Kerberos support for active checks (SMBCLIENT and HTTP)

Comments: 3

Oldest • Newest • Most likes • Fewest likes

• Add a comment
• 26 May, '25
  Mario

  Highlighted comment
  
  The curl command also supports Kerberos authentication; however, the implemented check_httpv2 command only supports Basic and Token authentication.
  
  Would it be possible to add support for Kerberos authentication here as well?
  
  With curl, Kerberos authentication can be used as follows:
  curl --negotiate -u sAMAccountName@domainname.tld:password https://servername.tld --verbose # uses a user account
  curl --negotiate -u : https://domainname.tld --verbose # uses the computer account

  2 Copy link to this comment
• 26 May, '25
  Mario

  I tried several things, and the smclient check works out of the box with Kerberos authentication. I only had to adjust the /etc/krb5.conf accordingly and use the UPN for authentication.
  For all those using an appliance, it would be great if the Kerberos configuration could be set up via the web interface.
  
  [libdefaults]
  default_realm = DOMAINNAME.TLD
  dns_lookup_relam = true
  dns_lookup_kdc = true
  ticket_lifetime = 24h
  renew_lifetime = 7d
  forwardable = true
  clockskew = 300
  
  [realms]
  DOMAINNAME.TLD = {
  kdc = kdc1.domainname.tld
  kdc = kdc2.domainname.tld
  admin_server = kdc1.domainname.tld
  default_domain = DOMAINNAME.TLD
  }
  
  [domain_realm]
  domainname.tld = DOMAINNAME.TLD
  .domainname.tld = DOMAINNAME.TLD

  1 Copy link to this comment
• 02 Dec, '25
  Pietro R

  Good morning,
  I am here because Bash Curl has a --negotiate switch of which the behavior can't be replicated in the new http_check
  I would love such a switch to be present, for now... I'll resort to writing a local check!

  Copy link to this comment