Xinet Active Directory Integration Support

Overview

You want to utilize Active Directory authentication within your Xinet environment. You want to verify whether your environment is compatible with the Xinet Active Directory integration.

Solution

Active Development of the Apache AD Modules necessary for the integration is limited. An updated AD module for use with RHEL/CentOS Linux 7 and Apache 2.4.6 has been made available and can be found attached.

The steps below are provided as guidance for System Admins looking to integrate Active Directory with Xinet. The Apache authentication module and the underlying PAM/authselect mechanism described here are confirmed to work on RHEL 9 and current Xinet releases; some legacy references in this guide (32-bit binaries, RHEL 5, Windows Server 2003 procedures) are retained for historical reference only and do not apply to current deployments.

Note: Once this is completed, any local accounts will no longer appear in the WebNative Admin Portal. Only accounts from Active Directory will appear. Also, the “New Users” and “Delete Users” tabs will no longer be accessible under the “Users” tab. This is because all administration of users should be done on Active Directory.

Prerequisites

Xinet Server joined to Active Directory Domain. (Ex. Realmd, Centrify)

The authselect step is a prerequisite, not an optional extra.

The directory module (pam_sss for SSSD, pam_winbind for winbind) is only present in /etc/pam.d/system-auth once an authselect profile has been selected. On a server the AD tooling has already configured, this is already done. On a server that has never been joined to a domain, it has not, and it must be enabled explicitly:

# authselect current
# ("No existing configuration detected." means it is not yet managed)
# authselect select sssd --force
# grep pam_sss.so /etc/pam.d/system-auth /etc/pam.d/password-auth

--force is required the first time, because the existing PAM/NSS files were written by the OS installer and are not yet managed by authselect. Without it the command refuses and makes no change. authselect backs up whatever it replaces. Note that --force also resets optional features such as faillock and mkhomedir — re-list any you use on the same command line.

Configuration

Backup the "Xinet" folder and overwrite it with the contents of "Login":
```
# cp /etc/pam.d/xinet /etc/pam.d/xinet.backup
# cp /etc/pam.d/login /etc/pam.d/xinet
```
Note — this step alone does not enable local Linux accounts.
Creating /etc/pam.d/xinet tells WebNative which PAM configuration to use; it does not change who performs the password check. The Xinet Apache module calls PAM from inside the httpd process, which runs as the unprivileged apache user, and Linux permits a non-root caller to verify only its own account's password against /etc/shadow.

Active Directory authentication works because the check is performed by a privileged daemon (SSSD or winbind) on Apache's behalf, not by Apache itself. Local /etc/shadow accounts have no such broker by default, so they will be rejected — with unix_chkpwd: check pass; user unknown in /var/log/secure — even when the password is correct and this PAM file is in place.

To authenticate local Linux system users instead of (or alongside) a directory service, see Authenticating WebNative against local Linux system users (RHEL 9).
Download and Install Xinet
Download the appropriate legacy Xinet Apache module. (See Additional Resources below)
1. Place the module within /etc/httpd/modules/
2. Verify the permissions match that of the other modules.
Edit /etc/httpd/conf/httpd.conf:
1. Backup before continuing:
```
# cp /etc/httpd/conf/httpd.conf /etc/httpd/conf/httpd.conf.bak
```
2. Add the following line to the LoadModule section:
  1. LoadModule auth_xinet_module "<full path to the module>"
  2. Example: LoadModule auth_xinet_module "/usr/lib64/httpd/modules/mod_auth_xinet2.so"
3. Replace all instances of "AuthUserFile" with "XinetAuthUserFile":
  1. Search for this line:
    1. AuthUserFile /var/adm/webnative/apache.userfile
  2. Replace it with:
    1. XinetAuthUserFile /var/adm/webnative/apache.userfile
  3. Note: There should be 3 instances to replace.
Restart Apache:
```
# /usr/sbin/apachectl restart
```
1. While Apache is loading module auth_xinet2.so, it may complain that it can’t find library ‘libldap.so.2’. Usually, that library is in the /usr/lib directory. If the library is not there, make a symbolic link to the latest libldap version and restart Apache again.
  1. For example, if the latest LDAP library is libldap-2.3.so.0.2.15:
```
# cd /usr/lib
# ln –s libldap-2.3.so.0.2.15 libldap.so.2
```
Create a system.userlist file
1. In order for WebNative to pull the user information from Active Directory, you will need
  to create a blank file named system.userlist by running this command in the terminal:
```
# touch /usr/etc/webnative/system.userlist
```
2. Upon logging into the WebNative Admin portal, your AD users should appear in the Users list.

Note: To enable the use of "Short Names" for login with Samba, add the following line to /etc/samba/smb/conf: "winbind use default domain = true"

Additional Resources

The Legacy Team originally provided these details within Tech Note 218 for Xinet 17 or earlier. You can access these directly by logging into the Xinet Reseller Portal and selecting Tech Notes for additional details.

Legacy Configuration Guides

Please contact your Account Manager directly with any inquiries relating to future development plans.

mod_auth_xinet2.so.zip

19 KB
View
Download

Choose files or drag and drop files

Tags:

Was this article helpful?

Yes

Priyanka Bhotika
Posted
Updated

Comments

Please sign in to comment