# Installation

by Joel Aufrecht

## Using Pluggable Authentication Modules (PAM) with OpenACS

OpenACS supports PAM authetication via the ns_pam module in AOLserver.

1. Add PAM support to AOLserver

   OpenACS supports PAM support via the PAM AOLserver module. PAM is system of modular support, and can provide local (unix password), RADIUS, LDAP (more information), and other forms of authentication. Note that due to security issues, the AOLserver PAM module cannot be used for local password authentication.

   1. Compile and install ns_pam

      Download the tarball to `/tmp`.

      Debian users: first do `apt-get install libpam-dev`

          [root@yourserver root]# cd /usr/local/src/aolserver
          [root@yourserver aolserver]# tar xzf /tmp/ns_pam-0.1.tar.gz
          [root@yourserver aolserver]# cd nspam
          [root@yourserver nspam]# make
          gcc -I/usr/include/pam -I/usr/local/aolserver/include -D_REENTRANT=1
            -DNDEBUG=1 -g -fPIC -Wall -Wno-unused -mcpu=i686 -DHAVE_CMMSG=1
            -DUSE_FIONREAD=1 -DHAVE_COND_EINTR=1   -c -o nspam.o nspam.c
          nspam.c: In function `PamCmd':
          nspam.c:107: warning: implicit declaration of function `Tcl_SetObjResult'
          nspam.c:107: warning: implicit declaration of function `Tcl_NewIntObj'
          gcc -I/usr/include/pam -I/usr/local/aolserver/include -D_REENTRANT=1
            -DNDEBUG=1 -g -fPIC -Wall -Wno-unused -mcpu=i686 -DHAVE_CMMSG=1
            -DUSE_FIONREAD=1 -DHAVE_COND_EINTR=1   -c -o pam_support.o pam_support.c
          /bin/rm -f nspam.so
          gcc -shared -nostartfiles -o nspam.so nspam.o pam_support.o -lpam
          [root@yourserver nspam]# make install
          [root@yourserver nspam]#
          cd /usr/local/src/aolserver
          tar xzf /tmp/ns_pam-0.1.tar.gz
          cd nspam
          make
          make install

   2. Set up a PAM domain

      A PAM domain is a set of rules for granting privileges based on other programs. Each instance of AOLserver uses a domain; different aolserver instances can use the same domain but one AOLserver instance cannot use two domains. The domain describes which intermediate programs will be used to check permissions. You may need to install software to perform new types of authentication.

      - RADIUS in PAM

        1. Untar the pam_radius tarball and compile and install. (more information)

               [root@yourserver root]# cd /usr/local/src/
               [root@yourserver src]# tar xf /tmp/pam_radius-1.3.16.tar
               [root@yourserver src]# cd pam_radius-1.3.16
               [root@yourserver pam_radius-1.3.16]# make
               cc -Wall -fPIC -c pam_radius_auth.c -o pam_radius_auth.o
               cc -Wall -fPIC   -c -o md5.o md5.c
               ld -Bshareable pam_radius_auth.o md5.o -lpam -o pam_radius_auth.so
               [root@yourserver pam_radius-1.3.16]# cp pam_radius_auth.so /lib/security/pam_radius_auth.so
               [root@yourserver pam_radius-1.3.16]#
               cd /usr/local/src/
               tar xf /tmp/pam_radius-1.3.16.tar
               cd pam_radius-1.3.16
               make
               cp pam_radius_auth.so /lib/security/pam_radius_auth.so

           Debian users: `apt-get install libpam-radius-auth`

        2. Set up the PAM domain. Recent PAM distributions have a different file for each domain, all in `/etc/pam.d`. Previous PAM setups put all domain configuration lines into a single file, `/etc/pam.conf`. On Red Hat, create the file `/etc/pam.d/service0` with these contents:

               auth       sufficient   /lib/security/pam_radius_auth.so

        3. Modify the AOLserver configuration file to use this PAM domain. Edit the line

               ns_param   PamDomain             "service0"

           So that the value of the parameter matches the name (just the file name, not the fully pathed name) of the domain file in

               /etc/pam.d/

      - LDAP in PAM

        more information

   3. Modify the AOLserver configuration file to support ns_pam.

      In `/var/lib/aolserver/service0/etc/config.tcl`, enable the nspam module by uncommenting this line:

          ns_param   nspam           ${bindir}/nspam.so

2. Install auth-pam OpenACS service package

   Install `auth-pam` and restart the server.

