Linux – Ldap+kerberos authentication through AD

This seemed familiar and Google searching brought me back to ServerFault. Long story short, Micros*** extends Kerberos in a way that makes client authentication with alternative Kerberos implementations (e.g. MIT or Heimdal) not easily accomplished. This is why projects like pGina were created. That might be primarily for LDAP auth, but the cause will lead to you needing a similar result, namely coding your own custom GINA DLL to handle that kind of auth. If you find one that handles Kerberos, please let us know! I would be super-excited to use it and find out.

To answer your questions,

1. Yes, webserver and Browser/client need to connect to the KDC to verify the tickets. You must do a kinit/domain login to get TGT and further the webbrowser will get a HTTP service ticket to access the webserver.

2. Exposing kerberos/domaincontroller on internet is not a good practice. Try using webauth.

3. I do not understand what you intended to do with proxy, but you could get a proxiable ticket from kerberos and use it based on your need.

Firefox already supports gss-api negotiate methods. All you have to do is do a kinit and configure the negotiate-auth in about:config http://grolmsnet.de/kerbtut/firefox.html and access your web page. If you are using apache check mod_auth_kerb. Lighttpd also has some kerberos support.