Background

The Apache HTTP server can be configured to integrate with CalNet SSO. This is a convenient way to secure applications that do not have built-in support for various SSO protocols. The mod_auth_openidc authentication and authorization module is a modern and standards-based module for Apache that implements the OIDC Relying Party functionality.

mod_auth_openidc is recommended over both mod_auth_cas and mod_auth_mellon because it is standards-based and generally easier to configure.

Example Configuration

These are the high-level steps to configuring mod_auth_openidc for Apache. Here is a simple working example.

1. Submit an SSO Service Request with the CalNet team.
2. Once you have the ClientID and ClientSecret, add mod_auth_openidc to your Apache configuration.
3. Use the Berkeley OIDC OP metadata download URL for either test or production:

   # use auth-test for non-prod / QA systems
   OIDCProviderMetadataURL https://auth-test.berkeley.edu/cas/oidc/.well-known/openid-configuration
   
   # use auth.berkeley.edu for production systems
   OIDCProviderMetadataURL https://auth.berkeley.edu/cas/oidc/.well-known/openid-configuration
   

4. Add your application's redirect URI that was registered with CalNet:

   # Note that /redirect_uri is managed by the module and not created by you.
   OIDCRedirectURI https://${YOUR_SERVER_FQDN}/redirect_uri
   

5. Add the secrets provided by the CalNet team:

   OIDCClientID ${YOUR_OIDC_CLIENT_ID}
   OIDCClientSecret ${YOUR_OIDC_CLIENT_SECRET}
   
   # A unique and strong passphrase generated by you to secure internal session cookies
   OIDCCryptoPassphrase ${A_VERY_STRONG_AND_RANDOM_PASSPHRASE_HERE}
   

6. Add the OIDC scope based on the attributes you need. Note that openid is required. Also add the requirement for the PKCE layer of security:

   OIDCScope "openid profile"
   OIDCPKCEMethod S256
   

7. You must minimally add protection for the secure callback URL specified in the OIDCRedirectURI parameter above:

   <Location "/redirect_uri">
       AuthType openid-connect
       Require valid-user
   </Location>
   

Protecting Your Application

The following examples will make it so that your application redirects users for authentication.

Protect the entire site

<Location />
    AuthType openid-connect
    Require valid-user
</Location>

Protect a specific location and require group membership

<Location "/example">
    AuthType openid-connect
    Require claim "group~cn=edu:berkeley:official:employees:staff:professional.*$"
</Location>