You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Satya Prakash Prasad <sa...@gmail.com> on 2012/09/10 05:44:07 UTC
[users@httpd] WAMP SSO
I am having WAMP (Windows, Apache, MySQL and PHP) on a web server. The
box is available within our organization network only.
I need to implement SSO (Single Sign On) for a tool to be launched for
people of our organization only. The tool should be able to detect
which intranet user is visiting our site automatically instead of
promptly asking organization n/w username / password. I am not sure
how to implement that both at Apache and back end code side (PHP
script) - such that a PHP script should be able to detect the 'USER'
at least. Note if I can avail the 'USRE' details I can do LDAP
validation to authenticate this user.
Please help me out to understand how to setup Apache for the above
functionality?
Regards,
Prakash
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] WAMP SSO
Posted by Satya Prakash Prasad <sa...@gmail.com>.
Thanks for the details. I am sorry but I am Unix guy and have not much
expertise on Windows platform.
I googled and found that mod_auth_tkt is provided as a UNIX tarball -
nothing windows specific.
Please let me know how I can migrate / install it on windows?
Regards,
Prakash
On Tue, Sep 11, 2012 at 1:28 PM, linuxsupport <li...@gmail.com> wrote:
> try mod_auth_tkt
>
>
> On Tue, Sep 11, 2012 at 11:46 AM, Satya Prakash Prasad
> <sa...@gmail.com> wrote:
>>
>> Thanks to all for the information and details as provided.
>>
>> I would try to explore the various options provided in the discussion.
>> Kindly note that I need to implement it on WAMP as mentioned earlier
>> (Windows, Apache, MySQL and PHP).
>>
>> The one option I may request upon is that does Apache itself does not
>> provide modules / mechanism to implement SSO?
>>
>> Thanks in advance.
>>
>> Regards,
>> Prakash
>>
>>
>> On Mon, Sep 10, 2012 at 8:32 PM, Mark Montague <ma...@catseye.org> wrote:
>> > On September 10, 2012 10:03 , Nick Kew <ni...@webthing.com> wrote:
>> >>>>
>> >>>> I need to implement SSO (Single Sign On) for a tool to be launched
>> >>>> for
>> >>>> people of our organization only.
>> >>>
>> >>> For true SSO solutions, look at
>> >>
>> >> Any strong reason to prefer those to worldwide initiatives
>> >> such as OpenID/OpenAuth?
>> >
>> >
>> > Mostly because I didn't think of them :) But, now that you've asked:
>> >
>> > My understanding is that most of the following features offered by
>> > cosign/PubCookie/CAS are not offered by OpenID/OpenAuth:
>> > * Centralized Single Log Out.
>> > * Per-site forced reauthentication (e.g., when user's IP address
>> > changes, or when they access a particularly sensitive resource)
>> > * Per-site multi-factor authentication (including hardware tokens,
>> > X.509
>> > client certificates, etc.)
>> > * Idle time outs (require reauthentication after, say, 2 hours of no
>> > pages being requested).
>> > * Hard time outs (require reauthentication, say, every 24 hours or
>> > every
>> > week, regardless of activity)
>> > * Credential proxying to back-end services (other web servers, IMAP,
>> > LDAP, databases, etc.)
>> >
>> > Regardless of the above, OpenID/OpenAuth may be a fine choice for the
>> > original poster, depending on his requirements, particularly if he sets
>> > up
>> > his own OpenID provider rather than using an external provider such as
>> > Google or Yahoo.
>> >
>> > --
>> > Mark Montague
>> > mark@catseye.org
>> >
>> >
>> >
>> > ---------------------------------------------------------------------
>> > To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
>> > For additional commands, e-mail: users-help@httpd.apache.org
>> >
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
>> For additional commands, e-mail: users-help@httpd.apache.org
>>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] WAMP SSO
Posted by linuxsupport <li...@gmail.com>.
try mod_auth_tkt
On Tue, Sep 11, 2012 at 11:46 AM, Satya Prakash Prasad <
satyaprakash.prasad@gmail.com> wrote:
> Thanks to all for the information and details as provided.
