Website Login System - Out of the box

Question

I am building a simple website that basically hosts a bunch of PDFs behind a PDF Viewer app. I will link to these PDFs from an external site, but I need a way of keeping these from being openly accessible. There is also a interactive map viewer component that is hosted on the server (ESRI Web Appbuilder). This already has its own security mechanism.

I am looking for a solution that allows me to basically lock an entire webserver (Apache in this case, but open to other suggestions), behind a login screen. Ideally it would support either Active Directory and/or OAuth.

I am aware of Apache basic auth, but as I understand it, this would check credentials on every page load, which might not make our IT people very happy and also would probably slow things down somewhat.

Answer 1

You should be able to use Basic with with the Apache HTTPD LDAP module. There are options for caching results, which ought to mollify your IT department. The Samba wiki - https://wiki.samba.org/index.php/Authenticating_Apache_against_Active_Directory - has details, for example:

---

Basic LDAP authentication

Example of where you need this: You want Apache to permit access to a directory on your webserver just for AD users that are members of a defined AD group (I used group test in the example). Username and password should be validated against AD.

• Create a new user in ADUC or with samba-tool, that Apache will use for connecting to the AD (I used "apache-connect" in the example below).

• Add the following to your .htaccess or your httpd.conf (vHost/directory/... directive):

  AuthName "AD authentication"
  AuthBasicProvider ldap
  AuthType Basic
  AuthLDAPGroupAttribute member
  AuthLDAPGroupAttributeIsDN On
  AuthLDAPURL ldap://{AD-Hostname/IP}:389/cn=Users,dc={your Domain DN}?sAMAccountName?sub?(objectClass=*)
  AuthLDAPBindDN cn=apache-connect,cn=Users,{your Domain DN}
  AuthLDAPBindPassword {password} require ldap-group cn=test,cn=Users,{your Domain DN} 
  

  With this configuration, the username is searched for just in the "Users" container and below. If you want to search in any OU of your domain, then you have to add

  REFERRALS off

  to your /etc/openldap/ldap.conf. Otherwise accessing doesn't work and apache will log auth_ldap authenticate: user xxx authentication failed; URI / [ldap_search_ext_s() for user failed][Operations error]!. If you're still getting this error after turning referrals off, set Apache to connect to Samba/AD port 3268 (AD global catalog) instead to the standard LDAP 389 port.

  Make sure that your configuration file is only readable by the webserver, because of the password!

• Restart apache.

---

The same page also has configuration examples for browser SSO, which may be of interest.