Hello Alexander,
Thanks for help.
I found that I have to name pam.d service with same name as HBAC
service in IPA and it works.
My mistake when reading documentation.
With kind regards,
Jan Gardian
On 08/28/2018 05:44 PM, Alexander
Bokovoy wrote:
On
ti, 28 elo 2018, Jan Gardian via FreeIPA-users wrote:
Hello,
Could you please be so kind provide me advice how to setup HBAC
rule to allow user authentication/authorization to web service
but not to server where this web run.
Our ipa runs at Centos 7.5.1804, version of IPA 4.5.4,
API_VERSION: 2.228.
Web service runs at Ubuntu 16.06.5 LTS on Apache2.
In Apache configuration is setup kerberos authentication and
authorization is directed to pam_sss.so SSSD module which we use
for server login.
<Location />
AuthType Kerberos
AuthName "Kerberos Login"
KrbMethodNegotiate On
KrbAuthoritative On
KrbMethodK5Passwd Off
KrbServiceName
HTTP/web_server.domain.com
KrbAuthRealms DOMAIN.COM
Krb5KeyTab
/etc/apache2/http-web_server.keytab
KrbVerifyKDC Off
KrbSaveCredentials On
KrbLocalUserMapping On
Require pam-account
crm-production
</Location>
/etc/pam.d/crm-production:
auth required pam_sss.so # pam_sss.so for
SSSD
account required pam_sss.so # or other PAM
module
-----------------------------------------------------------------------
HBAC rule with bellow setting works but it allow any service.
Specified User and Groups
* testuser
Specified Hosts and Groups
* web_server.domain.com
Any Service
How can I tell in HBAC rule to allow only
HTTP/web_server.domain.com?
Did you disable allow_all HBAC rule? That rule allows access to
any
service on any machine by default. You'd need to create specific
rules
for specific users/groups/hosts/services when allow_all rule is
disabled.