>
> I would try to explore the various options provided in the discussion.
> Kindly note that I need to implement it on WAMP as mentioned earlier
> (Windows, Apache, MySQL and PHP).
>
> The one option I may request upon is that does Apache itself does not
> provide modules / mechanism to implement SSO?
>
> Thanks in advance.
>
> Regards,
> Prakash
>
>
> On Mon, Sep 10, 2012 at 8:32 PM, Mark Montague <ma...@catseye.org> wrote:
> > On September 10, 2012 10:03 , Nick Kew <ni...@webthing.com> wrote:
> >>>>
> >>>> I need to implement SSO (Single Sign On) for a tool to be launched for
> >>>> people of our organization only.
> >>>
> >>> For true SSO solutions, look at
> >>
> >> Any strong reason to prefer those to worldwide initiatives
> >> such as OpenID/OpenAuth?
> >
> >
> > Mostly because I didn't think of them :) But, now that you've asked:
> >
> > My understanding is that most of the following features offered by
> > cosign/PubCookie/CAS are not offered by OpenID/OpenAuth:
> > * Centralized Single Log Out.
> > * Per-site forced reauthentication (e.g., when user's IP address
> > changes, or when they access a particularly sensitive resource)
> > * Per-site multi-factor authentication (including hardware tokens,
> X.509
> > client certificates, etc.)
> > * Idle time outs (require reauthentication after, say, 2 hours of no
> > pages being requested).
> > * Hard time outs (require reauthentication, say, every 24 hours or
> every
> > week, regardless of activity)
> > * Credential proxying to back-end services (other web servers, IMAP,
> > LDAP, databases, etc.)
> >
> > Regardless of the above, OpenID/OpenAuth may be a fine choice for the
> > original poster, depending on his requirements, particularly if he sets
> up
> > his own OpenID provider rather than using an external provider such as
> > Google or Yahoo.
> >
> > --
> > Mark Montague
> > mark@catseye.org
> >
> >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> > For additional commands, e-mail: users-help@httpd.apache.org
> >
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
Re: [users@httpd] WAMP SSO
Posted by Satya Prakash Prasad <sa...@gmail.com>.
Thanks to all for the information and details as provided.
I would try to explore the various options provided in the discussion.
Kindly note that I need to implement it on WAMP as mentioned earlier
(Windows, Apache, MySQL and PHP).
The one option I may request upon is that does Apache itself does not
provide modules / mechanism to implement SSO?
Thanks in advance.
Regards,
Prakash
On Mon, Sep 10, 2012 at 8:32 PM, Mark Montague <ma...@catseye.org> wrote:
> On September 10, 2012 10:03 , Nick Kew <ni...@webthing.com> wrote:
>>>>
>>>> I need to implement SSO (Single Sign On) for a tool to be launched for
>>>> people of our organization only.
>>>
>>> For true SSO solutions, look at
>>
>> Any strong reason to prefer those to worldwide initiatives
>> such as OpenID/OpenAuth?
>
>
> Mostly because I didn't think of them :) But, now that you've asked:
>
> My understanding is that most of the following features offered by
> cosign/PubCookie/CAS are not offered by OpenID/OpenAuth:
> * Centralized Single Log Out.
> * Per-site forced reauthentication (e.g., when user's IP address
> changes, or when they access a particularly sensitive resource)
> * Per-site multi-factor authentication (including hardware tokens, X.509
> client certificates, etc.)
> * Idle time outs (require reauthentication after, say, 2 hours of no
> pages being requested).
> * Hard time outs (require reauthentication, say, every 24 hours or every
> week, regardless of activity)
> * Credential proxying to back-end services (other web servers, IMAP,
> LDAP, databases, etc.)
