Improving radicale kerberos auth

bgstack15 — Mon, 13 Mar 2023 13:12:45 GMT

My current setup for Radicale and Infcloud for my web interface to my calendars depends on ldap authentication at the reverse-proxy level.

I hacked the frontend in my branch of infcloud to use the browser localStorage javascript/devtools feature so I don't have to enter my username and password every time. Yes, it's insecure, and yes, I don't care.

Using my web calendar works very well. However, when I go to download an event (usually to email it to someone to invite them), I get prompted with the browser basic auth prompt. So I got tired of having to do that, at least the first time in every session, and I wanted to find a better way. I use kerberos (gssapi) authentication in other places on my web server, and I wanted to bring that here.

So I spent a bunch of time experimenting, and I learned that I didn't need to change the infcloud or radicale apps at all! Configuration of the apache httpd reverse proxy, and also my radicale rights file was all I needed.

Changes to apache httpd config

I only needed to change one line in my main config file: which auth.cnf file to include:

RewriteEngine On
RewriteRule ^/radicale$ /radicale/ [R,L]
<Location "/radicale/">
   ProxyPreserveHost On
   Include conf.d/auth-gssapi.cnf
   Require valid-user
   AuthName "GSSAPI protected"
   ProxyPass        http://localhost:5232/ retry=20 connectiontimeout=300 timeout=300
   ProxyPassReverse http://localhost:5232/
   RequestHeader    set X-Script-Name /radicale
</Location>

Changes to auth-gssapi.cnf

I added entries to auth-gssapi.cnf, which was mostly complete.

AuthType GSSAPI
GssapiUseSessions On
Session On
SessionCookieName s1_session path=/;
GssapiCredStore keytab:/etc/httpd/keytab
GssapiCredStore ccache:/etc/httpd/krb5.cache
SessionHeader S1SESSION
GssapiSessionKey file:/etc/httpd/gssapisession.key
GssapiImpersonate On
GssapiDelegCcacheDir /run/httpd/ccache
GssapiDelegCcachePerms mode:0660 gid:apache
GssapiUseS4U2Proxy On
GssapiAllowedMech krb5
GssapiBasicAuth On
GssapiBasicAuthMech krb5
GssapiLocalName On
GssapiNameAttributes json
AuthBasicProvider ldap
AuthLDAPGroupAttribute member
AuthLDAPSubGroupClass group
AuthLDAPGroupAttributeIsDN On
AuthLDAPURL "ldaps://dns1.ipa.internal.com:636 dns2.ipa.internal.com:636/cn=users,cn=accounts,dc=ipa,dc=internal,dc=com?uid,memberof,gecos?sub?(objectClass=person)"
#GSS_NAME returns username@IPA.EXAMPLE.COM which merely needs additional rules in /etc/radicale/rights
RequestHeader set X_REMOTE_USER "%{GSS_NAME}e"
# Does not work
#RequestHeader set X_GROUPS "%{AUTHENTICATE_memberOf}e"
# mostly useless values
#RequestHeader set X_REMOTE_GSS "%{GSS_NAME_ATTRS_JSON}e"

Changes to radicale rights file

My radicale setup uses /etc/radicale/rights to define the ACLS. The examples in the file are very useful. I merely needed to repeat entries and add the domain name.

# default, which was already here
[principal]
user: .+
collection: {user}
permissions: RW
# new entry
[principal-domain]
user: (.+)@IPA.INTERNAL.COM
collection: {0}
permissions: RW

# default
[calendars]
user: .+
collection: {user}/[^/]+
permissions: rw
# new entry
[calendars-domain]
user: (.+)@IPA.INTERNAL.COM
collection: {0}/[^/]+
permissions: rw

# Specific calendars
[user8-read-bgstack15-1]
user: user8
collection: bgstack15
permissions: R
[user8-read-bgstack15-2]
user: user8
collection: bgstack15/c86bcd9f-7526-8083-ca5c-c68bc664ae03
permissions: rwi
# new entries
[user8-read-bgstack15-1-domain]
user: user8@IPA.INTERNAL.COM
collection: bgstack15
permissionsS: R
[user8-read-bgstack15-2-domain]
user: user8@IPA.INTERNAL.COM
collection: bgstack15/c86bcd9f-7526-8083-ca5c-c68bc664ae03
permissions: rwi

I find it worth duplicating entries, to accomplish my goal of being able to seamlessly download calendar events in my browser.

Kerberos auth for my cgit project

bgstack15 — Tue, 14 Jun 2022 13:13:22 GMT

I finally solidified my Kerberos authentication for my cgit solution. I recently added ldap auth, and now we have the real authentication solution available (at least according to Kerberos people).

