PHP kerberos 委派

Question

我如何使用 php 将 kerberos 身份验证转发到另一台服务器(使用 CURL)。我的请求中有 $_SERVER['KRB5CCNAME']，我需要使用 curl 将其委托(delegate)给另一台服务器。

如何做到这一点？

代码:

$ch = curl_init();

$url = 'http://www.somesite.com/info.php';

@curl_setopt($ch, CURLOPT_HTTPGET, 1);

@curl_setopt($ch, CURLOPT_GSSAPI_DELEGATION, CURLGSSAPI_DELEGATION_FLAG);
@curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_GSSNEGOTIATE);
@curl_setopt($ch, CURLOPT_USERPWD, ":");

@curl_setopt($ch, CURLOPT_URL, $url);
@curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$resultContent = @curl_exec($ch);

$httpCode = @curl_getinfo($ch, CURLINFO_HTTP_CODE);

if(@curl_errno($ch))
{
    $msg = @curl_error($ch);
    curl_close($ch);
    die('Curl error: content: '.$this->resultContent.' code: '.$this->httpCode);
}

curl_close($ch);

die('R: code: '.$httpCode.' content: '. htmlspecialchars($resultContent));

编辑:

我刚刚发现 php 5.3 没有 CURLOPT_GSSAPI_DELEGATION，它是在 5.5.0 alpha 3 中添加的。处理一个问题，看看是否是问题所在。

Answer 1

如 http://curl.haxx.se/libcurl/c/curl_easy_setopt.htmlCURLOPT_GSSAPI_DELEGATION

Set the parameter to CURLGSSAPI_DELEGATION_FLAG to allow unconditional GSSAPI credential delegation. The delegation is disabled by default since 7.21.7. Set the parameter to CURLGSSAPI_DELEGATION_POLICY_FLAG to delegate only if the OK-AS-DELEGATE flag is set in the service ticket in case this feature is supported by the GSSAPI implementation and the definition of GSS_C_DELEG_POLICY_FLAG was available at compile-time.

OK-AS-DELEGATE 标志应在 Kerberos 服务票据(领域策略)中设置。