>
> Regardless of the above, OpenID/OpenAuth may be a fine choice for the
> original poster, depending on his requirements, particularly if he sets up
> his own OpenID provider rather than using an external provider such as
> Google or Yahoo.
>
> --
> Mark Montague
> mark@catseye.org
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] WAMP SSO
Posted by Mark Montague <ma...@catseye.org>.
On September 10, 2012 10:03 , Nick Kew <ni...@webthing.com> wrote:
>>> I need to implement SSO (Single Sign On) for a tool to be launched for
>>> people of our organization only.
>> For true SSO solutions, look at
> Any strong reason to prefer those to worldwide initiatives
> such as OpenID/OpenAuth?
Mostly because I didn't think of them :) But, now that you've asked:
My understanding is that most of the following features offered by
cosign/PubCookie/CAS are not offered by OpenID/OpenAuth:
* Centralized Single Log Out.
* Per-site forced reauthentication (e.g., when user's IP address
changes, or when they access a particularly sensitive resource)
* Per-site multi-factor authentication (including hardware tokens,
X.509 client certificates, etc.)
* Idle time outs (require reauthentication after, say, 2 hours of
no pages being requested).
* Hard time outs (require reauthentication, say, every 24 hours or
every week, regardless of activity)
* Credential proxying to back-end services (other web servers,
IMAP, LDAP, databases, etc.)
Regardless of the above, OpenID/OpenAuth may be a fine choice for the
original poster, depending on his requirements, particularly if he sets
up his own OpenID provider rather than using an external provider such
as Google or Yahoo.
--
Mark Montague
mark@catseye.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] WAMP SSO
Posted by Nick Kew <ni...@webthing.com>.
On Mon, 10 Sep 2012 09:07:06 -0400
Mark Montague <ma...@catseye.org> wrote:
> On September 9, 2012 23:44 , Satya Prakash Prasad
> <sa...@gmail.com> wrote:
> > I need to implement SSO (Single Sign On) for a tool to be launched for
> > people of our organization only.
>
> For true SSO solutions, look at
Any strong reason to prefer those to worldwide initiatives
such as OpenID/OpenAuth?
--
Nick Kew
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] WAMP SSO
Posted by Mark Montague <ma...@catseye.org>.
On September 9, 2012 23:44 , Satya Prakash Prasad
<sa...@gmail.com> wrote:
> I need to implement SSO (Single Sign On) for a tool to be launched for
> people of our organization only.
For true SSO solutions, look at
cosign: http://weblogin.org/
PubCookie: http://pubcookie.org/
CAS: http://www.jasig.org/cas
> The tool should be able to detect
> which intranet user is visiting our site automatically instead of
> promptly asking organization n/w username / password.
All of the SSO solutions I mention above will prompt the user for their
username and password, unless the user is already authenticated.
Rhetorically speaking, how would a SSO system "detect" the user's
identity? There is nothing in standard web technologies that does this
by default -- you would need to set up something for each user that
differentiates that user from other users which the users' web browsers
will share with your web servers. One choice is a long-lived cookie,
but of course you'll have to take into account that this cookie could be
stolen or forged, and so you'll still need to perform some sort of
strong authentication (usually by prompting the user for a password).
Another choice is to use a client-side X.509 certificate for each user.
A third choice, if you are in an "enterprise environment" (e.g., all
clients use Active Directory) is using SPNEGO. Most SSO solutions do
not rely on any of these things being in place, and hence will prompt
the user for their username and password.
> I am not sure
> how to implement that both at Apache and back end code side (PHP
> script) - such that a PHP script should be able to detect the 'USER'
> at least.
If you set up any of the solutions listed above -- *except* for the
cookie solution -- then Apache HTTP Server will put the identity of the
authenticated user into the REMOTE_USER environment variable, which can
be accessed in your PHP script with the code $_SERVER['REMOTE_USER']
--
Mark Montague
mark@catseye.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org