Package: nginx-krbauth
nginx-krbauthLDAP + Kerberos authenticator for nginx's auth_request module.Installationpipinstallnginx-krbauthIf, for some reason, you want to use the latest code from git:pipinstallgit+https://github.com/quantum5/nginx-krbauth.gitUsageLoadnginx_krbauth:appinto any WSGI compatible server.
Configuration is done through environment variables.Example:[uwsgi]protocol=uwsgisocket=/tmp/krbauth.sockmodule=nginx_krbauth:appenv=KRB5_KTNAME=FILE:/home/krbauth/.keytabenv=KRBAUTH_HMAC_KEY=hunter2env=KRBAUTH_LDAP_SERVER=ldapi:///env=KRBAUTH_LDAP_BIND_DN=cn=http,ou=Apps,dc=example,dc=comenv=KRBAUTH_LDAP_BIND_AUTHTOK=hunter2env=KRBAUTH_LDAP_SEARCH_BASE=dc=example,dc=comnginx_krbauthexports two HTTP endpoints:/krbauth: This endpoint performs SPNEGO authentication. When done, it
sets a session cookie and generates a 307 redirect to the URL in thenextGET parameter./krbauth/check: The endpoint checks the validity of the session cookie. If
valid, it returns 200. Otherwise, it returns 401.The intention is to use/krbauth/checkasauth_requestin yournginxconfiguration. On 401,nginxshould be configured to generate a redirect to/krbauth.ConfigurationKRB5_KTNAME: This is actually a Kerberos setting. It should point to a
keytab file that only the user runningnginx_krbauthcan read containing
the Kerberos host principals.KRBAUTH_HMAC_KEY(required): This is the HMAC key used to sign cookies. It
should be a long random string. Keep it secret!KRBAUTH_KEY_DURATION: The duration (in seconds) for which the session cookie
is valid. Default: 1 hour.KRBAUTH_RANDOM_SIZE: The length of the nonce in the session cookie in bytes.
Default: 32.KRBAUTH_GSSAPI_NAME: The GSSAPI name for the service. Leave blank if any
name in the keytab is fine.KRBAUTH_SECURE_COOKIE: This controls whether the session cookie is marked as
HTTPS-only. Default: yes. Set to0ornoto disable.LDAPnginx_krbauthcan also optionally check LDAP group membership. It does so by
looking up the groups of the LDAP entity whosekrbPrincipalNameattribute
matches the name of the Kerberos principal used to authenticate.The group is specified through the WSGI environment variableKRBAUTH_LDAP_GROUP. This could be set throughuwsgi_param, for example.The following environment variables are used to configurenginx_krbauth's
LDAP support:KRBAUTH_LDAP_SERVER: The LDAP URI used to connect to the LDAP server.KRBAUTH_LDAP_SEARCH_BASE: The root of the subtree to search for LDAP
entities forkrbPrincipalNameand group membership.KRBAUTH_LDAP_BIND_DN: The DN used to bind to the LDAP server. Leave blank
for anonymous bind.KRBAUTH_LDAP_BIND_AUTHTOK: The password used to bind to the LDAP server.
Leave blank for anonymous bind.LDAP binding can also be used as a fallback authentication mechanism through
HTTP Basic authentication. This is useful when SPNEGO is not supported, or when
the client does not support Kerberos. To use this, configure:KRBAUTH_LDAP_USER_DN: A string template to convert usernames into LDAP DNs.
There should be one%ssymbol in this string, which will be replaced by the
username.Examplenginx.confauth_request/krbauth/check;error_page401=@krbauth;location@krbauth{return307/krbauth?next=$request_uri;}location/krbauth{auth_requestoff;error_page527error.html;# To cancel out error_page 401 outside.uwsgi_passunix:/tmp/krbauth.sock;uwsgi_pass_request_bodyoff;uwsgi_paramKRBAUTH_LDAP_GROUP"cn=group,dc=example,dc=com";includeuwsgi_params;}