Apache Moonshot module information
These instructions relate to manually building the Apache Moonshot module (development version). This version provides support for exporting the SAML attributes received from the IDP as environment variables, thus making them available for the web applications (e.g. OpenStack).
All of the instructions below assume that you have root access, and will work as the root user (either directly or using sudo).
1. System Preparation
1.1. Add the Moonshot libraries.
If you have not already done so, you first need to follow the instructions on how to install the Moonshot Libraries on Debian 7.
1.2. Install some prerequisites
Building the Apache mod_auth_kerb module requires you to have several packages already installed on the machine. To install them:
1.3. Build the module
We are now ready to build the Apache module.
Get a copy of the code via git:
Enter the directory that just got created:
Build the software:
This will install the module to
/usr/local/etc/apache2/mods-available/auth_gssapi.load. To get the process to put the module somewhere where Apache can find it without any intervention, run the following configure command in step 5:
2. Installation Instructions
To install the Apache module, issue the following command (or create the appropriate symlinks manually):
Ensure that the certificates referenced in
/etc/radsec.confcan be read by the Apache user:
Verify that the
KeepAliveoption is enabled in the Apache configuration file
3. Configuration Instructions
Shibboleth2 Apache module incompatibility
Please note that this module is currently not compatible with the Shibboleth2 service provider Apache module. When testing or using the Moonshot module, disable the Shibboleth module and restart the webserver before attempting your test. We are attempting to resolve this problem.
3.1. Protecting a location with Moonshot
To protect a particular location on your Apache server, you must configure it with an AuthType of "Negotiate".
To allow anyone with a valid Moonshot account to access
/wherever, you would do the following:
3.2. Exporting GSS API attributes as environment variables
The module includes an option called GssapiNameAttributes that allows controlling which GSS API attributes (either SAML or RADIUS) are exported as environment variables. It is used as follows:
This option can be specified multiple times, once for each attribute to expose. The Special value "json" is used to expose all attributes in a json formatted string via the special environment variable GSS_NAME_ATTRS_JSON.
The special environment variable GSS_NAME_ATTR_ERROR is set with the GSS API returned error string in case the inquire name function fails to retrieve attributes, and with the string "0 attributes found", if no attributes are set.
In addition to this, in the event of an authentication failure, the module exports an environment variable called MAG_ERROR which contains one of the following values:
- "NO_AUTH_DATA" when the client did not send any authentication data (usually because the appropriate libraries are not installed on the browser).
- "UNSUP_AUTH_TYPE" when the client sent authentication data of an invalid type.
- "GSS_MECH_ERROR" when the GSS mechanism failed for some reason (e.g. invalid credentials).
Finally, whenever MAG_ERROR takes a value of "GSS_MECH_ERROR", an additional environment variable named GSS_ERROR_STR is sourced. This variable contains the result of the gss_display_status() call and may help web developers to show a more appropriate error page/string to the user.
3.3. Populating REMOTE_USER
Web services often rely on the
REMOTE_USER Apache environment variable for user information, such as a local user account or a pseudonymous identifier.
REMOTE_USER, update the reply from the RP Proxy with the
User-Name RADIUS attribute in the RP Proxy's
3.4. HTTPS Internet Explorer compatibility
For updated best practice with Internet Explorer connections, you should also read Microsoft's HTTPS and Keep-Alive Connections article.