title: Kerberos Authentication for multi-tenant apache hosted Rails app
body: <p>I would like to support a multi-tenant rails application with conditional support for Kerberos authentication by tenant.</p>
  
  <p>The examples I've seen with mod_auth_kerb assume the apache server will reach out directly to the KDC for validating the ticket. In my case, I would like the server to have the client browser negotiate w/ the KDC and provide the appropriate ticket. I believe this is done by returning a 401 w/ www-negotiate header and the client browser will then call back with the ticket.  The apache server would then just validate the ticket against the appropriate keytab. My understanding is I will need a keytab from each domain that will support Kerberos auth.</p>
  
  <p>So, I think I can easily provide an "/auto_login" route that Apache then enforces Kerberos on. However, I'm not quite sure how to have Apache choose the right keytab; e.g. if I hit /auto_login?client=abc to validate against ABC's keytab.</p>
  
  <p>I currently use Devise. A custom strategy: <a href="https://stackoverflow.com/questions/3503827/devise-ignoring-custom-strategy">Devise ignoring custom strategy</a> would be nice, but it seems I have the same issue in configuring the Krb5 gem (unsupported now?) to handle multiple keytabs and determine which to validate against.</p>