by Joel Aufrecht OpenACS supports PAM authetication via the ns_pam module in AOLserver. OpenACS supports PAM support via the PAM AOLserver module. PAM is system of modular support, and can provide local (unix password), RADIUS, LDAP (more information), and other forms of authentication. Note that due to security issues, the AOLserver PAM module cannot be used for local password authentication. Download the tarball to /tmp. Debian users: first do apt-get install libpam-dev [root@yourserver root]# cd /usr/local/src/aolserver [root@yourserver aolserver]# tar xzf /tmp/ns_pam-0.1.tar.gz [root@yourserver aolserver]# cd nspam [root@yourserver nspam]# make gcc -I/usr/include/pam -I/usr/local/aolserver/include -D_REENTRANT=1 -DNDEBUG=1 -g -fPIC -Wall -Wno-unused -mcpu=i686 -DHAVE_CMMSG=1 -DUSE_FIONREAD=1 -DHAVE_COND_EINTR=1 -c -o nspam.o nspam.c nspam.c: In function `PamCmd': nspam.c:107: warning: implicit declaration of function `Tcl_SetObjResult' nspam.c:107: warning: implicit declaration of function `Tcl_NewIntObj' gcc -I/usr/include/pam -I/usr/local/aolserver/include -D_REENTRANT=1 -DNDEBUG=1 -g -fPIC -Wall -Wno-unused -mcpu=i686 -DHAVE_CMMSG=1 -DUSE_FIONREAD=1 -DHAVE_COND_EINTR=1 -c -o pam_support.o pam_support.c /bin/rm -f nspam.so gcc -shared -nostartfiles -o nspam.so nspam.o pam_support.o -lpam [root@yourserver nspam]# make install [root@yourserver nspam]# cd /usr/local/src/aolserver tar xzf /tmp/ns_pam-0.1.tar.gz cd nspam make make install A PAM domain is a set of rules for granting privileges based on other programs. Each instance of AOLserver uses a domain; different aolserver instances can use the same domain but one AOLserver instance cannot use two domains. The domain describes which intermediate programs will be used to check permissions. You may need to install software to perform new types of authentication. Untar the pam_radius tarball and compile and install. (more information) [root@yourserver root]# cd /usr/local/src/ [root@yourserver src]# tar xf /tmp/pam_radius-1.3.16.tar [root@yourserver src]# cd pam_radius-1.3.16 [root@yourserver pam_radius-1.3.16]# make cc -Wall -fPIC -c pam_radius_auth.c -o pam_radius_auth.o cc -Wall -fPIC -c -o md5.o md5.c ld -Bshareable pam_radius_auth.o md5.o -lpam -o pam_radius_auth.so [root@yourserver pam_radius-1.3.16]# cp pam_radius_auth.so /lib/security/pam_radius_auth.so [root@yourserver pam_radius-1.3.16]# cd /usr/local/src/ tar xf /tmp/pam_radius-1.3.16.tar cd pam_radius-1.3.16 make cp pam_radius_auth.so /lib/security/pam_radius_auth.so Debian users: apt-get install libpam-radius-auth Set up the PAM domain. Recent PAM distributions have a different file for each domain, all in /etc/pam.d. Previous PAM setups put all domain configuration lines into a single file, /etc/pam.conf. On Red Hat, create the file /etc/pam.d/service0 with these contents: auth sufficient /lib/security/pam_radius_auth.so Modify the AOLserver configuration file to use this PAM domain. Edit the line ns_param PamDomain "service0" So that the value of the parameter matches the name (just the file name, not the fully pathed name) of the domain file in /etc/pam.d/ more information In /var/lib/aolserver/service0/etc/config.tcl, enable the nspam module by uncommenting this line: ns_param nspam ${bindir}/nspam.so Install auth-pam and restart the server. OpenACS supports multiple authentication authorities. The OpenACS server itself is the "Local Authority," used by default. Browse to the authentication administration page, http://yourserver/acs-admin/auth/. Create and name an authority (in the sitewide admin UI) Set Authentication to PAM. If the PAM domain defines a password command, you can set Password Management to PAM. If not, the PAM module cannot change the user's password and you should leave this option Disabled. Leave Account Registration disabed. Configure Batch Synchronization by John Sequeira, Michael Steigman, and Carl Blesius. Add/verify information on on-demand sync, account registration, and batch synchronization. Add section on ldapsearch. You do not want to make users remember yet another password and username. If you can avoid it you do not want to store their passwords either. This document should help you set your system up so your users can seamlessly log in to your OpenACS instance using the password they are accustomed to using for other things at your institution. The original OpenACS LDAP implementation (which has been depreciated by this package) treated the LDAP server as another data store similar to Oracle or Postgresql. It opened a connection using a priveleged account and read or stored an encrypted password for the user in question. This password was independent of the user's operating system or network account, and had to be synchronized if you wanted the same password for OpenACS. Save their passwords? Sync passwords? Deal with forgotten password requests? No Thanks. Using ldap bind, you can delegate authentication completely to LDAP. This way you can let the IT department (if you are lucky) worry about password storage/synchronization/etc. The bind operation takes a username and password and returns a true of false depending on whether they match up. This document takes the 'bind' approach so that your users LDAP/AD password (or whatever else you use) can be used to login to OpenACS. On