Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My problem is, I have a number of prepackaged web apps (a print system, a wiki, a bug tracker, an email archive, etc.) running on different Mac OS X Leopard (soon to be SL) servers that each need to authenticate users from the internet at large. Right now every server presents an Apache basic authentication prompt, which takes a shared login, but it's apparently enough of an inconvenience to log in repeatedly that people are sending email without checking the wiki or bug tracker or archive. In the case of the bug tracker, a user [might need to log in twice---once for apache if he hasn't used any other protected service on that server, once for the bug tracker itself so it can distinguish different people.

Since the only common component to all these apps is Apache 2 itself, does it have any way of authenticating a user once, in some way that will be respected by other servers and various web apps?

Looked at http://serverfault.com/questions/32421/how-is-session-stickiness-achieved-across-multiple-web-servers but it sounds like the answer is assuming that I get to write my own web app.

Looked at Ian Bicking's blog but it's four years old and recommends something available only for apache 1.3, not apache 2.

Sorry not to hyperlink the second site---apparently I need 10 reputation points.

Edit: Shibboleth does what I need, but I should have specified that I'm looking for a really dumb, really simple solution for in-house services that need to handle all of a dozen users, probably not more than three at a time.

share|improve this question
    
blog.ianbicking.org/more-on-single-signon.html is the second site –  Wang Nov 22 '09 at 7:01

3 Answers 3

Look into shibboleth http://shibboleth.internet2.edu/

share|improve this answer
    
+1 Was exactly what I was about to say. –  sybreon Nov 22 '09 at 7:34

Kerberos would do what you want (and more). You would have to run a kerberos service though, but that isn't that hard. Kereros tools are usually already installed on client devices too.

share|improve this answer

I've just tackled this problem myself [Link] . It's pretty easy to set up a Kerberos server, compile the mod_auth_kerb module and configure the Apache webserver.

Note that I've only tried single sign on with Firefox in Linux, as I currently do not have an Acive Directory linked to the Kerberos server. That is my next step, though. :)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.