15.4. SSSD를 사용하도록 Apache 구성

다음 내용이 포함된 /etc/pam.d/openshift 파일을 만듭니다.

auth required pam_sss.so
account required pam_sss.so

이 구성을 사용하면 플러그형 인증 모듈인 PAM이 pam_sss.so 를 사용하여 openshift 스택에 대한 인증 및 액세스 요청이 발행될 때 인증 및 액세스 제어를 결정할 수 있습니다.

/etc/httpd/conf.modules.d/55-authnz_pam.conf 파일을 편집하고 다음 행의 주석 처리를 해제합니다.

LoadModule authnz_pam_module modules/mod_authnz_pam.so

원격 기본 인증을 위해 Apache httpd.conf 파일을 구성하려면 /etc/httpd/ conf.d 디렉터리에 openshift-remote-basic-auth.conf 파일을 만듭니다. 다음 템플릿을 사용하여 필요한 설정 및 값을 제공하십시오.

LoadModule request_module modules/mod_request.so
LoadModule php7_module modules/libphp7.so

# Nothing needs to be served over HTTP.  This virtual host simply redirects to
# HTTPS.
<VirtualHost *:80>
  DocumentRoot /var/www/html
  RewriteEngine              On
  RewriteRule     ^(.*)$     https://%{HTTP_HOST}$1 [R,L]
</VirtualHost>

<VirtualHost *:443>
  # This needs to match the certificates you generated.  See the CN and X509v3
  # Subject Alternative Name in the output of:
  # openssl x509 -text -in /etc/pki/tls/certs/remote-basic.example.com.crt
  ServerName remote-basic.example.com

  DocumentRoot /var/www/html

  # Secure all connections with TLS
  SSLEngine on
  SSLCertificateFile /etc/pki/tls/certs/remote-basic.example.com.crt
  SSLCertificateKeyFile /etc/pki/tls/private/remote-basic.example.com.key
  SSLCACertificateFile /etc/pki/CA/certs/ca.crt

  # Require that TLS clients provide a valid certificate
  SSLVerifyClient require
  SSLVerifyDepth 10

  # Other SSL options that may be useful
  # SSLCertificateChainFile ...
  # SSLCARevocationFile ...

  # Send logs to a specific location to make them easier to find
  ErrorLog logs/remote_basic_error_log
  TransferLog logs/remote_basic_access_log
  LogLevel warn

  # PHP script that turns the Apache REMOTE_USER env var
  # into a JSON formatted response that OpenShift understands
  <Location /check_user.php>
    # all requests not using SSL are denied
    SSLRequireSSL
    # denies access when SSLRequireSSL is applied
    SSLOptions +StrictRequire
    # Require both a valid basic auth user (so REMOTE_USER is always set)
    # and that the CN of the TLS client matches that of the OpenShift master
    <RequireAll>
      Require valid-user
      Require expr %{SSL_CLIENT_S_DN_CN} == 'system:openshift-master'
    </RequireAll>
    # Use basic auth since OpenShift will call this endpoint with a basic challenge
    AuthType Basic
    AuthName openshift
    AuthBasicProvider PAM
    AuthPAMService openshift

    # Store attributes in environment variables. Specify the email attribute that
    # you confirmed.
    LookupOutput Env
    LookupUserAttr mail REMOTE_USER_MAIL
    LookupUserGECOS REMOTE_USER_DISPLAY_NAME

    # Other options that might be useful

    # While REMOTE_USER is used as the sub field and serves as the immutable ID,
    # REMOTE_USER_PREFERRED_USERNAME could be used to have a different username
    # LookupUserAttr <attr_name> REMOTE_USER_PREFERRED_USERNAME

    # Group support may be added in a future release
    # LookupUserGroupsIter REMOTE_USER_GROUP
  </Location>

  # Deny everything else
  <Location ~ "^((?!\/check_user\.php).)*$">
      Deny from all
  </Location>
</VirtualHost>

check_user.php 스크립트를 /var/www/html 디렉터리에 생성합니다. 다음 코드를 포함합니다.

<?php
// Get the user based on the Apache var, this should always be
// set because we 'Require valid-user' in the configuration
$user = apache_getenv('REMOTE_USER');

// However, we assume it may not be set and
// build an error response by default
$data = array(
    'error' => 'remote PAM authentication failed'
);

// Build a success response if we have a user
if (!empty($user)) {
    $data = array(
        'sub' => $user
    );
    // Map of optional environment variables to optional JSON fields
    $env_map = array(
        'REMOTE_USER_MAIL' => 'email',
        'REMOTE_USER_DISPLAY_NAME' => 'name',
        'REMOTE_USER_PREFERRED_USERNAME' => 'preferred_username'
    );

    // Add all non-empty environment variables to JSON data
    foreach ($env_map as $env_name => $json_name) {
        $env_data = apache_getenv($env_name);
        if (!empty($env_data)) {
            $data[$json_name] = $env_data;
        }
    }
}

// We always output JSON from this script
header('Content-Type: application/json', true);

// Write the response as JSON
echo json_encode($data);
?>

Apache를 활성화하여 모듈을 로드합니다. /etc/httpd/conf.modules.d/55-lookup_identity.conf 파일을 수정하고 다음 행의 주석을 제거합니다.

LoadModule lookup_identity_module modules/mod_lookup_identity.so

SElinux가 Apache가 D-BUS를 통해 SSSD에 연결할 수 있도록 SELinux 부울을 설정합니다.

# setsebool -P httpd_dbus_sssd on

SELinux가 Apache가 PAM 하위 시스템에 연결할 수 있음을 알리도록 부울을 설정합니다.

# setsebool -P allow_httpd_mod_auth_pam on

Apache 시작:

# systemctl start httpd.service