Next Active Directory Integration - Revision history

Michael.mast at 17:58, 11 April 2018

2018-04-11T17:58:23Z

Michael.mast at 17:55, 11 April 2018

2018-04-11T17:55:29Z

Michael.mast at 00:35, 8 April 2018

2018-04-08T00:35:41Z

Michael.mast: /* Kerberose issues */

2017-12-14T22:52:06Z

Kerberose issues

Michael.mast: /* Kerberose issues */

2017-12-14T22:50:40Z

Kerberose issues

Michael.mast: /* Kerberose issues */

2017-12-14T22:49:40Z

Kerberose issues

Michael.mast at 19:16, 14 December 2017

2017-12-14T19:16:23Z

Michael.mast: Created page with "Installing for WP VERSION-HERE with SSO enabled.
Looking to use kerberose for this one, eventually replacing with SAML.

DUMP OF NOTES HERE https://activ..."

2017-12-05T22:19:42Z

Created page with "Installing for WP **VERSION-HERE** with SSO enabled. Looking to use kerberose for this one, eventually replacing with SAML. DUMP OF NOTES HERE <ref>https://activ..."

New page

Installing for WP **VERSION-HERE** with SSO enabled. 
Looking to use kerberose for this one, eventually replacing with SAML.
 
 
DUMP OF NOTES HERE
<ref>https://active-directory-wp.com/docs/Networking/Single_Sign_On/Kerberos_SSO_with_Apache_on_Linux.html</ref>
*mv kerberos.keytab /var/www/html/
*chown apache:apache /var/www/html/kerberos.keytab
*kinit -p admin@domain.tld
*yum install mod_auth_gssapi
*nano /etc/httpd/conf.d/vhosts.conf
<ref>https://github.com/modauthgssapi/mod_auth_gssapi</ref>
<pre>
<Location /private>
AuthType GSSAPI
AuthName "GSSAPI Single Sign On Login"
GssapiCredStore keytab:/etc/httpd.keytab
Require valid-user
</Location>
</pre>
*nano /etc/httpd/conf.d/vhosts.conf

@@ Line 23: / Line 23: @@
 Most issues were caused by selinux. After setting the correct context for the keytab file I was able to get this thing working properly.
 <ref>http://blog.stefan-macke.com/2011/04/19/single-sign-on-with-kerberos-using-debian-and-windows-server-2008-r2/</ref><ref>http://research.imb.uq.edu.au/~l.rathbone/ldap/gssapi.shtml</ref><ref>https://stackoverflow.com/questions/8978080/htaccess-exclude-one-url-from-basic-auth</ref>
 *<ref>https://unix.stackexchange.com/questions/120216/apache-mod-auth-kerb-key-table-entry-not-found</ref>Sample apache conf
 <pre>

@@ Line 22: / Line 22: @@
 ==Kerberose issues==
 Most issues were caused by selinux. After setting the correct context for the keytab file I was able to get this thing working properly.
-<ref>http://blog.stefan-macke.com/2011/04/19/single-sign-on-with-kerberos-using-debian-and-windows-server-2008-r2/</ref>
+<ref>http://blog.stefan-macke.com/2011/04/19/single-sign-on-with-kerberos-using-debian-and-windows-server-2008-r2/</ref><ref>http://research.imb.uq.edu.au/~l.rathbone/ldap/gssapi.shtml</ref><ref>https://stackoverflow.com/questions/8978080/htaccess-exclude-one-url-from-basic-auth</ref>
 *<ref>https://unix.stackexchange.com/questions/120216/apache-mod-auth-kerb-key-table-entry-not-found</ref>Sample apache conf
 <pre>

