Difference between revisions of "Authentication"
imported>Mutantmonkey (remove krb5.conf stuff because it's unnecessary) |
|||
| (13 intermediate revisions by 5 users not shown) | |||
| Line 1: | Line 1: | ||
| − | VTLUUG | + | = VTLUUG = |
| − | + | VTLUUG uses [[Infrastructure:Chimera|chimera]] as it's FreeIPA server, and all VTLUUG hosts except [[Infrastructure:Joey|joey]], the router, are in its domain. | |
| − | == | + | == Account maintenance instructions == |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | + | All users can log into [https://chimera.vtluug.org Chimera's FreeIPA web GUI] to edit their account. Yes, it does have a self signed cert. Get over it /s | |
| + | |||
| + | For management of the entire domain, officers are able to add, remove, or modify users in any way. | ||
| + | |||
| + | == History == | ||
| + | |||
| + | VTLUUG has been was Kerberos and LDAP for authentication until the [[CVL eviction]]. We then migrated to an LDAP only domain due to a lack of IPv6 on behind router.ece.vt.edu. The old Kerberos server was configured to work on IPv6 only, therefore, we were required to migrate away from its use for authentication. | ||
| + | |||
| + | With the old deployment, [[Infrastructure:Acidburn|acidburn]] should be acceptable through normal password authentication over ssh. There is no need to configure tickets or anything else Kerberos related. | ||
| + | |||
| + | |||
| + | = CAS = | ||
| + | |||
| + | The '''Virginia Tech Central Authentication System''' or '''CAS''' is the Virginia Tech deployment of the [[Free software|open source]] [[w:Shibboleth (Internet2)|Shibboleth]] authentication system. Shibboleth can be thought of as an identity provider similar to [[w:OpenID|OpenID]], but more centralized, and thus well-liked by institutions such as universities. | ||
| + | |||
| + | == Scripted Login == | ||
| + | The following is a work in progress. Eventually, the following commands should yield a login. | ||
| + | <pre> | ||
| + | $ curl -s -c cookies https://auth.vt.edu/login?service=https://my.vt.edu/Login | sed -nrf sedconf | xargs curl | ||
| + | </pre> | ||
| + | |||
| + | The <code>sedconf</code> file's contents are below. | ||
| + | <pre> | ||
| + | /name="lt"/s/.*value="([^"]*).*/-d "lt=\1"/p | ||
| + | /name="_eventId"/s/.*value="([^"]*).*/-d "eventId=\1"/p | ||
| + | /name="submit"/s/.*value="(^")*".*/-d "submit=\1"/p | ||
| + | /action="/s/.*action="([^;]*)[^?]*(\??[^"]*).*/--url "https:\/\/auth.vt.edu\1\2"/p | ||
| + | $a -d "username=bob" | ||
| + | $a -d "password=bubba" | ||
| + | $a -c cookies | ||
| + | </pre> | ||
| + | |||
| + | Refer to the [[sed]] and [[curl]] manual pages for details on the various commands that drive this script. | ||
| + | |||
| + | =External Links= | ||
| + | * [https://auth.vt.edu VT CAS] | ||
| + | * [http://www.computing.vt.edu/infrastructure_services/cas/index.html Description of CAS] | ||
| + | |||
| + | [[Category:Infrastructure]] | ||
| + | [[Category:Scripts]] | ||
| + | [[Category:Campus computing resources]] | ||
Latest revision as of 08:26, 3 January 2019
Contents
VTLUUG
VTLUUG uses chimera as it's FreeIPA server, and all VTLUUG hosts except joey, the router, are in its domain.
Account maintenance instructions
All users can log into Chimera's FreeIPA web GUI to edit their account. Yes, it does have a self signed cert. Get over it /s
For management of the entire domain, officers are able to add, remove, or modify users in any way.
History
VTLUUG has been was Kerberos and LDAP for authentication until the CVL eviction. We then migrated to an LDAP only domain due to a lack of IPv6 on behind router.ece.vt.edu. The old Kerberos server was configured to work on IPv6 only, therefore, we were required to migrate away from its use for authentication.
With the old deployment, acidburn should be acceptable through normal password authentication over ssh. There is no need to configure tickets or anything else Kerberos related.
CAS
The Virginia Tech Central Authentication System or CAS is the Virginia Tech deployment of the open source Shibboleth authentication system. Shibboleth can be thought of as an identity provider similar to OpenID, but more centralized, and thus well-liked by institutions such as universities.
Scripted Login
The following is a work in progress. Eventually, the following commands should yield a login.
$ curl -s -c cookies https://auth.vt.edu/login?service=https://my.vt.edu/Login | sed -nrf sedconf | xargs curl
The sedconf file's contents are below.
/name="lt"/s/.*value="([^"]*).*/-d "lt=\1"/p /name="_eventId"/s/.*value="([^"]*).*/-d "eventId=\1"/p /name="submit"/s/.*value="(^")*".*/-d "submit=\1"/p /action="/s/.*action="([^;]*)[^?]*(\??[^"]*).*/--url "https:\/\/auth.vt.edu\1\2"/p $a -d "username=bob" $a -d "password=bubba" $a -c cookies
Refer to the sed and curl manual pages for details on the various commands that drive this script.
