Kerberos gssapi with laravel

[Aditya51293]

I am trying to use Gssapi for the laravel using apache with Kerberos authentication it is working fine but when I try to perform some search operations it is using frequent requests so multiple authentication is taking place.Can I use any cache mechanism for it as it will be reducing the time. Please let me know if you have any documentation for it

[simo5]

See sessions support:
https://github.com/gssapi/mod_auth_gssapi?tab=readme-ov-file#gssapiusesessions
https://github.com/gssapi/mod_auth_gssapi?tab=readme-ov-file#gssapisessionkey

[Aditya51293]

Thanks,but in mod_auth_kerb there was in built cache system which had the token in server so it didn’t authenticate with KDC for each request. Same way do we have or implement any cache for the user token in server for gssapi. Actually for fetching data from AD it takes 10 seconds.

[simo5]

Clients do not need to fetch new tickets to create a new GSS token.

If you see that behavior check your browser configuration, it may have enabled delegation, which you should not use.
Delegation sends the user's TGT to the server, which is generally not something you want to do, and generally GSSAPI applications do obtain a fresh TGT for forwarding every time increasing the load on the KDC and the latency.
In Firefox network.negotiate-auth.delegation-uris should not be set.

Another case may arise if you have canonicalization turned on the the client does know exactly how to resolve the ticket from the server name directly. If the client get confuse it may try to obtain a ticket every time because it does not recognize that it already has one for the name that results from canonicalization.

Otherwise GSSAPI fetches a server ticket from the KDC only the first time the server is contacted, and after that uses the same server ticket to create a new GSS Token for each authentication completely locally. The server also does a completely local check to verify the client GSS Token.

The reason to use sessions is that most browsers are quite dumb and do not cache the fact a URI needs authentication resulting in multiple roundtrips to access the server for each connection.
With a session you can dedicate a separate endpoint (say /login) to perform GSSAPI authentication, and then just use the session cookie for authentication to any other resource, avoiding the overhead of the roundtrips, and some corner cases with POST/PUT verbs as well which do not always behave properly with 401s being returned for authentication.

For example if no session cookie is present the browser could be redirected to /login to perform the one GSSAPI auth and then back to whatever URL it wanted, the session cookie would have to be set with the proper domain restriction to apply only to whatever areas it should be used in.
Any application that can delegated authentication to other methods (like oauth, oidc, saml, etc...) should be able to support such workflows, but it can also be done with HTTPD config directives if the application is dumb.

HTH

[Aditya51293]

Thanks but I tried but when the request is sent to AD based on the searched name etc it is trying to authenticate each character while sending the request due to which it is taking some more time. So still checking on that