Versions Compared

Version Old Version 2 New Version 3
Changes made by

Stefan Paetow

Stefan Paetow

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Note

All of the instructions below assume that you have root access, and will work as the root user (either directly or using sudo).

Warning

This package is for the x86 platform only. Please follow the instructions for manually building the Apache module for x64 platforms.

Numberedheadings

System Preparation

Add the Moonshot libraries

If you have not already done so, you first need to follow the instructions on how to .

Installation Instructions

  1. To use the Apache module, install it and the MIT Kerberos client package:

    bash

  2. To install the Apache module, issue the following command (or create the appropriate symlinks manually):

    bash

  3. Add a dummy Kerberos key to make the module happy:

    bash

  4. Export the location of the keytab file into Apache's config:

    bash

  5. Assign the correct permissions to the keytab file:

    bash

  6. Ensure that the certificates referenced in /etc/radsec.conf can be read by the Apache user:

    bash

  7. Verify that the KeepAlive option is enabled in the Apache configuration file /etc/apache2/apache2.conf:

    bash

  8. Restart Apache:

    bash

Configuration Instructions

Shibboleth2 Apache module incompatibility

Please note that this module is currently not compatible with the Shibboleth2 service provider Apache module. When testing or using the Moonshot module, disable the Shibboleth module and restart the webserver before attempting your test. We are attempting to resolve this problem.

Protecting a location with Moonshot

To protect a particular location on your Apache server, you must configure it with an AuthType of "Negotiate".

Example

To allow anyone with a valid Moonshot account to access /wherever, you would do the following:

true

Populating REMOTE_USER

Web services often rely on the REMOTE_USER Apache environment variable for user information, such as a local user account or a pseudonymous identifier.

To populate REMOTE_USER, update the reply from the RP Proxy with the User-Name RADIUS attribute in the RP Proxy's post-auth section:

HTTPS Internet Explorer compatibility

For updated best practice with Internet Explorer connections, you should also read Microsoft's HTTPS and Keep-Alive Connections article.