System Preparation

Add the Moonshot libraries and configure the server

If you have not already done so, you first need to follow the instructions on how to .to 

Installation Instructions

1. To use the Apache module, install it and the MIT Kerberos client package:

   bashtrue

   
   

2. VERIFY! To install the Apache module, issue the following command (or create the appropriate symlinks manually):

   bash

   Add a dummy Kerberos key to make the module happy:

   bash

   Export the location of the keytab file into Apache's config:

   bash

   Assign the correct permissions to the keytab file:

   bashtrue

   
   

3. Ensure that the certificates referenced in /etc/radsec.conf can be read by the Apache user:

   bashtrue

   
   

4. Verify that the KeepAlive option is enabled in the Apache configuration file /etc/apache2/apache2.conf:

   bashtrue

   
   

5. Restart Apache:

   bashtrue

   
   

Configuration Instructions

Protecting a location with Moonshot

To protect a particular location on your Apache server, you must configure it with an AuthType of "Negotiate".

of GSSAPI.

Here's a sample configuration that can get you started to allow anyone with a valid Moonshot account to access /wherever

:

Populating REMOTE_USER

Web services often rely on the REMOTE_USER Apache environment variable for user information, such as a local user account or a pseudonymous identifier.

To populate REMOTE_USER, update the reply from the RP Proxy with the User-Name RADIUS attribute in the RP Proxy's post-auth section:

HTTPS Internet Explorer compatibility