You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Joel Johnson <mr...@lixil.net> on 2007/09/25 04:44:31 UTC
[users@httpd] Only require satisfaction of one AuthType in 2.2
I'm setting up a site using Apache httpd 2.2 and an existing Kerberos
infrastructure and would like to optionally allow users to have single
sign-on with an existing Kerberos ticket. I'm using the Debian packaged [1]
mod_auth_kerb [2] to accomplish the authentication which is all working
smoothly.
The problem I'm running into is in designating the authentication as
*optional*. For example, I'd like to setup a wiki at wiki.and have the
contents publicly accessible, but require authentication for edits. I'd like
to first offer Kerberos authentication, but if that fails than still allow
access. The application would then check REMOTE_USER and honor its value if
set, or fallback to internal authentication if desired. This will also allow
me to configure the server such that if a user is local and has Kerberos
credentials they are seamlessly authenticated, but if not than I can have a
login screen authenticating internally against the same source. There are
several different ways that I will use this, but they all rely on optional
authentication support.
The working exclusively-Kerberos relevant config is simply:
AuthType Kerberos
require valid-user
I've tried using a "Satisfy any" directive as follows, but the "Allow from
all" seems to take precedence over any other method:
AuthType Kerberos
require valid-user
Allow from all
Satisfy any
I've also considered using a "KrbAuthoritative Off" directive to allow
checking to fallthrough to the next module, but I can't find an
authentication module with "accept all" semantics.
One option does look promising, but it only available in trunk/2.3 which I
can't switch to for this project, but the following should work (corrections
on assumption are welcome) by using two authorization providers with a
single authentication method:
AuthType Kerberos
<SatisfyOne>
Require valid-user
Require all allowed
</SatisfyOne>
My goals are that I'd like the location to be available to all, and if
authorized that is an extra bonus and allows seamlessness, customized
content and others, but it should *not* be a requirement. Additionally, I
want the content to be available under a single canonical URI which will be
well-known, so symlinking directories with different <Location>s is not an
option.
If I've missed something simple, I'd love to have it pointed out, or if
there is a best practice for this sort of setup please share!
Many thanks for any guidance or pointers!
The script that I'm using to do basic testing on the authentication is
(basically, I also have some logic to remove the Kerberos realm that isn't
included):
<? if (empty($_SERVER['REMOTE_USER'])) {
echo "You weren't automatically logged in, we'll have to do it locally.";
} else {
echo "Congratulations $username, you've logged on successfully!";
echo "REMOTE_USER = {$_SERVER['REMOTE_USER']} <br>";
}
?>
[1] http://packages.debian.org/etch/libapache2-mod-auth-kerb
[2] http://modauthkerb.sourceforge.net/
--
Joel Johnson
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Apache taking hours to answer on low system load
Posted by Sander Temme <sc...@apache.org>.
On Sep 30, 2007, at 10:27 AM, Samuel Vogel wrote:
> -bash: fork: Cannot allocate memory
...
> Everything seems normal doesn't it?
> I'm running the default Debian etch configuration on this vServer
> and increasing MaxClients didn't do any good.
>
> What could the problem be?
Looks like you have some memory allocation limit going on that you're
running into. Compare the output of:
ulimit -a -S
with
ulimit -a -H
and see if there are any red flags.
S.
--
Sander Temme
sctemme@apache.org
PGP FP: 51B4 8727 466A 0BC3 69F4 B7B8 B2BE BC40 1529 24AF
[users@httpd] Apache taking hours to answer on low system load
Posted by Samuel Vogel <sa...@gmx.de>.
Hey guys,
My Apache Server at kilu.de is taking pretty long to answer requests,
even thou the system doesn't seem to have a high load.
