- Can I use rednose/kerberos-bundle in a Laravel application?
- No, not as a direct Composer dependency. It is a Symfony bundle built around Symfony's DI container, bundle extension, security factories, and event system, with no Laravel service provider, guard, or Authenticatable contract. The realistic path is to port its authentication decision into a Laravel guard and middleware, or bypass it and terminate Kerberos at the web server while Laravel trusts a header assertion.
- How do I install rednose/kerberos-bundle?
- In a Symfony project you would install it with Composer, enable the bundle in the kernel, and configure a security firewall with the Kerberos listener. It also expects a native Kerberos dependency such as PECL krb5, GSSAPI, or an Apache module like mod_auth_kerb or mod_auth_gssapi. This is a Symfony2-era bundle, so expect older Symfony and PHP constraints and verify compatibility before attempting an install.
- What is Kerberos/SPNEGO authentication and when should I use it?
- Kerberos/SPNEGO uses HTTP Negotiate so a browser automatically presents a domain ticket and the user never sees a login form. It fits intranet single sign-on against Active Directory or a MIT KDC, typically for internal corporate users on domain-joined machines. It is a poor fit for internet-facing, multi-tenant, or bring-your-own-identity products because it requires domain membership, SPN registration, and keytab custody.
- Does rednose/kerberos-bundle support Laravel 10 or 11?
- No. The package is a Symfony bundle and provides no Laravel integration, service provider, or guard for Laravel 10, 11, or any other Laravel version. Supporting modern Laravel would require a fork or a fresh implementation of the authentication flow. For Laravel 10 and 11 the more robust approach is web-server-level Kerberos termination with Laravel trusting a verified REMOTE_USER or header assertion.
- What native dependencies does rednose/kerberos-bundle require?
- It is almost certainly backed by a native dependency such as PECL krb5, GSSAPI, or an Apache module like mod_auth_kerb or mod_auth_gssapi. The bundle code itself is not the real integration cost; the native library and server configuration are. Check that your target runtime images include the required GSSAPI libraries, because slim containers often do not.
- How do I add Kerberos SSO to Laravel?
- The recommended path is to terminate Kerberos at the web server or reverse proxy using mod_auth_gssapi or mod_auth_kerb, then have Laravel trust a REMOTE_USER or equivalent header only from a trusted hop. Map that principal to a local user in a custom guard or middleware. This is more robust and debuggable than coupling PHP request handling directly to GSSAPI, and it avoids porting a Symfony bundle into Laravel.
- Is rednose/kerberos-bundle maintained and production-ready?
- Adoption risk is high: it has 3 stars, 0 dependents, and a composite score of 0.105, which means essentially no ecosystem validation. A Rednose public bundle from this era is likely pinned to older Symfony and PHP constraints and unmaintained. You should assume you will own a fork, and there is no public evidence of production use or community to absorb maintenance.
- What are the security risks of using rednose/kerberos-bundle?
- Negotiate handling touches credential parsing, token validation, and fallback behavior, so a subtle flaw can become an authentication bypass. Examples include accepting forged tokens, falling back to a spoofable header, or trusting REMOTE_USER from an untrusted hop. This code has not had the adversarial review that a widely used auth library receives, so treat the security surface as moderate-to-high and review any fork carefully.
- How does rednose/kerberos-bundle map a Kerberos principal to a local application user?
- The bundle resolves the Kerberos principal from the Negotiate token, and you must map that principal to an application user, typically through a user provider or custom logic. You also need a strategy for group sync and role assignment, and you own that mapping. In a Laravel port this mapping would live in a custom guard or middleware rather than in Symfony security configuration.
- What happens if the browser cannot negotiate Kerberos, and what alternatives exist?
- Fallback behavior depends on configuration and may expose a basic-auth prompt, so confirm with your security team before relying on it. If users are not domain-joined or lack network line-of-sight to a KDC, OIDC or SAML against Entra ID is usually a better requirement fit. For Laravel, alternatives include an identity-aware proxy or a reverse-proxy header assertion combined with a custom guard.