[Freeipa-users] Re: How to set up kerberized web service with access control?

On 16.04.20 10:09, Dominik Vogt via FreeIPA-users wrote:

Hi folks,

on RHEL8.0, we've set up a small cluster with a FreeIPA server and two clients, one running a browser (Firefox) and the other running a web server (tomcat). (IdM is still configured with the defaults.) [...]

We are using mod_auth_gssapi and mod_authnz_pam with Apache in several setups. The important part is the

require pam-account something

line in the apache config where "something" refers to /etc/pam.d/something

This file has to have the following content: auth required pam_sss.so account required pam_sss.so

On the ipa side you need an HBAC service named "something".

That's it.

Cheers, Ronald