Skip to content

Commit bbe6d29

Browse files
pcfenspcfens
committed
Add support for mod_auth_cas module configuration
1 parent fbfc2de commit bbe6d29

5 files changed

Lines changed: 155 additions & 2 deletions

File tree

‎README.md‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -520,6 +520,7 @@ There are many `apache::mod::[name]` classes within this module that can be decl
520520
* `actions`
521521
* `alias`
522522
* `auth_basic`
523+
* `auth_cas`* (see [`apache::mod::auth_cas`](#class-apachemodauthcas) below)
523524
* `auth_kerb`
524525
* `authnz_ldap`*
525526
* `autoindex`
@@ -578,7 +579,7 @@ Modules noted with a * indicate that the module has settings and, thus, a templa
578579

579580
The modules mentioned above, and other Apache modules that have templates, cause template files to be dropped along with the mod install. The module will not work without the template. Any module without a template installs the package but drops no files.
580581

581-
####Class: `apache::mod::event
582+
####Class: `apache::mod::event`
582583

583584
Installs and manages mpm_event module.
584585

@@ -592,6 +593,11 @@ To configure the event thread limit:
592593
}
593594
```
594595

596+
####Class: `apache::mod::auth_cas`
597+
598+
Installs and manages mod_auth_cas. The parameters `cas_login_url` and `cas_validate_url` are required.
599+
600+
Full documentation on mod_auth_cas is available from [JASIG](https://github.com/Jasig/mod_auth_cas).
595601

596602
####Class: `apache::mod::info`
597603

‎manifests/mod/auth_cas.pp‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
class apache::mod::auth_cas (
2+
$cas_login_url,
3+
$cas_validate_url,
4+
$cas_cookie_path = $::apache::params::cas_cookie_path,
5+
$cas_version = 2,
6+
$cas_debug = 'Off',
7+
$cas_validate_depth = undef,
8+
$cas_certificate_path = undef,
9+
$cas_proxy_validate_url = undef,
10+
$cas_root_proxied_as = undef,
11+
$cas_cookie_entropy = undef,
12+
$cas_timeout = undef,
13+
$cas_idle_timeout = undef,
14+
$cas_cache_clean_interval = undef,
15+
$cas_cookie_domain = undef,
16+
$cas_cookie_http_only = undef,
17+
$cas_authoritative = undef,
18+
$suppress_warning = false,
19+
) {
20+
21+
validate_string($cas_login_url, $cas_validate_url, $cas_cookie_path)
22+
23+
if $::osfamily == 'RedHat' and ! $suppress_warning {
24+
warning('RedHat distributions do not have Apache mod_auth_cas in their default package repositories.')
25+
}
26+
27+
::apache::mod { 'auth_cas': }
28+
29+
file { $cas_cookie_path:
30+
ensure => directory,
31+
before => File['auth_cas.conf'],
32+
mode => '0750',
33+
owner => $apache::user,
34+
group => $apache::group,
35+
}
36+
37+
# Template uses
38+
# - All variables beginning with cas_
39+
file { 'auth_cas.conf':
40+
ensure => file,
41+
path => "${::apache::mod_dir}/auth_cas.conf",
42+
content => template('apache/mod/auth_cas.conf.erb'),
43+
require => [ Exec["mkdir ${::apache::mod_dir}"], ],
44+
before => File[$::apache::mod_dir],
45+
notify => Service['httpd'],
46+
}
47+
48+
}

‎manifests/params.pp‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,9 @@
6767
$suphp_engine = 'off'
6868
$suphp_configpath = undef
6969
# NOTE: The module for Shibboleth is not available to RH/CentOS without an additional repository. http://wiki.aaf.edu.au/tech-info/sp-install-guide
70+
# NOTE: The auth_cas module isn't available to RH/CentOS without enabling EPEL.
7071
$mod_packages = {
72+
'auth_cas' => 'mod_auth_cas',
7173
'auth_kerb' => 'mod_auth_kerb',
7274
'authnz_ldap' => $::apache::version::distrelease ? {
7375
'7' => 'mod_ldap',
@@ -110,11 +112,12 @@
110112
'7' => '/usr/share/httpd/error',
111113
default => '/var/www/error'
112114
}
113-
if $::osfamily == "RedHat" {
115+
if $::osfamily == 'RedHat' {
114116
$wsgi_socket_prefix = '/var/run/wsgi'
115117
} else {
116118
$wsgi_socket_prefix = undef
117119
}
120+
$cas_cookie_path = '/var/cache/mod_auth_cas/'
118121
$modsec_crs_package = 'mod_security_crs'
119122
$modsec_crs_path = '/usr/lib/modsecurity.d'