Also as soon as I start Apache, every try to start some other process
results in:
# ls
-bash: fork: Cannot allocate memory
The output of top (started before I started Apache):
top - 19:24:24 up 15 min, 1 user, load average: 0.13, 0.08, 0.02
Tasks: 174 total, 2 running, 172 sleeping, 0 stopped, 0 zombie
Cpu(s): 1.0% us, 1.0% sy, 0.0% ni, 98.0% id, 0.0% wa, 0.0% hi, 0.0% si
Mem: 2070020k total, 1864392k used, 205628k free, 334648k buffers
Swap: 3068392k total, 1108k used, 3067284k free, 813712k cached
Everything seems normal doesn't it?
I'm running the default Debian etch configuration on this vServer and
increasing MaxClients didn't do any good.
What could the problem be?
Regards,
Samy
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Only require satisfaction of one AuthType in 2.2
Posted by "William A. Rowe, Jr." <wr...@rowe-clan.net>.
William A. Rowe, Jr. wrote:
> Sorry - too many JJ's posting, had this confused.
>
>> On Mon, September 24, 2007 8:44 pm, Joel Johnson wrote:
>>> The problem I'm running into is in designating the authentication as
>>> *optional*. For example, I'd like to setup a wiki at wiki.and have the
>>> contents publicly accessible, but require authentication for edits. I'd like
>>> to first offer Kerberos authentication, but if that fails than still allow
>>> access. The application would then check REMOTE_USER and honor its value
>>> if set, or fallback to internal authentication if desired. This will also
>>> allow me to configure the server such that if a user is local and has Kerberos
>>> credentials they are seamlessly authenticated, but if not than I can have a
>>> login screen authenticating internally against the same source. There are
>>> several different ways that I will use this, but they all rely on optional
>>> authentication support.
>>>
>>> The working exclusively-Kerberos relevant config is simply:
>>> AuthType Kerberos
>>> require valid-user
>>>
>>> I've tried using a "Satisfy any" directive as follows, but the "Allow from
>>> all" seems to take precedence over any other method:
>>> AuthType Kerberos
>>> require valid-user
>>> Allow from all
>>> Satisfy any
>
> Did you make sure that to the denied resources, you have toggled either
> Deny from All
> or
> Satisfy All
> which should force the authentication? Beyond this, there's no way to
> 'optionally log in but not really if you don't want to'.
Actually; I have to say I haven't dug into kerbos auth; if it works as
NTLM auth, you actually can prod a client into giving up an auth token
and failover gracefully if none is present.
> I've also considered using a "KrbAuthoritative Off" directive to allow
> checking to fallthrough to the next module, but I can't find an
> authentication module with "accept all" semantics.
Actually that wouldn't be the approach; you are saying "if I can't get
a kerbos login, I'd be happy with /method X/ login instead". Which is
why this didn't help you.
The only other hint I can offer, if you present a page as 'auth required'
and fail over to a redirect to the auth-not-required page if they don't
pass, but to the auth accepted page if they do pass, this is one way
to differentiate the logged in vs. login not required users.
One a user logs in, most clients continue to present the login credentials
for that session/browser process.
Bill
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Only require satisfaction of one AuthType in 2.2
Posted by "William A. Rowe, Jr." <wr...@rowe-clan.net>.
Sorry - too many JJ's posting, had this confused.
Joel Johnson wrote:
> Does anyone have any thoughts, suggestions, pointers, tips or references on
> this issue?
>
> On Mon, September 24, 2007 8:44 pm, Joel Johnson wrote:
>>
>> The problem I'm running into is in designating the authentication as
>> *optional*. For example, I'd like to setup a wiki at wiki.and have the
>> contents publicly accessible, but require authentication for edits. I'd like
>> to first offer Kerberos authentication, but if that fails than still allow
>> access. The application would then check REMOTE_USER and honor its value
>> if set, or fallback to internal authentication if desired. This will also
>> allow me to configure the server such that if a user is local and has
>> Kerberos
>> credentials they are seamlessly authenticated, but if not than I can have a
>> login screen authenticating internally against the same source. There are
>> several different ways that I will use this, but they all rely on optional
>> authentication support.
