mod_proxy_kcd

Deutsch · English

mod_proxy_kcd is an Apache HTTP Server module that turns an identity already authenticated by OpenID Connect into an outbound Kerberos constrained- delegation credential:

Browser -> Apache + OIDC/MFA -> S4U2Self -> S4U2Proxy -> Exchange OWA

It is intended for organizations that need modern authentication and MFA in front of an on-premises application that still accepts HTTP Negotiate. The reference deployment uses Authentik and Microsoft Exchange OWA, but the module itself is not tied to a specific OpenID Provider.

Apache validates the login with mod_auth_openidc. mod_proxy_kcd reads the authenticated UPN, asks MIT Kerberos for an S4U2Self/S4U2Proxy credential, wraps the result in SPNEGO, and places Authorization: Negotiate ... on the request sent by mod_proxy_http. The user's Active Directory password is never requested, received, or stored by the module.

Project status

Version 0.1.0 is a deployable pilot release, not a statement of broad production maturity or Microsoft support. It has:

• strict-warning C builds and unit tests;
• a real Apache module-load/configuration test;
• a disposable Samba AD S4U2Self/S4U2Proxy integration test;
• a successful production-path test against Authentik and Exchange with Extended Protection, plus Outlook/MAPI and ActiveSync through HAProxy;
• Debian and RPM packaging templates.

Every deployment still requires a controlled pilot, a reviewed rollback, correct SPN ownership, a coordinated certificate lifecycle, and application- specific acceptance testing. Do not expose a production service merely because the included probe succeeds.

Security properties

• Uses MIT GSSAPI rather than implementing Kerberos.
• Supports an explicit service principal and an explicit target SPN.
• Computes RFC 5929 tls-server-end-point channel-binding data for Exchange Extended Protection.
• Replaces untrusted inbound Authorization on the final proxy-header hook.
• Rejects missing/malformed UPNs and unapproved UPN suffixes.
• Limits generated token size and fails closed.
• Can strip upstream authentication challenges so a KCD failure does not turn into a browser password prompt.
• Never logs or prints a Kerberos token unless kcd-probe --print-token is explicitly requested.

The keytab is a high-value secret: possession may allow impersonation to every service permitted by its constrained-delegation configuration. Read the security model before installation.

Compatibility baseline

• Apache HTTP Server 2.4 with mod_proxy and mod_proxy_http.
• MIT Kerberos 1.17 or later for enterprise names and credential stores.
• MIT Kerberos 1.22 or later only when KcdRequestChannelBoundFlag On is used. With 1.19–1.21, keep it off and use client_aware_channel_bindings = true in krb5.conf.
• OpenSSL 1.1.1 or 3.x.
• A current security-fixed mod_auth_openidc (2.4.20.3 or later).
• A supported Microsoft Exchange Server Subscription Edition build for the reference OWA scenario.

The protocol is compatible with Exchange 2016/2019, but those products left normal support in October 2025. Compatibility is not a recommendation to publish unsupported software.

Build

Required development packages are Apache/APXS, MIT Kerberos GSSAPI, OpenSSL, a C compiler, make, and pkg-config.

make test all
sudo make install

Reproducible container build and Apache syntax/module-load check:

podman build --target build -f Containerfile .

Disposable Samba AD integration test:

docker build -f tests/integration/Containerfile -t mod-proxy-kcd-integration .
docker run --rm --hostname dc1.example.test mod-proxy-kcd-integration

Use a rootful container engine for this test. Samba AD provisioning is not reliable inside all rootless user-namespace and overlay-filesystem setups.

Documentation

1. Architecture
2. Security model
3. English deployment and rollback guide
4. Deutsche Installations- und Rollback-Anleitung
5. Directive reference
6. Troubleshooting
7. Apache example
8. HAProxy edge-routing example

Important design boundary

Interactive OIDC redirects are appropriate for browser OWA traffic. They are not appropriate for Outlook/MAPI, ActiveSync, Autodiscover, SMTP, or Exchange Remote PowerShell. Keep those protocols on their supported native authentication paths. The reference architecture therefore places HAProxy in front of Apache: OWA and the OIDC callback go to Apache, while selected native client paths go directly to Exchange. HAProxy forces HTTP/1.1 and http-reuse never for NTLM so backend connections are not shared across clients. ECP, EWS, PowerShell, and unknown paths are denied with HTTP 403 at the public frontend. Blocking EWS externally can disable Outlook and third-party features that depend on EWS.

References

• Apache reverse proxy
• MIT Kerberos GSSAPI S4U
• RFC 5929: Channel Bindings for TLS
• Microsoft Exchange Extended Protection
• Microsoft Exchange Kerberos/ASA
• Authentik OAuth2/OIDC provider
• mod_auth_openidc

License

Apache License 2.0. See LICENSE.