Re: [users@httpd] Public viewing when it should be private
I would also recommend mod_auth_cas if your SSO supports it - very easy to set up. - Y Sent from a device with a very small keyboard and hyperactive autocorrect. On Thu, May 20, 2021, 2:41 AM Michael Wechner wrote: > Hi Michael > > I think it depends on your SSO app, more specifically what standards it > supports. > > For example you could use *mod_auth_kerb** and * > > *mod_auth_gssapi * > https://active-directory-wp.com/docs/Networking/Single_Sign_On/Kerberos_SSO_with_Apache_on_Linux.html > https://wiki.centos.org/HowTos/HttpKerberosAuth > > Another possibility might be to use JWT > > https://www.miniorange.com/apache-adfs-single-sign-on(sso) > > or > > https://github.com/zmartzone/mod_auth_openidc > > Also have a look at > > https://httpd.apache.org/docs/trunk/howto/auth.html > > I am not sure what other possibilities exist which work together with your > SSO app, but it might be less effort to just move your documentation into > your app servers. > > HTH > > Michael > > > > Am 20.05.21 um 06:46 schrieb Michael D.: > > Hello user group. > > I maintain a website that authenticates users through an internal > single-sign-on app. > > I have a documentation page that is publically viewable but I only want it > viewable after authentication. I've looked into .htaccess but I don't want > a separate login process for users to view documentation. I want them to be > able to login through our internal SSO and automatically have access to > those documents that are currently stored on the web server. > > Is this possible to do through Apache or should these static documentation > pages be put on our app servers and then served up for authenticated users? > > I'm not finding a way to avoid a second authentication process just to > view documentation that is private info for only authorized users > > (Fyi we have thousands of users that need access to this documentation.) > > >
Re: [users@httpd] Public viewing when it should be private
Thanks for the responses Daniel and Michael. I will look into those links and see where I get. On Wed, May 19, 2021, 11:42 PM Michael Wechner wrote: > Hi Michael > > I think it depends on your SSO app, more specifically what standards it > supports. > > For example you could use *mod_auth_kerb** and * > > *mod_auth_gssapi * > https://active-directory-wp.com/docs/Networking/Single_Sign_On/Kerberos_SSO_with_Apache_on_Linux.html > https://wiki.centos.org/HowTos/HttpKerberosAuth > > Another possibility might be to use JWT > > https://www.miniorange.com/apache-adfs-single-sign-on(sso) > > or > > https://github.com/zmartzone/mod_auth_openidc > > Also have a look at > > https://httpd.apache.org/docs/trunk/howto/auth.html > > I am not sure what other possibilities exist which work together with your > SSO app, but it might be less effort to just move your documentation into > your app servers. > > HTH > > Michael > > > > Am 20.05.21 um 06:46 schrieb Michael D.: > > Hello user group. > > I maintain a website that authenticates users through an internal > single-sign-on app. > > I have a documentation page that is publically viewable but I only want it > viewable after authentication. I've looked into .htaccess but I don't want > a separate login process for users to view documentation. I want them to be > able to login through our internal SSO and automatically have access to > those documents that are currently stored on the web server. > > Is this possible to do through Apache or should these static documentation > pages be put on our app servers and then served up for authenticated users? > > I'm not finding a way to avoid a second authentication process just to > view documentation that is private info for only authorized users > > (Fyi we have thousands of users that need access to this documentation.) > > >
Re: [users@httpd] Public viewing when it should be private
Hi Michael I think it depends on your SSO app, more specifically what standards it supports. For example you could use /mod_auth_kerb//and //mod_auth_gssapi /https://active-directory-wp.com/docs/Networking/Single_Sign_On/Kerberos_SSO_with_Apache_on_Linux.html https://wiki.centos.org/HowTos/HttpKerberosAuth Another possibility might be to use JWT https://www.miniorange.com/apache-adfs-single-sign-on(sso) or https://github.com/zmartzone/mod_auth_openidc Also have a look at https://httpd.apache.org/docs/trunk/howto/auth.html I am not sure what other possibilities exist which work together with your SSO app, but it might be less effort to just move your documentation into your app servers. HTH Michael Am 20.05.21 um 06:46 schrieb Michael D.: Hello user group. I maintain a website that authenticates users through an internal single-sign-on app. I have a documentation page that is publically viewable but I only want it viewable after authentication. I've looked into .htaccess but I don't want a separate login process for users to view documentation. I want them to be able to login through our internal SSO and automatically have access to those documents that are currently stored on the web server. Is this possible to do through Apache or should these static documentation pages be put on our app servers and then served up for authenticated users? I'm not finding a way to avoid a second authentication process just to view documentation that is private info for only authorized users (Fyi we have thousands of users that need access to this documentation.)
Re: [users@httpd] Public viewing when it should be private
Hello, Depends entirely on how you implement that SSO auth you mention. For example, I have experience with a SSO implementation that allows you to do what you specify with apache through a third party module, but you are not specifying which is the SSO implementation or what it can do, so we can only guess. .htaccess has nothing to do with authentication so I guess that's out of the question. .htaccess is just used to allow non-admins configure directory directives. El jue, 20 may 2021 a las 6:47, Michael D. () escribió: > > Hello user group. > > I maintain a website that authenticates users through an internal > single-sign-on app. > > I have a documentation page that is publically viewable but I only want it > viewable after authentication. I've looked into .htaccess but I don't want a > separate login process for users to view documentation. I want them to be > able to login through our internal SSO and automatically have access to those > documents that are currently stored on the web server. > > Is this possible to do through Apache or should these static documentation > pages be put on our app servers and then served up for authenticated users? > > I'm not finding a way to avoid a second authentication process just to view > documentation that is private info for only authorized users > > (Fyi we have thousands of users that need access to this documentation.) -- Daniel Ferradal HTTPD Project #httpd help at Freenode - To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org For additional commands, e-mail: users-h...@httpd.apache.org