3. Create an OpenACS authority

   OpenACS supports multiple authentication authorities. The OpenACS server itself is the "Local Authority," used by default.

   1. Browse to the authentication administration page, `http://yourserver/acs-admin/auth/`. Create and name an authority (in the sitewide admin UI)

   2. Set Authentication to PAM.

   3. If the PAM domain defines a `password` command, you can set Password Management to PAM. If not, the PAM module cannot change the user's password and you should leave this option Disabled.

   4. Leave Account Registration disabed.

   5. Configure Batch Synchronization

## Using LDAP/Active Directory with OpenACS

by John Sequeira, Michael Steigman, and Carl Blesius.

ToDo:

Add/verify information on on-demand sync, account registration, and batch synchronization. Add section on ldapsearch.

Overview

You do not want to make users remember yet another password and username. If you can avoid it you do not want to store their passwords either. This document should help you set your system up so your users can seamlessly log in to your OpenACS instance using the password they are accustomed to using for other things at your institution.

Background

The original OpenACS LDAP implementation (which has been depreciated by this package) treated the LDAP server as another data store similar to Oracle or Postgresql. It opened a connection using a priveleged account and read or stored an encrypted password for the user in question. This password was independent of the user's operating system or network account, and had to be synchronized if you wanted the same password for OpenACS.

Save their passwords? Sync passwords? Deal with forgotten password requests? No Thanks. Using ldap bind, you can delegate authentication completely to LDAP. This way you can let the IT department (if you are lucky) worry about password storage/synchronization/etc. The bind operation takes a username and password and returns a true of false depending on whether they match up. This document takes the 'bind' approach so that your users LDAP/AD password (or whatever else you use) can be used to login to OpenACS.

Note on Account Creation

On the authentication driver configure screens, you will also see lots of options for synchronizing users between your directory and OpenACS. This document takes the approach of provisioning users on demand instead of ahead-of-time. This means that when they attempt to login to OpenACS, if they have a valid Windows account, we'll create an account for them in OpenACS and log them in.

1. Installing AOLserver LDAP support (openldap and nsldap)

   Install openldap and nsldap using the document Malte created

   Next, modify your config.tcl file as directed in the nsldap README.

   Here's what the relevant additions should look like:

       # LDAP authentication
       ns_param   nsldap             ${bindir}/nsldap.so

       ...

       ns_section "ns/ldap/pool/ldap"
       ns_param user "cn=Administrator, cn=Users, dc=mydomain, dc=com"
       ns_param password "password"
       ns_param host "directory.mydomain.com"
       ns_param connections 1
       ns_param verbose On

       ns_section "ns/ldap/pools"
       ns_param ldap ldap

       ns_section "ns/server/${server}/ldap"
       ns_param pools *
       ns_param defaultpool ldap

   To verify that this is all working, restart Aolserver and ensure that you see something like this in your error.log:

       [10/Jan/2006:11:11:07][22553.3076437088][-main-] Notice: modload: loading '/usr/local/aolserver/bin/nsldap.so'
       [10/Jan/2006:11:11:08][22553.3076437088][-main-] Debug: nsldap: allowing * -> pool ldap
       [10/Jan/2006:11:11:08][22553.3076437088][-main-] Debug: nsldap: adding pool ldap to the list of allowed pools
       [10/Jan/2006:11:11:08][22553.3076437088][-main-] Debug: nsldap: Registering LDAPCheckPools (600)

2. auth-ldap + driver installation

   Next, visit the software installation page in acs-admin and install the auth-ldap package. Your OpenACS installation now has all the code required to authenticate using nsldap, so now you need to configure your site's authentication to take advantage of it. To add the authentication driver to your OpenACS instance, go to: Main Site, Site-Wide Administration, and then Authentication

   Here's some sample Authentication Driver values:

   Name=Active Directory, Short Name=AD, Enabled=Yes, Authentication=LDAP, Password Management=LDAP

   You may wish to push this new authority to the top of the list so it will become the default for users on the login screen.