← Older revision		Revision as of 22:49, 14 December 2017
Line 23:		Line 23:
	Most issues were caused by selinux. After setting the correct context for the keytab file I was able to get this thing working properly.		Most issues were caused by selinux. After setting the correct context for the keytab file I was able to get this thing working properly.
	<ref>http://blog.stefan-macke.com/2011/04/19/single-sign-on-with-kerberos-using-debian-and-windows-server-2008-r2/</ref>		<ref>http://blog.stefan-macke.com/2011/04/19/single-sign-on-with-kerberos-using-debian-and-windows-server-2008-r2/</ref>
		+	*<ref>https://unix.stackexchange.com/questions/120216/apache-mod-auth-kerb-key-table-entry-not-found</ref>Sample apache conf
		+	<pre>
		+	<VirtualHost 10.5.3.200:443>
		+
		+	#Proxy
		+	<Proxy *>
		+	Order deny,allow
		+	Allow from all
		+	</Proxy>
		+	ProxyPass /elasticsearch/ http://127.0.0.1:9200/
		+	ProxyPassReverse /elasticsearch/ http://127.0.0.1:9200/
		+
		+	#Server Config
		+	ServerName spufi002.ads.ktag.ch
		+	ServerAdmin "sm-linux@ag.ch"
		+	DocumentRoot /srv/www/htdocs/kibana/
		+	ErrorLog /var/log/apache2/error_log
		+	TransferLog /var/log/apache2/access_log
		+	SSLEngine on
		+	SSLProtocol all -SSLv2 -SSLv3
		+	SSLCipherSuite ALL:!aNULL:!eNULL:!SSLv2:!LOW:!EXP:!MD5:@STRENGTH
		+	SSLCertificateFile /etc/apache2/ssl.crt/server.crt
		+	SSLCertificateKeyFile /etc/apache2/ssl.key/server.key
		+	<Files ~ "\.(cgi\|shtml\|phtml\|php3?)$">
		+	SSLOptions +StdEnvVars
		+	</Files>
		+	<Directory "/srv/www/cgi-bin">
		+	SSLOptions +StdEnvVars
		+	</Directory>
		+	CustomLog /var/log/apache2/ssl_request_log ssl_combined
		+	<Directory "/srv/www/htdocs/kibana">
		+
		+	#Authentication
		+	AuthType Kerberos
		+	AuthName "SPNEGO"
		+	KrbAuthRealms ADS.KTAG.CH
		+	Krb5Keytab /etc/krb5.keytab
		+	KrbMethodNegotiate on
		+	KrbServiceName http
		+	KrbMethodK5Passwd on
		+	KrbLocalUserMapping On
		+	Require user abnn ABNN tloi TLOI pwix PWIX rhe6 RHE6 dwav DWAV
		+	options Indexes FollowSymLinks
		+	AllowOverride None
		+	Order allow,deny
		+	Allow from all
		+	</Directory>
		+	</VirtualHost>
		+	</pre>

← Older revision		Revision as of 19:16, 14 December 2017
Line 20:		Line 20:
	</pre>		</pre>
	*nano /etc/httpd/conf.d/vhosts.conf		*nano /etc/httpd/conf.d/vhosts.conf
		+	==Kerberose issues==
		+	Most issues were caused by selinux. After setting the correct context for the keytab file I was able to get this thing working properly.
		+	<ref>http://blog.stefan-macke.com/2011/04/19/single-sign-on-with-kerberos-using-debian-and-windows-server-2008-r2/</ref>

@@ Line 9: / Line 9: @@
 DUMP OF NOTES HERE
 <ref>https://active-directory-wp.com/docs/Networking/Single_Sign_On/Kerberos_SSO_with_Apache_on_Linux.html</ref>
-*mv kerberos.keytab /var/www/html/
+<pre>
-*chown apache:apache /var/www/html/kerberos.keytab
+mv kerberos.keytab /var/www/html/
-*kinit -p admin@domain.tld
+chown apache:apache /var/www/html/kerberos.keytab
-*yum install mod_auth_gssapi mod_auth_kerb
+yum install mod_auth_gssapi mod_auth_kerb krb5-workstation
 *nano /etc/httpd/conf.d/vhosts.conf
 <ref>https://github.com/modauthgssapi/mod_auth_gssapi</ref>

@@ Line 2: / Line 2: @@
 Looking to use kerberose for this one, eventually replacing with SAML.
 <br>
 <br>
 DUMP OF NOTES HERE

Next Active Directory Integration - Revision history

Michael.mast at 17:58, 11 April 2018

Michael.mast at 17:55, 11 April 2018

Michael.mast at 00:35, 8 April 2018

Michael.mast: /* Kerberose issues */

Michael.mast: /* Kerberose issues */

Michael.mast: /* Kerberose issues */

Michael.mast at 19:16, 14 December 2017

Michael.mast: Created page with "Installing for WP **VERSION-HERE** with SSO enabled. Looking to use kerberose for this one, eventually replacing with SAML. DUMP OF NOTES HERE https://activ..."

Michael.mast: Created page with "Installing for WP VERSION-HERE with SSO enabled.
Looking to use kerberose for this one, eventually replacing with SAML.

DUMP OF NOTES HERE https://activ..."