My relevant snippets of my apache config file are the following.

SetEnv GIT_PROJECT_ROOT /var/www/git
SetEnv GIT_HTTP_EXPORT_ALL
SetEnv REMOTE_USER=$REDIRECT_REMOTE_USER
SetEnv GITWEB_CONFIG /etc/gitweb.conf
# This file will not work when it is in /usr/sbin.
ScriptAlias /git/ /usr/libexec/git-core/git-http-backend-mersey/
<Directory "/usr/libexec/git-core*">
   Options +ExecCGI +Indexes
   Order allow,deny
   Allow from all
   Require all granted
</Directory>
# a2enmod macro
<Macro Project $repository $rwstring $rostring>
   <LocationMatch "^/git/$repository.*$">
      AuthName "Git Access"
      Include conf.d/auth-gssapi.cnf
      #AuthUserFile /etc/git_access
      Require $rwstring
      Require $rostring
   </LocationMatch>
   <LocationMatch "^/git/$repository/git-receive-pack$">
      AuthName "Git Access"
      Include conf.d/auth-gssapi.cnf
      #AuthUserFile /etc/git_access
      Require $rwstring
   </LocationMatch>
</Macro>
# Protect everything under git directory...
<Directory "/var/www/git">
   Require all denied
</Directory>
# ...Unless given permissions in this file.
Include /etc/git_access.conf
# cgit
# https://ic3man5.wordpress.com/2013/01/26/installing-cgit-on-debian/
# depends on confs-enabled/cgit.conf
<Directory "/usr/share/cgit/">
   SetEnv CGIT_CONFIG /etc/cgitrc
   SetEnv GIT_URL cgit
   AllowOverride all
   Options +ExecCGI +FollowSymLinks +Indexes
   DirectoryIndex cgit.cgi
   AddHandler cgi-script .cgi
   RewriteCond %{REQUEST_FILENAME} !-f
   RewriteCond %{REQUEST_FILENAME} !-d
   RewriteRule (.*) /cgit/cgit.cgi/$1 [END,QSA]
</Directory>

Here is the separate include file, auth-gssapi.conf.

# File: /etc/httpd/conf.d/auth.cnf
# Startdate: 2022-06-13 14:10
# Usage: included by main config file in a few places
# History:
# Reference:
#    auth-ldap.cnf
AuthType GSSAPI
GssapiUseSessions On
Session On
SessionCookieName s1_session path=/;
GssapiCredStore keytab:/etc/httpd/keytab
GssapiCredStore ccache:/etc/httpd/krb5.cache               
SessionHeader S1SESSION
GssapiSessionKey file:/etc/httpd/gssapisession.key
GssapiImpersonate On
GssapiDelegCcacheDir /run/httpd/ccache
GssapiDelegCcachePerms mode:0660 gid:apache
GssapiUseS4U2Proxy On
GssapiAllowedMech krb5
GssapiBasicAuth On
GssapiBasicAuthMech krb5
GssapiLocalName On

Some preparation of the file system is required too, of course.

sudo yum install mod_auth_gssapi mod_session
sudo su -
# the rest as root
kinit -kt /etc/krb5.keytab
# I already have an existing ipa service for HTTP/server1.
ipa-getkeytab -p HTTP/server1.ipa.internal.com -k /etc/httpd.keytab
sudo kinit -k -t /etc/httpd.keytab -c /etc/httpd.cache HTTP/server1.ipa.internal.com
sudo chown apache /etc/httpd.keytab ; sudo chmod 0600 /etc/httpd.keytab
sudo mkdir -p /run/httpd/ccache ; sudo chown apache /run/httpd/ccache
sudo chown apache /etc/httpd.cache

Test apache and if its configuration is OK, reload it!

sudo httpd -t
sudo systemctl reload httpd

And now, on my git client, I can clear the credential cache

git credential-cache exit

Ensure that the effective git config includes:

[http]
emptyAuth = true

Which I can set with:

git config --global http.emptyAuth true

And ensure I have a kerberos ticket.

kinit

And then I can push to my remote.

$ git remote add server1 https://server1.ipa.example.com/git/mbbmlib
$ git push server1
Enumerating objects: 3, done.
Counting objects: 100% (3/3), done.
Compressing objects: 100% (2/2), done.
Writing objects: 100% (2/2), 229 bytes | 229.00 KiB/s, done.
Total 2 (delta 1), reused 0 (delta 0), pack-reused 0
To https://server1.ipa.internal.com/git/mbbmlib
   e0767c5..3a3c4d9  samplebranch -> samplebranch

I don't normally use my internal server name for my git remotes, but it's worth it if it can take advantage of the kerberos tickets I already use for auth to the system anyway!

Update 2023-06-18