CMK version: 2.4.0p20 Raw Edition
OS version: Linux OEL9.8 (“RHEL9.8”)
Error message: SSO fails and user is presented the CMK u/p login prompt
We have CMK RE configured to authenticate against AD using mod_auth_gssapi and LDAP connections.
This has functioned well for several years. However some newer user accounts fail to authenticate with Checkmk; (external OS and internal CMK) Apache HTTPD logs have a mixed-case userid (unlike most other users which are all lower case).
(Our LDAP connections have “Lower case User-IDs” checkbox ON, like 2025 CMK forum post “LDAP login username became case sensitive…”.)
Client web browser and client OS versions do not appear to be the issue, as this problem appears across several combinations.
Sample logs:
- sample error log from /omd/sites/cmksitedev/var/log/apache/access_log
1.2.3.4 - John.Doe [25/Aug/2026:13:00:00 -0400] “GET /cmksitedev/check_mk/ HTTP/1.1” 302 283 “-” “Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36” 21710
- sample ok log
1.2.3.5 - jane.doe [25/Aug/2026:14:00:00 -0400] “GET /cmksitedev/check_mk/ HTTP/1.1” 200 64795 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36” 174081
Internal HTTPD logging (default) configurations:
./apache.conf:LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %D" combined
./apache.conf:CustomLog /omd/sites/cmksitedev/var/log/apache/access_log combined
Checking if others have experienced or worked around a similar issue?
Comparing AD LDAP data for ok and error userids, there are no obvious differences/issues.
Trying to increase HTTPD logging did not reveal a root cause.
edit: cleanup data; add link to mod_auth_gssapi