[Freeipa-users] Re: How to set up kerberized web service with access control?
On 16.04.20 10:09, Dominik Vogt via FreeIPA-users wrote:
Hi folks,
on RHEL8.0, we've set up a small cluster with a FreeIPA server and
two clients, one running a browser (Firefox) and the other running
a web server (tomcat). (IdM is still configured with the
defaults.)
[...]
We are using mod_auth_gssapi and mod_authnz_pam with Apache in several
setups. The important part is the
require pam-account something
line in the apache config where "something" refers to /etc/pam.d/something
This file has to have the following content:
auth required pam_sss.so
account required pam_sss.so
On the ipa side you need an HBAC service named "something".
That's it.
Cheers,
Ronald