On Wed, 9 Mar 2011, Dvorkin, Asya wrote: > Thank you, John. > > I forgot to add that we cannot generate keytab from AD server for various reasons that I have no control over. > > Would mod_auth_kerb still work? My google searches all point to keytab file > being there... Yes. If you join AD properly you can get a keytab out of it. If you don't have a keytab, how are you proposing this single sign on is going to work? jh