Kerberos Bundle Laravel Package

Getting Started

• First, the mismatch. This is a Symfony bundle, not a Laravel package. It registers through Symfony's kernel/bundle system and plugs into the Symfony Security component (firewall listeners, authentication providers, tokens). You cannot composer require it into a Laravel app and expect it to work; in a Laravel context treat it as reference material or a porting source.
• Where to look first: DependencyInjection/ for the config keys and defaults, Security/ (or Security/Authentication/) for the listener/provider/token classes, and Resources/config/ for service wiring. The README is likely thin, so the source is the documentation.
• Runtime prerequisites: the PECL krb5 extension (php-krb5), a keytab containing the service principal, and clients that will send an Authorization: Negotiate <token> header. Confirm these before anything else.
• Minimal Symfony usage: register the bundle, define a firewall using the bundle's Kerberos listener/provider, and point it at your keytab and service principal.
• First use case: intranet single sign-on against Active Directory. A domain-joined Windows machine hits the app, the browser sends a Kerberos ticket, the bundle validates it, and you map the resulting principal (e.g. user@REALM) to an application user.

Implementation Patterns

• Stateless firewall pattern. Put the Kerberos listener on its own stateless firewall with no session, and keep a normal form/session firewall for the rest of the app. Kerberos SSO is per-request, not session-based.
• Principal-to-user mapping. The bundle authenticates a principal; it does not know your domain model. Wire a custom user provider (or a post-authentication step) that looks up or provisions the local user from the principal name.
• Hybrid authentication. Have the entry point return 401 with WWW-Authenticate: Negotiate to prompt the browser, then fall back to form login when no Negotiate header is present or the client is not domain-joined.
• Proxy/load balancer topology. Preserve the Authorization header end-to-end. Terminating TLS at a proxy is fine; dropping the header is not.
• Porting to Laravel. Implement a custom auth guard/driver plus middleware that reads the Negotiate header, validates the ticket via the krb5 extension, and resolves a user — mirroring the Symfony listener's flow. There is no first-party Laravel equivalent, so budget for this.
• Testing. From a domain-joined host with a valid ticket, hit the endpoint with curl --negotiate -u : http://host/ and confirm with klist.

Gotchas and Tips

• Hard dependency on the krb5 PECL extension. It is rarely installed by default and is painful in Docker and on shared hosting. Validate this first; if it is unavailable, the bundle is unusable.
• Framework coupling. It targets Symfony's security APIs and its version constraints will be tied to an older Symfony generation. Expect significant work to adapt to a current Laravel or Symfony app.
• Low maintenance signal. Three stars and zero dependents means no community support and likely no active maintenance. Read and vendor the source; do not assume fixes upstream.
• SPN must match the hostname users actually hit. DNS aliases, CNAMEs, and load-balancer names that differ from the service principal will fail Kerberos negotiation.
• Clock skew and expired tickets are the most common failure modes. Check with klist/kinit and verify NTP on app servers.
• Browsers only send Negotiate to trusted/intranet-zone hosts. A public DNS name will not trigger the header regardless of server configuration.
• Proxies and FastCGI setups often strip the Authorization header. You may need SetEnvIf Authorization or explicit HTTP_AUTHORIZATION forwarding.
• Debugging: inspect the keytab with klist -kt, enable Kerberos logging, and log only the presence/shape of the header — never the raw token.
• Extension points: custom token classes, user providers, and authentication success/failure handlers/events are the intended customization seams; prefer these over forking the bundle.
• If you only need SSO in Laravel, writing a small middleware/guard around krb5 (or using an LDAP/AD package) is likely less work than adapting this bundle.