-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathREADME
369 lines (254 loc) · 11.8 KB
/
README
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
Apache module mod_lookup_identity
=================================
Apache module to lookup user identifier and retrieve additional
information about the authenticated user.
The module supports lookup of the user identifier based on
certificate via SSSD D-Bus call, setting up the r->user request
structure.
Method org.freedesktop.sssd.infopipe.Users.FindByNameAndCertificate
is used by default and value of query string parameter configured
with directive LookupUserByCertificateParamName is passed to SSSD
together with certificate to allow mapping of single certificate to
multiple user accounts.
Setting NO_CERTIFICATE_MAPPING_SUPPORT at build time changes the
module so it does not check the query string and calls SSSD D-Bus
method org.freedesktop.sssd.infopipe.Users.FindByCertificate.
It also allows retrieval of list of group names the user belongs to
using org.freedesktop.sssd.infopipe.GetUserGroups call and any
custom attributes configured in /etc/sssd/sssd.conf using with
org.freedesktop.sssd.infopipe.GetUserAttr call. It can also retrieve
the GECOS information using the getpwnam call. The retrieved values
get stored in notes/environment variables.
The sssd-dbus package needs to be installed and the ifp service
enabled in the [sssd] section of /etc/sssd/sssd.conf.
The module itself needs to be loaded into Apache's configuration file
like /etc/httpd/conf/httpd.conf with directive like
LoadModule lookup_identity_module modules/mod_lookup_identity.so
User Lookup
-----------
By default, no user identifier lookup is enabled. Directive
LookupUserByCertificate On
enables the lookup. It uses the original internal r->user value
as input, so the typical setup for example with mod_ssl will be
SSLVerifyClient require
SSLUserName SSL_CLIENT_CERT
LookupUserByCertificate On
when mod_ssl puts the certificate to the username field and then
mod_lookup_identity replaces it with user identifier found with
org.freedesktop.sssd.infopipe.Users.FindByCertificate. If no user
is found based on the certificate, the r->user value is cleared.
Make sure the FakeBasicAuth is not enable in SSLOptions or the
r->user will not be set.
SSSD version 1.13 or higher is needed for LookupUserByCertificate
functionality.
Retrieving Group Membership and Attributes
------------------------------------------
For the custom attributes fetching, caching of non-POSIX attributes
needs to be enabled in the [domain/*] section of /etc/sssd/sssd.conf,
configuration ldap_user_extra_attrs, and the attributes also need to
be enabled in the [ifp] section using the user_attributes
configuration option.
Example of sssd.conf:
[domain/example.com]
...
ldap_user_extra_attrs = mail, telephoneNumber, givenname, sn
[sssd]
services = nss, pam, ssh, ifp
[ifp]
allowed_uids = apache, root
user_attributes = +mail, +telephoneNumber, +givenname, +sn
The default behaviour can be changed with the following directives:
LookupOutput where_to_store_results
Specifies if the lookups will be done at all and where the results
of the lookup will be stored. Possible values are:
None: Disable the lookup altogether
Notes: Sets the Apache notes table only
Env: Sets environment variables only
Headers: Sets HTTP request headers, for use by proxy setups.
Headers-Base64: Sets HTTP request headers with values
Base64-encoded, for use by proxy setups.
The default is Notes and Env.
LookupUserGECOS name
Name of the note and/or environment variable for the GECOS
value. If prefixed with '+' sign, it is set only if the
note/environment variable is not set yet, otherwise the
value is overwritten.
Setting this option requires for the user identity to be
POSIX identity, retrievable with getpwnam.
Example: LookupUserGECOS REMOTE_USER_FULLNAME
Example: LookupUserGECOS +REMOTE_USER_GECOS
Default is not set.
LookupUserGroups name [separator]
Name of the note and/or environment variable for the list of groups
retrieved using the org.freedesktop.sssd.infopipe.GetUserGroups
call, and optionally separator for multiple groups.
If the separator is specified, it is used to concatenate
multiple groups in single string value of the
note/environment variable. If the separator is not specified,
only one group is set.
Example: if user alice is member of groups staff and student,
option
LookupUserGroups REMOTE_USER_GROUPS :
will set value of REMOTE_USER_GROUPS to staff:student (or
student:staff, depending on the order returned by the sssd
dbus call). If the option is
LookupUserGroups REMOTE_USER_GROUPS
the value will be either staff or student (the first in the list
returned by the sssd dbus call; order not to be relied on).
When
LookupOutput headers-base64
is specified, the values are encoded individually and then
concatenated. For the staff and student values example,
LookupUserGroups REMOTE-USER-GROUPS :
will produce c3RhZmY=:c3R1ZGVudA==.
When prefixed with '+' sign and the note/environment variable
already has some value set, behaviour differs depending on
whether the optional separator is specified or not. If it is,
the string with separator-separated values is appended after
separator to existing value. If separator is not specified,
existing value is preserved.
Example: when user alice is member of groups staff and student,
and the environment variable REMOTE_USER_GROUPS already has
value "anonymous" set (by Apache configuration or by some
module that was invoked before mod_lookup_identity), directive
LookupUserGroups +REMOTE_USER_GROUPS :
will set the value to "anonymous:staff:student" (or
"anonymous:student:staff"). On the other hand,
LookupUserGroups +REMOTE_USER_GROUPS
would leave the value unchanged at "anonymous".
By default, groups are not retrieved.
