I would want to use SPNEGO/Kerberos protocol on a public internet webserver for specific remote ip addresses coming from corporate intranet. Other authentications methods are used for other addresses (Form- based login/password). All I want is to get the domain username of the incoming user if they are coming from corporate network. I'm using keytab file on the webserver created with ktpass. Webserver is in DMZ and isolated from intranet. The Kerberos implementation in question is Active Directory.
- Is Kerberos suitable for public internet webserver authentication in this kind of setup?
- Are there some specific security considerations related to a setup like this?
- What are the necessary steps if the keytab file gets compromised?