Adding SFU's CAS support to Apache on Mac OS X Snow Leopard / Mountain Lion
These directions are directly taken from information by Ray
Davison (SFU ICAT, IT Services) and extensive help from Derek
Warren (IT Services) but any error, confusion or
ambiguity is completely my own. They are also getting out of
date...
You need the Developer tools (Xcode) from Apple installed (with Mountain Lion & Lion you need to go to Xcode preferences and install the command line tools).
Textwrangler will make changes much easier. Any mac will work as a
web server- apache is built in. To turn it on, go to system
preferences/sharing and check the 'Web Sharing' box. Please email
cas-help@sfu.ca so they know
you are using CAS and can inform you of any changes. Please email
with
any corrections or suggestions.
Download a copy of mod_auth_cas which you can get from http://www.sfu.ca/itservices/publishing/enhanced_web_publishing/cas/apache_module.html.
More information about CAS is at SFU's
CAS pages.
When you download that on your Mac, it should untar so you will
end up with a mod_auth_cas_sfu-1.0.8 directory. Open terminal and
type cd [space] and then drag the src folder within the
mod_auth_cas_sfu-1.0.8 folder to the terminal window. Hit return
which will put you in the directory with the src code which can be
compiled with
sudo /usr/sbin/apxs -i -c mod_auth_cas.c
If this does not work, you can check where apxs is by using
which apxs
Create a new directory to save cached logins:
sudo mkdir /etc/apache2/cas
sudo chown -R _www /etc/apache2/cas
In terminal open the folder that the htconf.conf file is in
/private/etc/apache2/ [in Tiger it is in /private/etc/httpd/ ].
open /private/etc/apache2/
Then backup and open htconf.conf in textwrangler.
Download this httpd.conf.txt (from Snow Leopard) and
use textwrangler to do a side by side comparison to the original
[Search/Compare two front Documents] and make modifications to
your Apache config...
Comment out 5 lines LoadModule lines- mod_authz_groupfile.so,
mod_authz_user.so, mod_authz_dbm.so, mod_auth_basic.so,
mod_auth_digest.so. (In Mountain Lion I also commented out mod_authn_default.so)
Give the explicit path for mod_auth_cas.so e.g.
LoadModule auth_cas_module /usr/libexec/apache2/mod_auth_cas.so
and modify the cookie path:
CASCookiePath /usr/local/apache2/cas/
Change
AllowOverride None
to
AllowOverride AuthConfig
(in several places, depending on what you are doing).
Finally, to activate your changes, go to system preferences and
turn off web sharing, then turn it back on.
Go to http://www.sfu.ca/itservices/cas/htaccess.html
and htaccess.html for how to control
access.
Sample contents of .htaccess file (you will have to change the
path of AuthUserFile /pathto/.htpasswd)
AuthType CAS
AuthName "login as SFU user or webapplicant"
AuthUserFile /Library/WebServer/Documents/YourPath/.htpasswd
require valid-sfu-user
require valid-user
contents of .htpasswd file (webapplicant is both username and
password here)
webapplicant:snxXBvTU7Z8lg
Problems? check the console for error messages (Go to
Applications/utilities, or just type console in spotlight. From
Ray-
Some things to keep in mind when testing:
1) CAS sets a cookie when you login so that single signon works.
This means if you want to test logging in with different accounts,
you need to clear the cookie. This can be done by visiting the
logout page at:
https://cas.sfu.ca/cgi-bin/WebObjects/cas.woa/wa/logout
2) The mod_auth_cas module also caches logins so that if you
have a web page with a bunch of images it doesn't repeatedly hit
CAS to authenticate each of the images. This means that once you
have logged in to a protected web page with one account, you
can't test with another account even if you log out of CAS
because the module has cached your login. To return things back
to a clean state you need to stop Apache and empty the cache
directory (/etc/apache2/cas in your case). Then restart Apache.
When I went to the server website (e.g. fmp.biol.sfu.ca/ta_applications/)
I was redirected to the server name
https://cas.sfu.ca/cgi-bin/WebObjects/cas.woa/wa/login?service=http%3a%2f%2fBiology-Filemaker-Sciencess-Mac-mini.local%2fta_applications...
Console told me...
httpd: Could not reliably determine the server's fully qualified
domain name, using... for ServerName
so I just went into system preferences, stopped and restarted the
webserver (duh...). (This can also done in Terminal, and must be done in Terminal in Lion & Mountain Lion. The command for restarting (stopping/restarting) the webserver is: sudo apachectl graceful
It is not worth spending any more time on these instructions.
Tell me of any errors so I can correct them. Feel free to ask me
for help. Ray Davison is the person to ask about CAS.
|