All of the instructions below assume that you have root access, and will work as the root user (either directly or using sudo).
1. System Preparation
1.1. Add the Moonshot libraries
If you have not already done so, you first need to follow the instructions on how to install the Moonshot Libraries on Debian 8.
2. Installation Instructions
To use the Apache module, install it and the MIT Kerberos client package:
To install the Apache module, issue the following command (or create the appropriate symlinks manually):
Add a dummy Kerberos key to make the module happy:
Export the location of the keytab file into Apache's config:
Assign the correct permissions to the keytab file:
Ensure that the certificates referenced in
/etc/radsec.confcan be read by the Apache user:
Verify that the
KeepAliveoption is enabled in the Apache configuration file
3. Configuration Instructions
Shibboleth2 Apache module incompatibility
Please read Section 6.2 in Apache HTTPD on module incompatibilities.
3.1. Protecting a location with Moonshot
To protect a particular location on your Apache server, you must configure it with an AuthType of "Negotiate".
To allow anyone with a valid Moonshot account to access
/wherever, you would do the following:
3.2. Populating REMOTE_USER
Web services often rely on the
REMOTE_USER Apache environment variable for user information, such as a local user account or a pseudonymous identifier.
REMOTE_USER, update the reply from the RP Proxy with the
User-Name RADIUS attribute in the RP Proxy's
3.3. HTTPS Internet Explorer compatibility
For updated best practice with Internet Explorer connections, you should also read Microsoft's HTTPS and Keep-Alive Connections article.