There's been a lot of discussion on the list about getting mod_auth_kerb,
mod_waklog, filedrawers and CoSign all working together harmoniously under
Apache 2. I also struggled with this for a while, and eventually decided
to do a major modification/rewrite to mod_auth_kerb so that it can address
some of these concerns.
The new module I've called 'mod_afs_kerb' for the time being, anyway. It
is available here:
http://www.glue.umd.edu/downloads/mod_afs_kerb/mod_afs_kerb.5.3.tar.gz
This module will:
1) do the initial kerberos authentication, via
a) HTTP Basic Auth (over SSL)
b) SPNEGO/GSSAPI
2) use existing credentials provided by an external module (CoSign)
3) obtain AFS tokens for the authenticating user as desired
4) cache credentials based on SSL session ID to limit AS traffic
5) work with Apache 2.
In addition, when obtaining AFS tokens, it's possible to do so before the
Apache directory walk phase, which is a current limitation of mod_waklog.
This removes the requirement that the server itself must run with
credentials, and doesn't require special directory ACLs.
When using this module, the use of mod_waklog is not required.
One caveat: because we use Heimdal Kerberos, the AFS parts of this were
written to use the Heimdal functions. Someone will need to write a bit of
code to make this work with MIT kerberos. (See the afslog functions
inside #ifdef HEIMDAL) If there's enough interest, and no one else steps
up, I can look at doing it.
Also note: As part of the rewrite, for simplicity and improved
functionality, the existing Kerberos 4 and Apache 1 parts of the module
have been removed.
Enjoy!
Kevin
---
Kevin Hildebrand
University of Maryland, College Park
Office of Information Technology
_______________________________________________
OpenAFS-info mailing list
[email protected]
https://lists.openafs.org/mailman/listinfo/openafs-info
