Page tree

Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Numbered Headings

System Preparation

Add the Moonshot libraries

If you have not already done so, you first need to follow the instructions on how to install the Moonshot Libraries on Debian 8.

Installation Instructions

  1. To use the Apache module, install it and the MIT Kerberos client package:

    Code Block
    languagebash
    $ apt-get install krb5-user apache2-mpm-prefork libapache2-mod-auth-gssapi


  2. To install the Apache module, issue the following command (or create the appropriate symlinks manually):

    Code Block
    languagebash
    $ a2enmod auth_gssapi


  3. Add a dummy Kerberos key to make the module happy:

    Code Block
    languagebash
    $ ktutil
    ktutil:  addent -password -p HTTP/localhost@YOUR-WEBSERVER-HOSTNAME -k 1 -e aes256-cts
    <enter any password>
    ktutil:  wkt /etc/apache2/krb5.keytab
    ktutil:  quit


  4. Export the location of the keytab file into Apache's config:

    Code Block
    languagebash
    $ echo export KRB5_KTNAME=/etc/apache2/krb5.keytab >> /etc/apache2/envvars


  5. Assign the correct permissions to the keytab file:

    Code Block
    languagebash
    $ chown www-data /etc/apache2/krb5.keytab


  6. Ensure that the certificates referenced in /etc/radsec.conf can be read by the Apache user:

    Code Block
    languagebash
    $ su - --shell=/bin/bash www-data
    $ cat path_to_ca.pem
    $ cat path_to_client.pem
    $ cat path_to_client.key


  7. Verify that the KeepAlive option is enabled in the Apache configuration file /etc/apache2/apache2.conf:

    Code Block
    languagebash
    KeepAlive On


  8. Restart Apache:

    Code Block
    languagebash
    $ service apache2 restart


Configuration Instructions

Warning
titleShibboleth2 Apache module incompatibility

Please read Section 6.2 in Apache HTTPD on module incompatibilities.

Protecting a location with Moonshot

To protect a particular location on your Apache server, you must configure it with an AuthType of "Negotiate".

The /etc/apache2/conf.d/auth_gssapi.conf file contains a sample configuration that can get you started.

Tip
titleExample

To allow anyone with a valid Moonshot account to access /wherever, you would do the following:

Code Block
linenumberstrue
<Location "/wherever">
    AuthType Negotiate
    Require valid-user
</Location>


Populating REMOTE_USER

Web services often rely on the REMOTE_USER Apache environment variable for user information, such as a local user account or a pseudonymous identifier.

To populate REMOTE_USER, update the FreeRADIUS reply from the RP Proxy with the User-Name RADIUS attribute in the RP Proxy's post-auth section:

Code Block
update reply {
        User-Name := "content"
}

Accessing Moonshot attributes

The Moonshot module can use either the Shibboleth attribute resolver library to map RADIUS and SAML attributes to internal Shibboleth attributes, and then to environment variables, or use its own internal JSON attribute resolver to map either RADIUS attributes or SAML attributes to environment variables. Read more at Configure a Linux Server's Attribute Resolution about how to configure Shibboleth or the internal JSON attribute resolvers.

We are working on enhancements that allow the Moonshot module to expose attributes in the same way as the RedHat module.

HTTPS Internet Explorer compatibility

For updated best practice with Internet Explorer connections, you should also read Microsoft's HTTPS and Keep-Alive Connections article.