ILIAS SINGLE-SIGN-ON WITH APACHE AND KERBEROS
OVERVIEW INTRODUCTION SITUATION GOALS TECHNICAL BACKGROUND CONFIGURATIONS CAVEATS RESULT OPTIONS 14.10.14 14.10.14 2 2 2
INTRODUCTION 1 14.10.14 14.10.14 3 3 3
INTRODUCTION SRH Berufliche Rehabilitation GmbH Reintegration of disabled People Trainings for Business-Administraton, Technology, IL Enable Participants for Jobs 2-Years Trainings and shorter Trainings About 550 Participants ILIAS in use since 2008, starting with 3.10, to current 4.4 14.10.14 14.10.14 4 4 4
INTRODUCTION SRH Berufliche Rehabilitation GmbH Campus Heidelberg Several Locations > From Kassel > To Friedrichshafen 14.10.14 14.10.14 5 5 5
INTORDUCTION Ingo Jackisch My Experiences > Trainer for networks and operating systems since 1993 > Communication to our external it provider > Coordination of internal support > Coordination of trainers > ILIAS administration 14.10.14 14.10.14 6 6 6
SITUATION 2 14.10.14 14.10.14 7 7 7
SITUATION User Accounts Accounts exist in Active Directory Managed by external support Multiple forests (realms) Linked to ILIAS by LDAP and Radius, automatical generation No different credentials für workstation and ILIAS login Partially role assignment for ILIAS by LDAP group membership 14.10.14 14.10.14 8 8 8
GOALS 3 14.10.14 14.10.14 9 9 9
GOALS Single-Sign-on for internal access Pass workstation login to ILIAS with no user interaction Standard ILIAS login for external access Least possible impact for the user interface Minimize administrative effort Keep all features (Live-Demo) 14.10.14 14.10.14 10 10 10
GOALS Single-Sign-on for internal access Kerberos External Browser Internal Browser Login/ Tickets Pass credentials ILIAS/ Apache 14.10.14 14.10.14 11 11 11
TECHNICAL BACKGROUND 4 14.10.14 14.10.14 12 12 12
TECHNICAL BACKGROUND ILIAS-login without Apache Standard ILIAS login: > Login page > ILIAS searches account and authentication data in database > (if needed) Query external sources (Radius,LDAP) > (if needed) Query role memberships externally 14.10.14 14.10.14 13 13 13
TECHNISCHE HINTERGRÜNDE ILIAS-login using Apache On entry of ILIAS site (or Login) > Try to access ILIASDIR/sso > Authentication by Apache server (.htaccess, siteconfiguration) > Any method Apache supports > Evaluate environment variables > Determine user account and load data > (if needed) gather LDAP data Problems when Apache fails 14.10.14 14.10.14 14 14
TECHNICAL BACKGROUND ILIAS-Login 14.10.14 14.10.14 15 15 15
TECHNICAL BACKGROUND Kerberos (simplified) Communication by encrypted tickets Kerberos knows the encryption keys of all participants > (own, user, workstation, ILIAS/ SPN) No direct communication ILIAS <-> Kerberos, except for initial key exchange Active Directory uses regular key renewals, but these are initiated by the workstation/ service 14.10.14 14.10.14 16 16 16
TECHNICAL BACKGROUND Kerberos (simplified) ILIAS Browser Kerberos > After access (or login) ILIAS requires credentials from the browser > Browser requires serviceticket for ILIAS > Kerberos constructs login information and session key, encrypts with SPN s key > Kerberos encrypts the ticket again with user s key Require logindata Fetch serviceticket Decrypt userdata Create/encrypt ticket for ILIAS Encrypt with user-key 14.10.14 14.10.14 17 17 17
TECHNICAL BACKGROUND Kerberos (simplified) ILIAS Browser Kerberos > Browser receives information from Kerberos > Browser decrypts user-ticket > The embedded serviceticket is passed to Apache > Apache decrypts serviceticket and determines user-account Ticket encrypted with ILIAS key Ticket encrypted with user key Login 14.10.14 14.10.14 18 18 18
CONFIGURATIONS 5 14.10.14 14.10.14 19 19 19
CONFIGURATIONS ILIAS- server /etc/krb5.conf Kerberos basic information Krb5.keytab Key for SPN Apache-site/.htaccess Authentication settings /etc/samba/smb.conf (if using Samba) 14.10.14 14.10.14 20 20 20
CONFIGURATIONS Active Directory (Kerberos) Machineaccount for SPN and keys, DNS 14.10.14 14.10.14 21 21 21
CONFIGURATIONS ILIAS Configure Apache login, possibly patches 14.10.14 14.10.14 22 22 22
CONFIGURATIONS ILIAS Configure Apache login, possibly patches 14.10.14 14.10.14 23 23 23
CONFIGURATIONS Browser Activate Kerberos negotiate > (Chrome: Option for Command line) 14.10.14 14.10.14 24 24 24
STANDARD- ILIAS/ PATCHES 6 14.10.14 14.10.14 25 25 25
STANDARD-ILIAS/ PATCHES Comparison Apache/ Kerberos works for ILIAS without modifications > Apache be default login > LDAP- Daten partially usable > User may see Apache- authentication window 14.10.14 14.10.14 26 26 26
STANDARD-ILIAS/ PATCHES Comparison With modification to the ILIAS source > Apache must not be the default login > LDAP- data and group memberships can be used for user information and role assignment > Standard login behaviour is not modified > No changes to public area > Mantis: http://www.ilias.de/mantis/view.php?id=13356 14.10.14 14.10.14 27 27 27
CAVEATS 7 14.10.14 14.10.14 28 28 28
CAVEATS Take care: Clocks for ILIAS and Kerberos must be syncronized > E.g. cronjob for ntpdate DNS- Queries must have consstent results > Possible porblems with cnames entries in lochal hosts file Active Directory uses key version serial numbers Kerberos realms must be written in UPPERCASE > Documentation http://www.ilias.de/docu/ goto_docu_pg_56871_367.html 14.10.14 14.10.14 29 29 29
RESULT 8 14.10.14 14.10.14 30 30 30
RESULT ILIAS with Kerberos implemented since May 2014 Positive feedback from users No changes in external access Internal access simplified Few administrative tasks after implementation 14.10.14 14.10.14 31 31 31
OPTIONS 9 14.10.14 14.10.14 32 32 32
OPTIONS More options Apache as only means of authentication > Multiple LDAP/RADIUS/ - sources > Combination of Kerberos and LDAP > Mulitple forests with and without trusts possible ILIAS- login still functional 14.10.14 14.10.14 33 33 33
14.10.14 14.10.14 34 34 34 THANK YOU