120123
$modsec_dir = '/etc/httpd/modsecurity.d'
@@ -169,6 +172,7 @@
169172
$suphp_engine = 'off'
170173
$suphp_configpath = '/etc/php5/apache2'
171174
$mod_packages = {
175+
'auth_cas' => 'libapache2-mod-auth-cas',
172176
'auth_kerb' => 'libapache2-mod-auth-kerb',
173177
'dav_svn' => 'libapache2-svn',
174178
'fastcgi' => 'libapache2-mod-fastcgi',
@@ -198,6 +202,7 @@
198202
$mime_support_package = 'mime-support'
199203
$mime_types_config = '/etc/mime.types'
200204
$docroot = '/var/www'
205+
$cas_cookie_path = '/var/cache/apache2/mod_auth_cas/'
201206
$modsec_crs_package = 'modsecurity-crs'
202207
$modsec_crs_path = '/usr/share/modsecurity-crs'
203208
$modsec_dir = '/etc/modsecurity'

‎spec/classes/mod/auth_cas_spec.rb‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
require 'spec_helper'
2+
3+
describe 'apache::mod::auth_cas', :type => :class do
4+
let :params do
5+
{
6+
:cas_login_url => 'https://cas.example.com/login',
7+
:cas_validate_url => 'https://cas.example.com/validate',
8+
}
9+
end
10+
11+
let :pre_condition do
12+
'include ::apache'
13+
end
14+
15+
context "on a Debian OS", :compile do
16+
let :facts do
17+
{
18+
:id => 'root',
19+
:kernel => 'Linux',
20+
:lsbdistcodename => 'squeeze',
21+
:osfamily => 'Debian',
22+
:operatingsystem => 'Debian',
23+
:operatingsystemrelease => '6',
24+
:path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin',
25+
:concat_basedir => '/dne',
26+
:is_pe => false,
27+
}
28+
end
29+
it { is_expected.to contain_class("apache::params") }
30+
it { is_expected.to contain_apache__mod("auth_cas") }
31+
it { is_expected.to contain_package("libapache2-mod-auth-cas") }
32+
it { is_expected.to contain_file("auth_cas.conf").with_path('/etc/apache2/mods-available/auth_cas.conf') }
33+
it { is_expected.to contain_file("/var/cache/apache2/mod_auth_cas/").with_owner('www-data') }
34+
end
35+
context "on a RedHat OS", :compile do
36+
let :facts do
37+
{
38+
:id => 'root',
39+
:kernel => 'Linux',
40+
:osfamily => 'RedHat',
41+
:operatingsystem => 'RedHat',
42+
:operatingsystemrelease => '6',
43+
:path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin',
44+
:concat_basedir => '/dne',
45+
:is_pe => false,
46+
}
47+
end
48+
it { is_expected.to contain_class("apache::params") }
49+
it { is_expected.to contain_apache__mod("auth_cas") }
50+
it { is_expected.to contain_package("mod_auth_cas") }
51+
it { is_expected.to contain_file("auth_cas.conf").with_path('/etc/httpd/conf.d/auth_cas.conf') }
52+
it { is_expected.to contain_file("/var/cache/mod_auth_cas/").with_owner('apache') }
53+
end
54+
end

‎templates/mod/auth_cas.conf.erb‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
CASCookiePath <%= @cas_cookie_path %>
2+
CASLoginURL <%= @cas_login_url %>
3+
CASValidateURL <%= @cas_validate_url %>
4+
5+
CASVersion <%= @cas_version %>
6+
CASDebug <%= @cas_debug %>
7+
8+
<% if @cas_certificate_path -%>
9+
CASCertificatePath <%= @cas_certificate_path %>
10+
<% end -%>
11+
<% if @cas_proxy_validate_url -%>
12+
CASProxyValidateURL <%= @cas_proxy_validate_url %>
13+
<% end -%>
14+
<% if @cas_validate_depth -%>
15+
CASValidateDepth <%= @cas_validate_depth %>
16+
<% end -%>
17+
<% if @cas_root_proxied_as -%>
18+
CASRootProxiedAs <%= @cas_root_proxied_as %>
19+
<% end -%>
20+
<% if @cas_cookie_entropy -%>
21+
CASCookieEntropy <%= @cas_cookie_entropy %>
22+
<% end -%>
23+
<% if @cas_timeout -%>
24+
CASTimeout <%= @cas_timeout %>
25+
<% end -%>
26+
<% if @cas_idle_timeout -%>
27+
CASIdleTimeout <%= @cas_idle_timeout %>
28+
<% end -%>
29+
<% if @cas_cache_clean_interval -%>
30+
CASCacheCleanInterval <%= @cas_cache_clean_interval %>
31+
<% end -%>
32+
<% if @cas_cookie_domain -%>
33+
CASCookieDomain <%= @cas_cookie_domain %>
34+
<% end -%>
35+
<% if @cas_cookie_http_only -%>
36+
CASCookieHttpOnly <%= @cas_cookie_http_only %>
37+
<% end -%>
38+
<% if @cas_authoritative -%>
39+
CASAuthoritative <%= @cas_authoritative %>
40+
<% end -%>

0 commit comments

Comments
 (0)