Apache Auth for Icinga Against Kerberos and 2 AD domains

apache-icinga-kerberos.conf

#LogLevel authnz_ldap:debug auth_kerb:debug authz_core:debug

<AuthzProviderAlias ldap-group de.example.com CN=Icinga_Prod,OU=Global-Groups,DC=de,DC=example,DC=com>
  AuthLDAPBindDN "CN=icingaldap,OU=Global-Users,DC=de,DC=example,DC=com"
  AuthLDAPBindPassword "xxx"
  AuthLDAPURL "ldap://de.example.com:3268/DC=de,DC=example,DC=com?sAMAccountName?sub?(objectClass=user)"
</AuthzProviderAlias>

<AuthzProviderAlias ldap-group example.com CN=Icinga_Prod,OU=Global-Groups,DC=de,DC=example,DC=com>
  AuthLDAPBindDN "CN=icingaldap,OU=Global-Users,DC=de,DC=example,DC=com"
  AuthLDAPBindPassword "xxx"
  AuthLDAPURL "ldap://example.com:3268/DC=example,DC=com?sAMAccountName?sub?(objectClass=user)"
</AuthzProviderAlias>

<LocationMatch "^/icingaweb2">
  AuthType Kerberos
  AuthName "Icinga Access"

  KrbMethodNegotiate On
  KrbMethodK5Passwd On
  KrbServiceName HTTP/icinga.de.example.com@DE.example.com
  KrbAuthRealms DE.example.com
  KrbVerifyKDC off
  KrbLocalUserMapping On
  Krb5KeyTab /etc/httpd/apache.keytab

  <RequireAny>
    # OLD example for auth excludes!
    # before rewrite
    #Require expr %{REQUEST_URI} =~ m#^/icinga-web/web/api#
    # after rewrite
    #Require expr %{REQUEST_URI} =~ m#^/icinga-web# && %{QUERY_STRING} =~ m#^/web/api#

    Require de.example.com
    Require example.com
  </RequireAny>
</LocationMatch>

keytab.txt

rm -f /etc/httpd/apache.keytab
 
ktutil
ktutil:  addent -password -p HTTP/icinga.de.example.com@DE.EXAMPLE.COM -k 1 -e arcfour-hmac
ktutil:  addent -password -p HTTP/icinga.de.example.com@DE.EXAMPLE.COM -k 2 -e arcfour-hmac
ktutil:  addent -password -p HTTP/icinga.de.example.com@DE.EXAMPLE.COM -k 1 -e aes128-cts-hmac-sha1-96
ktutil:  addent -password -p HTTP/icinga.de.example.com@DE.EXAMPLE.COM -k 2 -e aes128-cts-hmac-sha1-96
 
ktutil:  write_kt /etc/httpd/apache.keytab
ktutil:  quit
 
chown apache /etc/httpd/apache.keytab

krb5.conf

[libdefaults]
default_realm = DE.EXAMPLE.COM

[realms]
DE.EXAMPLE.COM = {
  auth_to_local = RULE:[1:$1@$0](.*@EXAMPLE\.COM$)s/@.*$//
  auth_to_local = DEFAULT
}