Installing CUWebAuth

This page describes the installation process for Apache on Unix/Linux. 

Hardware/OS Requirements  

CUWebAuth runs on a variety of UNIX/Linux distributions and hardware...

• Solaris 8 & 9 (Sparc)
• RedHat Linux (Intel)
• AIX 4.x
• MacOS X (PPC)

Although not explicitly supported, CUWebAuth runs under several distributions of Linux (there are no explicit RedHat dependencies).

There is no particular hardware requirement for CUWebAuth.   If your hardware configuration can comfortably run Apache, adding CUWebAuth should be fine as well.

CUWebAuth version 1.4 supports Apache 2.2.x, 2.0.x, and 1.3.x.  There are separate CUWebAuth binaries for each version of Apache.

Download

To install CUWebAuth, you must first download and the appropriate package from http://identity.cit.cornell.edu/authn/cwa_dl.html  

Installation

The installation package file name will be one of the following, depending on your operating system:  

• cuwebauth-1.4-solaris-apache.tar.gz
• cuwebauth-1.4-linux-apache.tar.gz
• cuwebauth-1.4-aix-apache.tar.gz
• cuwebauth-1.4-osx-apache.tar.gz

Once you’ve found the proper archive, download it and unpack it into any directory.    The archive will contain the following files:

• mod_cuwebauth_2.2.so
• mod_cuwebauth_2.0.so
• mod_cuwebauth_1.3_eapi.so
• mod_cuwebauth_1.3_std.so
• krb.conf
• krb.realms
• README.<OSName>

Of these files, the README file will be the most important for making sure that CUWebAuth is installed correctly.    It contains information on where you should (likely) place the files specific for your operating system.  

For Apache 1.3, you must decide if you need the EAPI version or not.   Certain modules, including mod_ssl, cause Apache to be built with the extended API option (-dEAPI switch).   If you attempt to load a module that was not compiled with that option into an Apache environment that was built with the extended API option, you will get a warning telling you that Apache might crash because of this.  Because of this, the archive you choose will contain two versions of the CUWebAuth module:

• The extended API version - mod_cuwebauth_1.3_eapi.so
• The standard version -  mod_cuwebauth_1.3_std.so
  

Select the appropriate CUWebAuth module and copy it to the Apache modules directory and rename it mod_cuwebauth.so.  For Apache 1.3 the directory is called libexec , thereafter it is called modules .

Configuring Apache To Use CUWebAuth
Configuring Apache to be able to use CUWebAuth involves adding a line in your httpd.conf file to load the dynamic module.   Assuming you have stored mod_cuwebauth.so in the libexec directory of the Apache tree, you will need to have the following line in your httpd.conf file:

            LoadModule cuwebauth_module    modules/mod_cuwebauth.so

Apache 1.3 :

            LoadModule cuwebauth_module    libexec/mod_cuwebauth.so

This tells Apache about the CUWebAuth module and will make sure it is available when parsing the rest of the directives which CUWebAuth uses.    Anytime you modify the configuration of Apache you should restart it in order for the changes to take effect.

More configuration steps follow in the next section.

Configuring Kerberos
If your machine is not already configured to use Cornell's Kerberos realm then you need to place the two files krb.conf and krb.realms in /etc and make them readable by all, writeable by root only.