LookupUserGroupsIter name
The number of groups the user is a member of (as returned by
the org.freedesktop.sssd.infopipe.GetUserGroups call) will be
stored in note/environment variable <name>_N and individual
values in <name>_1 .. <name>_<<name>_N>. This allows for
safe retrieval of groups without the separator clashing with
the values.
Example: if user alice is member of groups staff and student,
option
LookupUserGroupsIter REMOTE_USER_GROUP
will set
REMOTE_USER_GROUP_N=2
REMOTE_USER_GROUP_1=staff
REMOTE_USER_GROUP_2=student
(or the values of REMOTE_USER_GROUP_1 and REMOTE_USER_GROUP_2
will be flipped).
When
LookupOutput headers-base64
is specified and assuming
LookupUserGroupsIter REMOTE-USER-GROUP
the HTTP header values will be
REMOTE-USER-GROUP-N=2
REMOTE-USER-GROUP-1=c3RhZmY=
REMOTE-USER-GROUP-2=c3R1ZGVudA==
Note that the numerical <name>_N is not Base64-encoded.
If user is not a member of any group, the <name>_N value will
be set to 0.
When the name is prefixed with '+' sign, existing values are
preserved and new values added to the list. Thus, if alice is
member of groups staff and student and REMOTE_USER_GROUP_N
already has value 2 set and the directive is
LookupUserGroupsIter +REMOTE_USER_GROUP
the module will set values of REMOTE_USER_GROUP_3
and REMOTE_USER_GROUP_4 and will update REMOTE_USER_GROUP_N
to value 4. The module will however not check/fix the consistency
of existing values; if REMOTE_USER_GROUP_N is set to value 2
prior to invocation of mod_lookup_identity, it will not check
if REMOTE_USER_GROUP_1 and REMOTE_USER_GROUP_2 are set to match
REMOTE_USER_GROUP_N.
By default, groups are not retrieved.
LookupUserAttr the_attribute name [separator]
Name of the attribute to be retrieved using the
org.freedesktop.sssd.infopipe.GetUserAttr call and name of
the note and/or environment variable where the value will
be stored, and optionally separator for multivalued results.
If the separator is specified, it is used to concatenate
multiple values in single string value of the
note/environment variable. If the separator is not specified,
only one value is set.
Example:
LookupUserAttr mail REMOTE_USER_MAIL
will retrieve one value from the mail attribute (from potentially
multivalued attribute) and store them to note/environment
variable REMOTE_USER_MAIL.
Directive
LookupUserAttr mail REMOTE_USER_MAIL ", "
will retrieve all the values and store them as comma-separated
string. The same way as with LookupUserGroups, headers-base64
will first Base64 encode and then concatenate.
When the name is prefixed with '+' sign, similar to LookupUserGroups
it will only set the value if not set yet, or append to existing
value if separator is specified: when
LookupUserAttr team +REMOTE_USER_TEAMS ", "
is configured and REMOTE_USER_ORGS is already set to "IT" and
the sssd dbus returned values "Helpdesk" and "Support", the
resulting value will be "IT, Helpdek, Support".
Multiple LookupUserAttr lines can be used to retrieve multiple
attributes.
By default, no user attributes are retrieved.
LookupUserAttrIter the_attribute name
The number of attribute values for the user (as returned by
the org.freedesktop.sssd.infopipe.GetUserAttr call) will be
stored in note/environment variable <name>_N and individual
values in <name>_1 .. <name>_<<name>_N>. This allows for
safe retrieval of multivalued attributes without the
separator clashing with the values.
Example: if user alice has multivalued custom attribute
office_no with values M314 and P005,
LookupUserAttrIter office_no REMOTE_USER_OFFICE
will cause the following notes/environment variables to be
set:
REMOTE_USER_OFFICE_N=2
REMOTE_USER_OFFICE_1=M314
REMOTE_USER_OFFICE_2=P005
When the '+' sign is used, behaviour matches the behaviour of
LookupUserGroupsIter -- the list formed by _N and _# variables
is appended to.
Multiple LookupUserAttr lines can be used to retrieve multiple
attributes.
By default, no user attributes are retrieved.
LookupDbusTimeout miliseconds
Default: 5000 (== 5 s).
LookupUserByCertificateParamName
Name of parameter for HTTP request's query string. The value from
query string (if there is any) is then sent to SSSD together with
the certificate. This is useful when single certificate is
assigned to multiple user accounts.
By default, no parameter is parsed from query string.
Please note that LookupUserGroups and LookupUserGroupsIter, as well as
LookupUserAttr and LookupUserAttrIter for single attribute can be
configured with the same note/environment variable name. For example,
LookupUserGroups REMOTE_USER_GROUPS :
LookupUserGroupsIter REMOTE_USER_GROUP
can be set at the same time and for user with two groups, all the
following values will be set:
REMOTE_USER_GROUPS=staff:student
REMOTE_USER_GROUP_N=2
REMOTE_USER_GROUP_1=staff
REMOTE_USER_GROUP_2=student
Building from sources
---------------------
When building from sources, command
apxs -n lookup_identity -i -a -c $(pkg-config --cflags dbus-1) \
$(pkg-config --libs dbus-1) \
-Wc,"-Wall -pedantic -std=c99" mod_lookup_identity.c
should build and install the module.
If the available version of sssd does not provide or is not configured
to provide the ifp dbus service, compile with
apxs -DNO_USER_ATTR -i -a -n lookup_identity
-c -Wc,"-Wall -pedantic -std=c99" \
mod_lookup_identity.c
In that case, the LookupUserAttr functionality will not be compiled
in and will not be available.
License
-------
Copyright 2013--2017 Jan Pazdziora
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.