Apache Single Sign On in Windows | Schäuffelhut Berger GmbH

In this post I am going to explain a rather unusual setup which we have implemented for a customer lately: Apache Single Sign On using Active Directory Server. This is not so unusual. The exceptional requirement is Apache running on a Windows Server not on a Linux Server.

For Apache on Windows there is no precompiled Kerberos module available. So we compiled it. Read on to find out how we configured the whole setup.

Please leave a comment on this page and tell us what you think. If we can be of any help let us know!

The Environment

Windows Server, Active Directory Server (ADS)
in this document I will refer to this server as ADS.your.domain@your.domain
Windows Server, Apache 2.2
in this document I will refer to this server as APACHE.your.domain@your.domain
Windows Client, e.g Windows 7

When I write your.domain, then replace it with the domain name your ADS is configured for.
When I write YOUR.DOMAIN, replace it with your domain name all in caps.

Create technical Users in ADS

User „apachekerb“ is used by Apache when authenticating users against ADS using the Kerberos protocol.
User „apacheldap“ is used by Apache for LDAP queries.

When creating these users in ADS make sure „User must change password at next logon“ is unchecked and „Password never expires“ is checked.
Pick a password for both users. In this example I use „zx890as$%^“ for both.

Create Group in ADS

Create ADS group „ApacheSSOAccess“. Add users which may access the Web Server.

Create test Users in ADS

To test the configuration I create two user accounts. One that will be granted access and one that will be denied access:

„ssotestgranted@your.domain“ in group „ApacheSSOAccess“
„ssotestdenied@your.domain“ not in the group

Create a Kerberos token

Apache needs an access code for accessing the ADS. Execute the following command on the ADS host in a cmd shell. Please be sure to replace APACHE.your.domain@your.domain with the name of the server Apache is installed on!

ktpass -princ HTTP/APACHE.your.domain@your.domain -mapuser apachekerb -crypto rc4-hmac-nt -ptype KRB5_NT_PRINCIPAL -pass zx890as$%^ -out c:\apache.keytab

Later I will copy c:\apache.keytab to the Apache Server.

1. Install apache 2.2

Get Apache 2.2 installer from here.
Note you must use Apache 2.2 from the specified source as our mod_auth_kerb
is specifically built for this version. Download it here.

2. Install MIT Kerberos for Windows 4.0.1

Get the MIT Kerberos installer from here.

Choose installation type „Typical“.
Install location is C:\Program Files (x86)\MIT\Kerberos

3. Configure MIT Kerberos

Add to empty file C:\ProgramData\MIT\Kerberos5\krb.ini

[libdefaults] debug=true default_realm = YOUR.DOMAIN dns_lookup_kdc = false krb4_config = /etc/krb.conf krb4_realms = /etc/krb.realms kdc_timesync = 1 ccache_type = 4 forwardable = true proxiable = true

[realms] YOUR.DOMAIN = { kdc = ADS.your.domain admin_server = ADS.your.domain default_domain = your.domain }

[domain_realm] .your.domain = YOUR.DOMAIN

[login] krb4_convert = true krb4_get_tickets = false

4. Copy apache.keytab into Apache2.2 conf directory

Now I copy the „apache.keytab“ file from the ADS to the Apache Server. The file needs to end up in „APACHE_HOME\conf\apache.keytab“.

5. Create authsso\index.php in document root

This folder is used to test SSO and authorization.

File: \authsso\index.php
Content:

    <html>
     <head>
      <meta http-equiv="Pragma" content="no-cache" />
     </head>
     <body>
      <h1>Authenticated!</h1>
      REMOTE\_USER: <?php echo $\_SERVER\["REMOTE\_USER"\]; ?></br>
      PHP\_AUTH\_USER: <?php echo $\_SERVER\["PHP\_AUTH\_USER"\]; ?></br>
     </body>
    </html>

6. Copy Module mod_auth_kerb.so into Apache modules directory

From: C:\Users\Public\Downloads\mod_auth_kerb.so
To: \modules\mod_auth_kerb.so

Source: Schäuffelhut Berger GmbH

7. Update Apache Config

File: \conf\httpd.conf

Enable modules needed for authorization and authentication:

   LoadModule auth\_kerb\_module modules/mod\_auth\_kerb.so
   LoadModule authnz\_ldap\_module modules/mod\_authnz\_ldap.so
   LoadModule authz\_default\_module modules/mod\_authz\_default.so

Append at the end of httpd.conf:

   # http://shib.ametsoc.org/manual/mod/mod\_ldap.html
   # cache ldap results for 60 seconds
   LDAPCacheTTL   60
   LDAPOpCacheTTL 60

    <Location /authsso>
       AuthType KerberosV5
       AuthName "Kerberos Login"
       KrbAuthRealm your.domain
       KrbServiceName HTTP/APACHE.your.domain@your.domain

       # on windows Krb5Keytab only works for absolute paths!
       Krb5Keytab "<APACHE INSTALL DIR>\\conf\\apache.keytab"

       KrbMethodK5Passwd on
       KrbMethodNegotiate on

       AuthzLDAPAuthoritative on

       # find LDAP user by Kerberos userPrincipalName.
       AuthLDAPURL "ldap://ADS.your.domain/DC=your,DC=domain?userPrincipalName"

       # use Common Name as displayed in ADS
       AuthLDAPBindDN "cn=apacheldap,DC=your,DC=domain"
       AuthLDAPBindPassword "zx890as$%^"

       # use Common Name as displayed in ADS
       # no quotes around GROUP!
       Require ldap-group CN=ApacheSSOAccess,DC=your,DC=domain

       Satisfy All
    </Location>

8. Users that may access /authsso must be set up like ssotestgranted@your.domain

Account name must match „User Principal Name“ for LDAP lookup to succeed.
Account must be member of ldap-group ApacheSSOAccess

Conclusion

Getting this setup to work was a challenge but it was an interesting experience. I hope this blog post will help you. Please leave a comment if you have any suggestions or questions.