the authentication driver configure screens, you will also see lots of options for synchronizing users between your directory and OpenACS. This document takes the approach of provisioning users on demand instead of ahead-of-time. This means that when they attempt to login to OpenACS, if they have a valid Windows account, we'll create an account for them in OpenACS and log them in. Install openldap and nsldap using the document Malte created Next, modify your config.tcl file as directed in the nsldap README. Here's what the relevant additions should look like: # LDAP authentication ns_param nsldap ${bindir}/nsldap.so ... ns_section "ns/ldap/pool/ldap" ns_param user "cn=Administrator, cn=Users, dc=mydomain, dc=com" ns_param password "password" ns_param host "directory.mydomain.com" ns_param connections 1 ns_param verbose On ns_section "ns/ldap/pools" ns_param ldap ldap ns_section "ns/server/${server}/ldap" ns_param pools * ns_param defaultpool ldap To verify that this is all working, restart Aolserver and ensure that you see something like this in your error.log: [10/Jan/2006:11:11:07][22553.3076437088][-main-] Notice: modload: loading '/usr/local/aolserver/bin/nsldap.so' [10/Jan/2006:11:11:08][22553.3076437088][-main-] Debug: nsldap: allowing * -> pool ldap [10/Jan/2006:11:11:08][22553.3076437088][-main-] Debug: nsldap: adding pool ldap to the list of allowed pools [10/Jan/2006:11:11:08][22553.3076437088][-main-] Debug: nsldap: Registering LDAPCheckPools (600) Next, visit the software installation page in acs-admin and install the auth-ldap package. Your OpenACS installation now has all the code required to authenticate using nsldap, so now you need to configure your site's authentication to take advantage of it. To add the authentication driver to your OpenACS instance, go to: Main Site, Site-Wide Administration, and then Authentication Here's some sample Authentication Driver values: Name=Active Directory, Short Name=AD, Enabled=Yes, Authentication=LDAP, Password Management=LDAP You may wish to push this new authority to the top of the list so it will become the default for users on the login screen. Next, you have to configure the authentication driver parameters by going to: Main Site, Site-Wide Administration, Authentication, Active Directory, and then Configure Parameters that match our example will look like: UsernameAttribute=sAMAccountNMame, BaseDN= cn=Users,dc=mydomain,dc=com, InfoAttributeMap=first_names=givenName;last_name=sn;email=mail, PasswordHash=N/A Bind-style authentication is not supported via configuration parameters, so we will have to modify the tcl authentication routine to provide this behavior. You'll have to modify the existing ./packages/auth-ldap/tcl/auth-ldap-procs.tcl file to support bind authentication. First toggle ldap bind support. Change this: # LDAP bind based authentication ? set ldap_bind_p 0 if {$ldap_bind_p==1} { ... to this: # LDAP bind based authentication ? set ldap_bind_p 1 if {$ldap_bind_p==1} { ... Then change the bind to first do a search to resolve to account name provided by the user to a fully qualified domain name (FQDN), which the LDAP server uses as a primary key. Change this: set lh [ns_ldap gethandle] if {[ns_ldap bind $lh "cn=$cn" "$password"]} { set result(auth_status) ok } to this set lh [ns_ldap gethandle] set fdn [lindex [lindex [ns_ldap search $lh -scope subtree $params(BaseDN) "($params(UsernameAttribute)=$username)" dn] 0] 1] if {[ns_ldap bind $lh $fdn $password]} { set result(auth_status) ok } If you're having trouble figuring out some the values for the ldapm, see this useful page on setting up Active Directory integration with Bugzilla. It explains how distinguished names are defined in Active Directory, and how to test that you have the correct values for connectivity and base DN using the OpenLDAP command-line utility ldapsearch. John had an issue where nsldap was not loading because AOLServer couldn't find the openldap client libraries, but he was able to fix it by adding the openldap libraries to his LD_LIBRARY_PATH (e.g. /usr/local/openldap/lib) Thanks to Malte Sussdorf for his help and the Laboratory of Computer Science at Massachusetts General Hospital for underwriting this work. Browse to the authentication administration page, http://yourserver/acs-admin/auth/ and choose an authority for batch sync. Set Batch sync enabled to Yes. Set GetDocument Implementation to HTTP GET. Set ProcessDocument Implementation to IMS Enterprise 1.1. These settings will cause OpenACS to attempt to retrieve via HTTP a list of users in XML format from a location we will specify in a few steps. Click OK. On the next page, click Configure on the GetDocument Implementation line. Enter either or both the IncrementalURL and SnapshotURL. These are the URLs which the external Authority will supply with XML files in IMS Enterprise 1.1 format. Configure your Authority (RADIUS server, etc) to supply XML files to the URLs IncrementalURL and SnapshotURL. A typical set of incremental file record looks like: example missing A snapshot file is similar but doesn't have recstatus, since it's not a delta but a list of valid records. See the larger example in the design document for more details. (More information: , The IMS 1.1 spec) ($Id: install.xml,v 1.5 2006/06/04 00:45:21 donb Exp $)