How to login into Web App with kerberos/AD but still allow access to non AD users

Question

I'm deploying a SSO in Apache webserver against an Active Directory via kerberos (mod_auth_kerb).

The module is installed and configured correctly, when I access apache websites with a logged in user to AD network, Apache receives correctly user's credentials via REMOTE_USER variable. The thing is that I want external users (non AD network ones) to be able to access Apache websites via regular login, but they get a

401 Authorization required

when accessing the websites.

I guess this can be achieved via kerberos configuration but haven't reached the solution. Does anyone know if this is posible with a kerberos location directive or should I configure some workaround for this, such as limiting location access by ip ranges in virtual host configuration Location directive?

My virtual host configuration is:

<VirtualHost *:80>
    # General
    ServerAdmin packettrc@my.es
    DocumentRoot /home/moodle/moodle
    ServerName my.es  
    LogLevel debug
    ErrorLog logs/my.es-error.log
    CustomLog logs/my.es.log combined

    <Location />    
        AuthType Kerberos
        AuthName "Kerberos Login MY"

        KrbMethodNegotiate On
        KrbMethodK5Passwd Off
        KrbServiceName HTTP/my.es@MY.ES
        KrbAuthRealms MY.ES  
        Krb5KeyTab      /etc/krb5.keytab

        require valid-user
    </Location>
</VirtualHost>

Answer 1

Try to replace

Require valid-user

with

Satisfy Any

You can find some insights in this article. Just in case link to Apache's manual.