Intro

For me, who loves CAS authentication moderately, I am sad that the ** mod_auth_cas ** provided in the EPEL repository in CentOS 6 and CentOS 7 has disappeared in the CentOS 8 (and RHEL 8) environment.

At the moment, it seems impossible to pick up rpm and install it, so I can not help it, so I will build it myself.

How to do

Based on the explanation on the following site, it is changed according to the environment when # yum install mod_auth_cas is done on CentOS 7. https://iam.uconn.edu/mod_auth_cas-installation-and-configuration/

Preparation

# yum install httpd httpd-devel
# yum install gcc libcurl-devel openssl-devel pcre-devel
# yum install autoconf automake make libtool redhat-rpm-config
# yum install wget tar

Build

# cd /usr/local/src
# wget https://github.com/apereo/mod_auth_cas/archive/v1.2.tar.gz
# tar xvzf v1.2.tar.gz
# cd mod_auth_cas-1.2
# autoreconf -iv
# ./configure --with-apxs=/usr/bin/apxs
# make
# make check
# make install

Settings for httpd

# mkdir /var/cache/httpd/mod_auth_cas
# chown apache:apache /var/cache/httpd/mod_auth_cas

# vi /etc/httpd/conf.d/auth_cas.conf
LoadModule auth_cas_module modules/mod_auth_cas.so
CASCookiePath /var/cache/httpd/mod_auth_cas/
CASCertificatePath /etc/pki/tls/certs/ca-bundle.crt
CASLoginURL https://sso.yourdomain/cas/login
CASValidateURL https://sso.yourdomain/cas/serviceValidate

# systemctl restart httpd

.htaccess installation

# vi /var/www/html/.htaccess
AuthType CAS
Require valid-user

Support for SELinux

If SELinux is enabled, a 401 error will occur after CAS authentication, so when using SELinux with Enforcing, check the error screen once and then execute the following.

# yum install policycoreutils-python-utils
# grep "httpd" /var/log/audit/audit.log | audit2allow --module=mod_auth_cas -all

module mod_auth_cas 1.0;

require {
        type http_port_t;
        type httpd_t;
        class tcp_socket name_connect;
}

#============= httpd_t ==============

#!!!! This avc can be allowed using one of the these booleans:
#     httpd_can_network_connect, httpd_graceful_shutdown, httpd_can_network_relay, nis_enabled
allow httpd_t http_port_t:tcp_socket name_connect;


# grep "httpd" /var/log/audit/audit.log | audit2allow --module=mod_auth_cas -all
# semodule -i mod_auth_cas.pp

Use mod_auth_cas on CentOS 8