   Next, you have to configure the authentication driver parameters by going to: Main Site, Site-Wide Administration, Authentication, Active Directory, and then Configure

   Parameters that match our example will look like:

   UsernameAttribute=sAMAccountNMame, BaseDN= cn=Users,dc=mydomain,dc=com, InfoAttributeMap=first_names=givenName;last_name=sn;email=mail, PasswordHash=N/A

3. Code Tweaks for Bind

   Bind-style authentication is not supported via configuration parameters, so we will have to modify the tcl authentication routine to provide this behavior.

   You'll have to modify the existing ./packages/auth-ldap/tcl/auth-ldap-procs.tcl file to support bind authentication.

   First toggle ldap bind support.

   Change this:

       # LDAP bind based authentication ?
       set ldap_bind_p 0
       if {$ldap_bind_p==1} {
       ...

   to this:

       # LDAP bind based authentication ?
       set ldap_bind_p 1

       if {$ldap_bind_p==1} {
       ...

   Then change the bind to first do a search to resolve to account name provided by the user to a fully qualified domain name (FQDN), which the LDAP server uses as a primary key.

   Change this:

       set lh [ns_ldap gethandle]

       if {[ns_ldap bind $lh "cn=$cn" "$password"]} {
           set result(auth_status) ok
       }

   to this

       set lh [ns_ldap gethandle]

       set fdn [lindex [lindex [ns_ldap search $lh -scope subtree $params(BaseDN) "($params(UsernameAttribute)=$username)" dn] 0] 1]

       if {[ns_ldap bind $lh $fdn $password]} {
           set result(auth_status) ok
       }

Troubleshooting

If you're having trouble figuring out some the values for the ldapm, see this useful page on setting up Active Directory integration with Bugzilla. It explains how distinguished names are defined in Active Directory, and how to test that you have the correct values for connectivity and base DN using the OpenLDAP command-line utility ldapsearch.

John had an issue where nsldap was not loading because AOLServer couldn't find the openldap client libraries, but he was able to fix it by adding the openldap libraries to his LD_LIBRARY_PATH (e.g. /usr/local/openldap/lib)

Credits

Thanks to Malte Sussdorf for his help and the Laboratory of Computer Science at Massachusetts General Hospital for underwriting this work.

## Configure Batch Synchronization

1. Browse to the authentication administration page, `http://yourserver/acs-admin/auth/` and choose an authority for batch sync.

2. Set Batch sync enabled to Yes. Set GetDocument Implementation to HTTP GET. Set ProcessDocument Implementation to IMS Enterprise 1.1. These settings will cause OpenACS to attempt to retrieve via HTTP a list of users in XML format from a location we will specify in a few steps.

3. Click OK.

4. On the next page, click `Configure` on the GetDocument Implementation line.

5. Enter either or both the IncrementalURL and SnapshotURL. These are the URLs which the external Authority will supply with XML files in IMS Enterprise 1.1 format.

6. Configure your Authority (RADIUS server, etc) to supply XML files to the URLs IncrementalURL and SnapshotURL. A typical set of incremental file record looks like:

       example missing

   A snapshot file is similar but doesn't have recstatus, since it's not a delta but a list of valid records. See the larger example in the design document for more details.

   (More information: , The IMS 1.1 spec)

($Id: install.xml,v 1.5 2006/06/04 00:45:21 donb Exp $)