aeolusproject/conductor — pull request #15 by mmahut (2012-08-24 08:40:54+00:00)
Title: Basic support for Kerberos SSO authentication

Basic support for web interface SSO authentication with kerberos. It
assumes the HTTP_X_FORWARDED_USER header is passed from the proxy, usually
apache or other web server, in some cases hardware proxy instance with Kerberos
support. After successful verification of HTTP_X_FORWARDED_USER header, this behaves the
same way as ldap. The kerberos authentication is done on the proxy layer due to
security concerns, as the kerberos keytab is often shared among services such as ssh.

Note this is not intended to replace the auth between components, but just to enable
the benefits of SSO as a login into the web interface. There is room for future improvement
too. Maybe even integration with FreeIPA directly into the web interface.