KP,
Not sure exactly what you are trying to do, but typically you can use CAS
attributes to make authorization decisions instead of having to use LDAP to
make a separate query. Your particular needs may be different. In a
typical case, one might only allow subjects to use a service if the account
owner can authenticate with CAS *and* CAS releases a particular entitlement
value to the service during tiket validation. So with mod_auth_cas,
something like:
In the httpd config for the mod_auth_cas module (e.g. cas.conf in
/etc/httpd/conf.d or some other conf include folder):
LoadModule auth_cas_module modules/mod_auth_cas.so
CASCookiePath /var/cache/mod_auth_cas/
CASLoginURL *${CAS_PREFIX}*/login
CASValidateURL *${CAS_PREFIX}*/samlValidate
CASValidateSAML On
In the vhost config:
<Location / >
CASScope /
Authtype CAS
Require cas-attribute eduPersonEntitlement:
https://myservice.example.org/users
</Location>
NOTE: The *${...}* syntax above is just a placeholder I am using-- I think
you actually can use environment variables in an Apache config with this
syntax, but I'm not suggesting that you ought to do that.
This example only allows users to log in if they can authenticate to CAS
and CAS releases an attribute named "eduPersonEntitlement" with a value of "
https://myservice.example.org/users";. You could use group memberships or
whatever attributes are appropriate.
That means that your web app is totally decoupled from your centralized
person directory. CAS brokers the authentication and provides the
information necessary to make policy enforcement decisions.
Thanks,
Carl Waldbieser
ITS
Lafayette College
On Thu, Feb 11, 2021 at 6:32 PM KC Pullen <[email protected]> wrote:
> Hello,
>
> I'm currently using CAS to protect web directories on Linux Centos7 and
> Apache 2.4.6.
>
> I'd like to use LDAP to grant authorization to select groups.
>
> The following is a list the sites/blogs that I'm using for reference:
> - https://fy.blackhats.net.au/blog/html/2011/07/10/Mod_auth_cas.html
> - https://httpd.apache.org/docs/2.4/mod/mod_authnz_ldap.html#authldapurl
> -
> https://stackoverflow.com/questions/8939487/how-to-support-require-group-foobar-in-mod-auth-cas
>
> Now, for "valid-user", there is no problem at all, but if I try to use
> LDAP and a filter, I'm getting the "Unauthorized" message.
>
> Below is a snippet from my conf file:
>
>
> <Directory /var/www/html/my-test-site>
>
> AuthName "Test password protection for directory"
> AuthType CAS
> AuthLDAPURL "ldaps://
> mysite.edu:636/cn=Users,dc=nl,dc=edu?email?sub?(objectClass=*)"
> Require ldap-filter &([email protected])
> # Require valid-user
>
> </Directory>
>
> Would anyone be able to take a look and provide a suggestion or two ?
> Maybe share a link to a blog or web-page..?
>
> Thank you kindly,
>
> KP
>
>
> --
> - Website: https://apereo.github.io/cas
> - Gitter Chatroom: https://gitter.im/apereo/cas
> - List Guidelines: https://goo.gl/1VRrw7
> - Contributions: https://goo.gl/mh7qDG
> ---
> You received this message because you are subscribed to the Google Groups
> "CAS Community" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [email protected].
> To view this discussion on the web visit
> https://groups.google.com/a/apereo.org/d/msgid/cas-user/de52d5e0-1f27-4b83-818d-6c0d5a252a57n%40apereo.org
> <https://groups.google.com/a/apereo.org/d/msgid/cas-user/de52d5e0-1f27-4b83-818d-6c0d5a252a57n%40apereo.org?utm_medium=email&utm_source=footer>
> .
>
--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/CALt4NbNeY9Ox6bS4BMS8WcksVA%3D4DJOnGFDB2fWt4wRjE03r0w%40mail.gmail.com.
