diff options
author | John Molakvoæ <skjnldsv@users.noreply.github.com> | 2022-01-20 23:25:58 +0300 |
---|---|---|
committer | GitHub <noreply@github.com> | 2022-01-20 23:25:58 +0300 |
commit | c0b03000a507f7bdce57eb91deaf4e7d2d67a3b4 (patch) | |
tree | 86019acc692b5e207a2c2efa226620e611b0dfa1 /apps/files_external/3rdparty/icewind/smb/README.md | |
parent | 4466eb1f42c037ed3a71e4a0d549fbe7c7295703 (diff) | |
parent | 13b8179912630acede43aff844f2d302f552cb80 (diff) |
Merge pull request #30782 from nextcloud/backport/29349/stable23v23.0.1rc3
Diffstat (limited to 'apps/files_external/3rdparty/icewind/smb/README.md')
-rw-r--r-- | apps/files_external/3rdparty/icewind/smb/README.md | 31 |
1 files changed, 30 insertions, 1 deletions
diff --git a/apps/files_external/3rdparty/icewind/smb/README.md b/apps/files_external/3rdparty/icewind/smb/README.md index 272c4ebedcd..fec1faefbad 100644 --- a/apps/files_external/3rdparty/icewind/smb/README.md +++ b/apps/files_external/3rdparty/icewind/smb/README.md @@ -44,13 +44,42 @@ $server = $serverFactory->createServer('localhost', $auth); ### Using kerberos authentication ### +There are two ways of using kerberos to authenticate against the smb server: + +- Using a ticket from the php server +- Re-using a ticket send by the client + +### Using a server ticket + +Using a server ticket allows the web server to authenticate against the smb server using an existing machine account. + +The ticket needs to be available in the environment of the php process. + ```php $serverFactory = new ServerFactory(); $auth = new KerberosAuth(); $server = $serverFactory->createServer('localhost', $auth); ``` -Note that this requires a valid kerberos ticket to already be available for php +### Re-using a client ticket + +By re-using a client ticket you can create a single sign-on setup where the user authenticates against +the web service using kerberos. And the web server can forward that ticket to the smb server, allowing it +to act on the behalf of the user without requiring the user to enter his passord. + +The setup for such a system is fairly involved and requires roughly the following this + +- The web server is authenticated against kerberos with a machine account +- Delegation is enabled for the web server's machine account +- Apache is setup to perform kerberos authentication and save the ticket in it's environment +- Php has the krb5 extension installed +- The client authenticates using a ticket with forwarding enabled + +```php +$serverFactory = new ServerFactory(); +$auth = new KerberosApacheAuth(); +$server = $serverFactory->createServer('localhost', $auth); +``` ### Upload a file ### |