System Preparation

Turn off SELinux

Currently, Moonshot will not work while SELinux is in enforcing mode. Until we resolve this, simply turn SELinux to permissive mode. This can be done temporarily (i.e., on reboot it will be turned back on), or permanently (the change will persist).

Temporarily

The following command will turn Enforcing mode off:

Permanently

Edit /etc/sysconfig/selinux and change "SELINUX=enforcing" to "SELINUX=permissive". Reboot the system.

Add the Moonshot libraries

If you have not already done so, you first need to follow the instructions on .

Installation Instructions

Using the standard RedHat mod_auth_gssapi module

1. To use the Apache module, install it from the base repository:

   bash

   
   

2. Ensure that the certificates referenced in /etc/radsec.conf can be read by the Apache user:

   bash

   
   

3. If they cannot be read, add the Apache user to the group that has read access to the certificates:

   bash

   
   

4. Verify that the KeepAlive option is enabled in the Apache configuration file /etc/httpd/conf/httpd.conf:

   bash

   
   

5. Restart Apache:

   bash

   
   

Using the Moonshot mod_auth_gssapi module

1. To use the Apache module, install it and the Kerberos workstation package from the base repository:

   bash

   
   

2. Add a dummy Kerberos key to make the module happy:

   bash

   
   

3. Export the location of the keytab file into Apache's config:

   bash

   
   

   Alternative

   Alternatively, you can use the GSSKrb5Keytab configuration directive in the Location directive in Section 3.1 to specify the keytab.

   
   

4. Assign the correct permissions to the keytab file:

   bash

   
   

5. Ensure that the certificates referenced in /etc/radsec.conf can be read by the Apache user:

   bash

   
   

6. If they cannot be read, add the Apache user to the group that has read access to the certificates:

   bash

   
   

7. Verify that the KeepAlive option is enabled in the Apache configuration file /etc/httpd/conf/httpd.conf:

   bash

   
   

8. Restart Apache:

   bash

   
   

Configuration Instructions

Protecting a location with Moonshot

Using the standard RedHat mod_auth_gssapi module

To protect a particular location on your Apache server, you must configure it with an AuthType of "GSSAPI".

Here's a sample configuration that can get you started.

Using the Moonshot mod_auth_gssapi module

To protect a particular location on your Apache server, you must configure it with an AuthType of "Negotiate".

The module-shipped /etc/httpd/conf.d/auth_gssapi.conf file contains a sample configuration that can get you started.

Populating REMOTE_USER

Web services often rely on the REMOTE_USER Apache environment variable for user information, such as a local user account or a pseudonymous identifier.

Using the RedHat mod_auth_gssapi module

 To populate REMOTE_USER, enable the GssapiImpersonate configuration directive:

Using the Moonshot mod_auth_gssapi module

To populate REMOTE_USER, update the FreeRADIUS reply from the RP Proxy with the User-Name RADIUS attribute in the :

Accessing Moonshot attributes

Using the RedHat mod_auth_gssapi module

The RedHat module has the ability to access all the attributes in the GSSAPI response, including the raw RADIUS attributes and any attributes that were transformed by the Shibboleth attribute map in the Moonshot mechanism. To access these attributes, use the GssapiNameAttributes directive:

Using the Moonshot mod_auth_gssapi module

The Moonshot module can use either the Shibboleth attribute resolver library to map RADIUS and SAML attributes to internal Shibboleth attributes, and then to environment variables, or use its own internal JSON attribute resolver to map either RADIUS attributes or SAML attributes to environment variables. Read more at about how to configure Shibboleth or the internal JSON attribute resolvers.

We are working on enhancements that allow the Moonshot module to expose attributes in the same way as the RedHat module.

Testing Moonshot

Either use a browser to access your protected location, or use cURL to retrieve it:

HTTPS Internet Explorer compatibility

For updated best practice with Internet Explorer connections, you should also read Microsoft's HTTPS and Keep-Alive Connections article.