approaches regarding using nginx and Kerberos?

If the authentication is expected to happen on nginx side, this 
can work - assuming the spnego-http-auth-nginx-module does the right 
thing.

Looking at the spnego-http-auth-nginx-module I suspect that both 
"WWW-Authenticate" headers are generated by the module.  Try 
looking into the module documentation and sources to find out how 
to use it properly.  In particular, docs suggest that

    auth_gss_allow_basic_fallback off;

will disable "WWW-Authenticate: Basic", and it might make your 
client happy.

-- 
Maxim Dounin
http://mdounin.ru/