>>
>> The working exclusively-Kerberos relevant config is simply:
>> AuthType Kerberos
>> require valid-user
>>
>> I've tried using a "Satisfy any" directive as follows, but the "Allow from
>> all" seems to take precedence over any other method:
>> AuthType Kerberos
>> require valid-user
>> Allow from all
>> Satisfy any
Did you make sure that to the denied resources, you have toggled either
Deny from All
or
Satisfy All
which should force the authentication? Beyond this, there's no way to
'optionally log in but not really if you don't want to'.
Bill
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Only require satisfaction of one AuthType in 2.2
Posted by "William A. Rowe, Jr." <wr...@rowe-clan.net>.
Joel Johnson wrote:
> Does anyone have any thoughts, suggestions, pointers, tips or references on
> this issue?
Not within 24 minutes.
Nope.
Bill
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Only require satisfaction of one AuthType in 2.2
Posted by Joel Johnson <mr...@lixil.net>.
Does anyone have any thoughts, suggestions, pointers, tips or references on
this issue?
Thanks!
On Mon, September 24, 2007 8:44 pm, Joel Johnson wrote:
> I'm setting up a site using Apache httpd 2.2 and an existing Kerberos
> infrastructure and would like to optionally allow users to have single
> sign-on with an existing Kerberos ticket. I'm using the Debian packaged [1]
> mod_auth_kerb [2] to accomplish the authentication which is all working
> smoothly.
>
> The problem I'm running into is in designating the authentication as
> *optional*. For example, I'd like to setup a wiki at wiki.and have the
> contents publicly accessible, but require authentication for edits. I'd like
> to first offer Kerberos authentication, but if that fails than still allow
> access. The application would then check REMOTE_USER and honor its value
> if set, or fallback to internal authentication if desired. This will also
> allow me to configure the server such that if a user is local and has
> Kerberos
> credentials they are seamlessly authenticated, but if not than I can have a
> login screen authenticating internally against the same source. There are
> several different ways that I will use this, but they all rely on optional
> authentication support.
>
> The working exclusively-Kerberos relevant config is simply:
> AuthType Kerberos
> require valid-user
>
> I've tried using a "Satisfy any" directive as follows, but the "Allow from
> all" seems to take precedence over any other method: AuthType Kerberos
> require valid-user Allow from all
> Satisfy any
>
>
> I've also considered using a "KrbAuthoritative Off" directive to allow
> checking to fallthrough to the next module, but I can't find an
> authentication module with "accept all" semantics.
>
> One option does look promising, but it only available in trunk/2.3 which I
> can't switch to for this project, but the following should work (corrections
> on assumption are welcome) by using two authorization providers with a
> single authentication method: AuthType Kerberos
> <SatisfyOne>
> Require valid-user
> Require all allowed
> </SatisfyOne>
>
>
> My goals are that I'd like the location to be available to all, and if
> authorized that is an extra bonus and allows seamlessness, customized content
> and others, but it should *not* be a requirement. Additionally, I want the
> content to be available under a single canonical URI which will be
> well-known, so symlinking directories with different <Location>s is not an
> option.
>
> If I've missed something simple, I'd love to have it pointed out, or if
> there is a best practice for this sort of setup please share!
>
>
> Many thanks for any guidance or pointers!
>
>
>
> The script that I'm using to do basic testing on the authentication is
> (basically, I also have some logic to remove the Kerberos realm that isn't
> included):
>
>
> <? if (empty($_SERVER['REMOTE_USER'])) {
> echo "You weren't automatically logged in, we'll have to do it locally."; }
> else { echo "Congratulations $username, you've logged on successfully!"; echo
> "REMOTE_USER = {$_SERVER['REMOTE_USER']} <br>";
> }
> ?>
>
>
> [1] http://packages.debian.org/etch/libapache2-mod-auth-kerb
> [2] http://modauthkerb.sourceforge.net/
>
>
> --
> Joel Johnson
>
>
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org