...
- Servers -> Web Server -> mod_auth_kerb
- Servers -> Windows File Server (pour le test des montages SMB
Il n'est pas nécessaire de configurer l'authentification des utilisateurs sur ce serveur.
Authentification web Kerberos par Apache en utilisant mod_auth_kerb
Installation basique Apache
Installer httpd (Apache) et mod_auth_kerb et démarrer Apache :
| Bloc de code |
|---|
\[root@cas kerb\]# chkconfig httpd on
\[root@cas kerb\]# service httpd start
Starting httpd: \[ OK \] |
Ecrire un simple script test.php dans le répertoire /var/www/html/kerb :
| Bloc de code |
|---|
<?php
echo "<p>REMOTE_USER=[".$_SERVER['REMOTE_USER']."]</p>";
echo "<p>PHP_AUTH_USER=[".$_SERVER['PHP_AUTH_USER']."]</p>";
phpinfo();
?> |
Tester en accédant à http://cas.ifsic.univ-rennes1.fr/kerb/test.php .
Installation mod_auth_kerb
Déclarer le client Kerberos. Sous kadmin :
| Bloc de code |
|---|
[root@cas kerb]# kadmin Authenticating as principal root/admin@UNIV-RENNES1.FR with password. Password for root/admin@UNIV-RENNES1.FR: kadmin: addprinc -randkey HTTP/cas.ifsic.univ-rennes1.fr WARNING: no policy specified for HTTP/cas.ifsic.univ-rennes1.fr@UNIV-RENNES1.FR; defaulting to no policy Principal "HTTP/cas.ifsic.univ-rennes1.fr@UNIV-RENNES1.FR" created. kadmin: ktadd -k /etc/httpd/conf/mod_auth_kerb.keytab HTTP/cas.ifsic.univ-rennes1.fr Entry for principal HTTP/cas.ifsic.univ-rennes1.fr with kvno 3, encryption type AES-256 CTS mode with 96-bit SHA-1 HMAC added to keytab WRFILE:/etc/httpd/conf/mod_auth_kerb.keytab. Entry for principal HTTP/cas.ifsic.univ-rennes1.fr with kvno 3, encryption type AES-128 CTS mode with 96-bit SHA-1 HMAC added to keytab WRFILE:/etc/httpd/conf/mod_auth_kerb.keytab. Entry for principal HTTP/cas.ifsic.univ-rennes1.fr with kvno 3, encryption type Triple DES cbc mode with HMAC/sha1 added to keytab WRFILE:/etc/httpd/conf/mod_auth_kerb.keytab. Entry for principal HTTP/cas.ifsic.univ-rennes1.fr with kvno 3, encryption type ArcFour with HMAC/md5 added to keytab WRFILE:/etc/httpd/conf/mod_auth_kerb.keytab. Entry for principal HTTP/cas.ifsic.univ-rennes1.fr with kvno 3, encryption type DES with HMAC/sha1 added to keytab WRFILE:/etc/httpd/conf/mod_auth_kerb.keytab. Entry for principal HTTP/cas.ifsic.univ-rennes1.fr with kvno 3, encryption type DES cbc mode with RSA-MD5 added to keytab WRFILE:/etc/httpd/conf/mod_auth_kerb.keytab. kadmin: exit [root@cas kerb]# |
Puis :
| Bloc de code |
|---|
[root@cas kerb]# chown apache /etc/httpd/conf/mod_auth_kerb.keytab [root@cas kerb]# chmod 640 /etc/httpd/conf/mod_auth_kerb.keytab [root@cas kerb]# |
Protéger un répertoire par Kerberos en éditant /etc/httpd/conf.d/auth_kerb.conf :
| Bloc de code |
|---|
<Location /kerb> # SSLRequireSSL AuthType KerberosV5 AuthName "Kerberos Login" KrbMethodNegotiate On KrbMethodK5Passwd Off KrbAuthRealms IFSIC.UNIV-RENNES1.FR Krb5KeyTab /etc/httpd/conf/mod_auth_kerb.keytab require valid-user </Location> |
Ecrire un simple script test.php dans le répertoire /var/www/html/kerb :
| Bloc de code |
|---|
<?php
echo "<p>REMOTE_USER=[".$_SERVER['REMOTE_USER']."]</p>";
echo "<p>PHP_AUTH_USER=[".$_SERVER['PHP_AUTH_USER']."]</p>";
phpinfo();
?> |
Test
| Balise Wiki |
|---|
Tester en accédant [http://cas.ifsic.univ-rennes1.fr/kerb/test.php]. Le nom de l'utilisateur doit apparaître dans les variables *$_SERVER\["REMOTE_USER"\]* et *$_SERVER\["PHP_AUTH_USER"\]* (quelque chose comme *paubry@IFSIC.UNIV-RENNES1.FR*). |
...