File	Date	Author	Commit
debian	2015-07-31	Jacob Welsh	[6c1935] debian: Fix doc file list and lintian issues
.gitignore	2015-07-16	Jacob Welsh	[9c6221] Improve build system and packaging
AUTHORS	2015-07-16	Jacob Welsh	[9c6221] Improve build system and packaging
COPYING	2015-07-12	Jacob Welsh	[660bf8] Remove redundant COPYRIGHT; add trailing newlin...
INSTALL	2015-07-16	Jacob Welsh	[9c6221] Improve build system and packaging
Makefile.am	2015-07-16	Jacob Welsh	[9c6221] Improve build system and packaging
NEWS	2015-07-16	Jacob Welsh	[9c6221] Improve build system and packaging
README	2009-08-04	Ryan Jud Hughes	[3cb7bd] Fix build issues on CentOS
configure.ac	2015-07-16	Jacob Welsh	[9c6221] Improve build system and packaging
lifetime.c	2002-07-14	clunis	[bed98f] Initial revision
mod_waklog.c	2015-07-16	Jacob Welsh	[9c6221] Improve build system and packaging
mod_waklog.spec	2015-07-16	Jacob Welsh	[9c6221] Improve build system and packaging
regen.sh	2015-07-16	Jacob Welsh	[9c6221] Improve build system and packaging
waklog.conf	2015-07-16	Jacob Welsh	[9c6221] Improve build system and packaging

Read Me

______________________________________________________________________________        
INTRO

mod_waklog is an Apache module that provides aklog-like semantics
for the web.  mod_waklog will acquire (and store in the kernel) an
AFS credential when a connection is opened, use the credential for
the duration of the connection, and will remove the credential when
the connection is closed.

mod_waklog allows you to permit directories using AFS ACLs, and access
them via a web browser.  An ACL of "umweb:servers rl" is required for
each mod_waklog-protected directory.

mod_waklog allows scripts to run as you.  Programs which use AFS
credentials to authenticate themselves do so as you.

mod_waklog often is used with mod_cosign, and uses the cosign-provided
krbtgt to acquire an AFS credential; this extends single signon to AFS
via the web.

______________________________________________________________________________        
CONFIGURATION

Mod_waklog understands these directives.  Of these, only WaklogAFSCell
is mandatory:

WaklogAFSCell

  Use the supplied AFS cell (required)

WaklogEnabled 

  Enable waklog on a server, location, or directory basis

WaklogDefaultPrincipal

  Set the default principal that the server runs as; this principal
  must have "l" access to every path that is served, regardless of
  user credentials or WaklogLocationPrincipal directives.

WaklogLocationPrincipal

  Set the principal on a <Location>-specific basis

WaklogDisableTokenCache (NOT YET IMPLEMENTED)

  Ignore the token cache (<Location>-specific).  This is useful for
  scripts that need kerberos tickets; for example, a perl script that
  uses kerberos authentication to contact a database.  By supplying a
  WaklogLocationPrincipal directive, mod_waklog can obtain the tickets
  and tokens for the principal, but by not using the token cache the
  script is assured that it will have tickets when it runs.
  
WaklogUseUserTokens 

  Use the requesting user tokens (from webauth)

______________________________________________________________________________        
PHASES

Apache processes a request in multiple phases.

mod_waklog runs at phase 0 to acquire credentials via a keytab, and
runs at phase 2 to remove the credentials.

mod_waklog runs at phase 7 to acquire credentials of whatever krbtgt
is referenced via KRB5CCNAME (e.g., set by mod_cosign).

mod_waklog runs at connection termination to remove the credentials
it acquired at phase 0 or phase 7.

Apache calls stat() between phase 1 and phase 2 to determine if it
has access to the directory; if it doesn't have read access at that
point, it won't try to read it again, even if later phases would
acquire credentials which would allow it to do so.  mod_waklog
acquires an afs credential for a principal in the pts group
umweb:servers at phase 0, and removes this credential at phase 2;
directories permitted "umweb:servers rl" will allow the stat() call
to succeed.

______________________________________________________________________________        
BUILD 

make

Be sure the paths to apxs, include files, and libraries are correct.

If you compiled Apache 2 with large file support, be sure to have:

   #define _LARGEFILE64_SOURCE

in mod_waklog.c.  If you run make and receive many errors about apr_off_t
being undefined, you may need to add or comment out the above line.


______________________________________________________________________________        
INSTALL

Copy the ./.libs/mod_waklog.so to somewhere Apache can read and execute it.

Add the following lines to your httpd.conf file:

    LoadModule waklog_module        /path/to/mod_waklog.so

    <IfModule mod_waklog.c>
        WaklogProtected                 On
    </IfModule>