WebAuth config

55_mod_webauth.conf (text/plain), 2.16 KB, created by Roland Hopferwieser on 2008-08-18 20:02:51 UTC

<IfDefine WEBAUTH>
	LoadModule webauth_module modules/mod_webauth.so
</IfDefine>

<IfModule mod_webauth.c>
	WebAuthKeyringAutoUpdate on
	WebAuthKeyringKeyLifetime 30d

	WebAuthLoginURL "https://<your-webkdc>/login/"
	WebAuthWebKdcURL "https://<your-webkdc>/webkdc-service/"
	WebAuthWebKdcPrincipal webkdc/<your-webkdc>
	WebAuthKeyring /var/cache/apache2/webauth.keyring
	WebAuthKeytab /etc/webauth/webauth.keytab
	WebAuthServiceTokenCache /var/cache/apache2/service_token.cache
	WebAuthCredCacheDir /var/cache/apache2/webauth_cred_cache
	WebAuthSubjectAuthType krb5

	WebAuthSSLRedirect on

# This file is only needed if your WebKDC is using a self-signed
# certificate.  Stanford users should not need to set it.  For those that
# are, you should copy that certificate (the file mentioned in the
# WebKDC's Apache SSLCertificateFile directive) to a local file, and point
# to that file with this directive.

	#WebAuthWebkdcSSLCertCheck on
	#WebAuthWebKdcSSLCertFile /etc/webauth/cacert.pem

# If you are having trouble getting WebAuth to run, you should turn on
# debug.

	#WebAuthDebug on

# If you are really have trouble getting WebAuth to run, you should turn
# on debug, and also enable the /webauth-status URL, then point your
# browser at it to check on the status of mod_webauth.  You should turn
# off the webauth-status URL when you are done.

	#<Location /webauth-status>
	#   SetHandler webauth
	#   Order allow,deny
	#   Allow from all
	#</Location>

# Example of restricting a location to authenticated users only.  If
# uncommented, all URLs under /private/ would require WebAuth
# authentication to access.

	#<Location /private/>
	#    AuthType WebAuth
	#    Require valid-user
	#</Location>

# Example of a logout page for a particular application.  (Note that even
# if the user goes to this page, they will still have their site-wide
# single sign-on cookie, so they will not be completely logged out.  This
# will only destroy their credentials for that particular application.)
# There should also be a web page that this URL corresponds to; WebAuth
# will not generate one internally.

	#<Location /logout/>
	#    AllowOverride All
	#    WebAuthDoLogout on
	#</Location>
</IfModule>