プライベートロケーションでのKerberos（SPNEGO）認証のサポート

$
sudo dnf install -y krb5-server krb5-workstation

$
sudo tee /etc/krb5.conf > /dev/null <<'EOF'
$
[libdefaults]
$
    default_realm = <REALM_NAME>
$
    dns_lookup_realm = false
$
    dns_lookup_kdc = false
$
    rdns = false
$

$
[realms]
$
    <REALM_NAME> = {
$
        kdc = <EC2_PRIVATE_IP>
$
        admin_server = <EC2_PRIVATE_IP>
$
    }
$

$
[domain_realm]
$
    <EC2_INTERNAL_HOSTNAME> = <REALM_NAME>
$
EOF

$
sudo tee /var/kerberos/krb5kdc/kdc.conf > /dev/null <<'EOF'
$
[kdcdefaults]
$
    kdc_ports = 88
$
    kdc_tcp_ports = 88
$

$
[realms]
$
    <REALM_NAME> = {
$
        acl_file = /var/kerberos/krb5kdc/kadm5.acl
$
        dict_file = /usr/share/dict/words
$
        admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
$
        supported_enctypes = aes256-cts-hmac-sha1-96:normal aes128-cts-hmac-sha1-96:normal
$
    }
$
EOF

$
# Create the Kerberos database (assign a master password when prompted)
$
sudo kdb5_util create -r <REALM_NAME> -s
$

$
# Grant admin permissions and enable KDC services on system boot
$
echo "*/admin@<REALM_NAME> *" | sudo tee /var/kerberos/krb5kdc/kadm5.acl
$
sudo systemctl enable --now krb5kdc kadmin

$
mkdir -p /home/ec2-user/kerb-test
$

$
# 1. Create client principal & keytab for synthetics runners
$
sudo kadmin.local -q "addprinc -randkey <CLIENT_PRINCIPAL>@<REALM_NAME>"
$
sudo kadmin.local -q "ktadd -k <CLIENT_KEYTAB_PATH> <CLIENT_PRINCIPAL>@<REALM_NAME>"
$
sudo chmod 644 <CLIENT_KEYTAB_PATH>
$

$
# 2. Create HTTP service principal name (SPN) keytab for the web server
$
sudo kadmin.local -q "addprinc -randkey HTTP/<EC2_INTERNAL_HOSTNAME>@<REALM_NAME>"
$
sudo kadmin.local -q "ktadd -k /home/ec2-user/kerb-test/http.keytab HTTP/<EC2_INTERNAL_HOSTNAME>@<REALM_NAME>"
$
sudo chown 33:33 /home/ec2-user/kerb-test/http.keytab
$
sudo chmod 644 /home/ec2-user/kerb-test/http.keytab

$
mkdir -p ~/kerb-test/httpd-image && cd ~/kerb-test/httpd-image
$

$
cat > kerb-test.conf <<'EOF'
$
<Location /kerb-test>
$
    AuthType GSSAPI
$
    AuthName "Kerberos Login"
$
    GssapiCredStore keytab:/etc/krb5-http.keytab
$
    Require valid-user
$
</Location>
$
EOF
$

$
cat > Dockerfile <<'EOF'
$
FROM debian:bookworm-slim
$
RUN apt-get update && \
>
    apt-get install -y --no-install-recommends apache2 libapache2-mod-auth-gssapi krb5-user && \
>
    a2enmod auth_gssapi && \
>
    mkdir -p /var/www/html/kerb-test && \
>
    echo '<h1>Kerberos SSO worked</h1>' > /var/www/html/kerb-test/index.html && \
>
    rm -rf /var/lib/apt/lists/*
$
COPY kerb-test.conf /etc/apache2/conf-enabled/kerb-test.conf
$
EXPOSE 80
$
CMD ["apache2ctl", "-D", "FOREGROUND"]
$
EOF
$

$
docker build -t kerb-test-httpd .
$

$
docker run -d --name kerb-test-httpd \
>
  -p 8080:80 \
>
  -v /etc/krb5.conf:/etc/krb5.conf:ro \
>
  -v /home/ec2-user/kerb-test/http.keytab:/etc/krb5-http.keytab:ro \
>
  kerb-test-httpd

$
# 1. Map internal hostname in /etc/hosts
$
echo "<EC2_PRIVATE_IP> <EC2_INTERNAL_HOSTNAME>" | sudo tee -a /etc/hosts
$

$
# 2. Verify unauthenticated challenge returns 401 Unauthorized
$
curl -i http://<EC2_INTERNAL_HOSTNAME>:8080/kerb-test/
$

$
# 3. Test ticket acquisition and end-to-end Kerberos SSO
$
kinit -kt <CLIENT_KEYTAB_PATH> <CLIENT_PRINCIPAL>@<REALM_NAME>
$
curl --negotiate -u : -i http://<EC2_INTERNAL_HOSTNAME>:8080/kerb-test/

$
docker run -d \
>
  --name sjm-container \
>
  --restart unless-stopped \
>
  -e PRIVATE_LOCATION_KEY=<PRIVATE_LOCATION_KEY> \
>
  -e KERBEROS_REALM=<REALM_NAME> \
>
  -e KERBEROS_KDC=<EC2_PRIVATE_IP> \
>
  -e KERBEROS_HOST_ALLOWLIST=<EC2_INTERNAL_HOSTNAME> \
>
  -e KERBEROS_KEYTAB_HOST_PATH=<CLIENT_KEYTAB_PATH> \
>
  -e RUNTIME_EXTRA_HOSTS=<EC2_INTERNAL_HOSTNAME>:<EC2_PRIVATE_IP> \
>
  -v /var/run/docker.sock:/var/run/docker.sock:rw \
>
  -v <CLIENT_KEYTAB_PATH>:<CLIENT_KEYTAB_PATH>:ro \
>
  newrelic/synthetics-job-manager

$
podman run -d \
>
  --pod SYNTHETICS \
>
  --restart unless-stopped \
>
  -e PRIVATE_LOCATION_KEY=<PRIVATE_LOCATION_KEY> \
>
  -e CONTAINER_ENGINE=PODMAN \
>
  -e PODMAN_API_SERVICE_PORT=8000 \
>
  -e PODMAN_POD_NAME=SYNTHETICS \
>
  -e KERBEROS_REALM=<REALM_NAME> \
>
  -e KERBEROS_KDC=<EC2_PRIVATE_IP> \
>
  -e KERBEROS_HOST_ALLOWLIST=<EC2_INTERNAL_HOSTNAME> \
>
  -e KERBEROS_KEYTAB_HOST_PATH=<CLIENT_KEYTAB_PATH> \
>
  -v <CLIENT_KEYTAB_PATH>:<CLIENT_KEYTAB_PATH>:ro,Z \
>
  newrelic/synthetics-job-manager