= VTLUUG has been using Kerberos and LDAP for authentication since at least September 2012. Our realm is <code>VTLUUG.ORG</code> but may change in the future to something under the vt.edu domain.=

In April 2013VTLUUG uses [[Infrastructure:Chimera|chimera]] as it's FreeIPA server, and all VTLUUG hosts except [[Infrastructure:Joey|joey]], Kerberos authentication on acidburn was forced because a Debian bug had required passwords to be sent in plaintext to the LDAP server. If you router, are unable to login, you'll need to provide sufficient proof of your identity to an officer so your password can be resetin its domain.

==SSH Authentication with KerberosAccount maintenance instructions ==Put this in your ~/.ssh/config: # Kerberos Host * GSSAPIAuthentication yes GSSAPIDelegateCredentials yes

Then you All users can just <code>kinit user@VTLUUGlog into [https://chimera.vtluug.org Chimera's FreeIPA web GUI] to edit their account. Yes, it does have a self signed cert.ORG<Get over it /code> s For management of the entire domain, officers are able to add, remove, or modify users in any way. == History == VTLUUG has been was Kerberos and you LDAP for authentication until the [[CVL eviction]]. We then migrated to an LDAP only domain due to a lack of IPv6 on behind router.ece.vt.edu. The old Kerberos server was configured to work on IPv6 only, therefore, we were required to migrate away from its use for authentication. With the old deployment, [[Infrastructure:Acidburn|acidburn]] should be able acceptable through normal password authentication over ssh. There is no need to configure tickets or anything else Kerberos related.  = CAS = The '''Virginia Tech Central Authentication System''' or '''CAS''' is the Virginia Tech deployment of the [[Free software|open source]] [[w:Shibboleth (Internet2)|Shibboleth]] authentication system. Shibboleth can be thought of as an identity provider similar to [[w:OpenID|OpenID]], but more centralized, and thus well-liked by institutions such as universities. == Scripted Login ==The following is a work in progress. Eventually, the following commands should yield a login.<codepre>ssh user@acidburn$ curl -s -c cookies https://auth.vt.edu/login?service=https://my.vtluugvt.orgedu/Login | sed -nrf sedconf | xargs curl</pre> The <code>sedconf</code> without file's contents are below.<pre>/name="lt"/s/.*value="([^"]*).*/-d "lt=\1"/p/name="_eventId"/s/.*value="([^"]*).*/-d "eventId=\1"/p/name="submit"/s/.*value="(^")*".*/-d "submit=\1"/p/action="/s/.*action="([^;]*)[^?]*(\??[^"]*).*/--url "https:\/\/auth.vt.edu\1\2"/p$a -d "username=bob"$a -d "password. You can also login =bubba"$a -c cookies</pre> Refer to any machine the [[sed]] and [[curl]] manual pages for details on our cluster or most of the machines on woodvarious commands that drive this script. =External Links=* [https://auth.vt.edu VT CAS]* [http://www.computing.vt. Note that IPv6 is currently required for getting Kerberos ticketsedu/infrastructure_services/cas/index.html Description of CAS] [[Category:Infrastructure]][[Category:Scripts]][[Category:Campus computing resources]]