Credential Authentication API (CAA)

################################################
## Use drupal as external auth backend for apache and other webservers.
## Apache example included.
## ALWAYS USE SSL FOR THIS AS PASSWORDS WILL BE SENT OVER THE WIRE!
################################################

Summary

This module provides a simple API to feed credentials, and returns a status message after verification.
Script for apache (external vhost) included.

Use cases

• Use in combination with mod-authnz-external to provide basic authentication on a different server / vhost against Drupal user database
• Use PAM to authenticate linux users against Drupal user database
• Many more possibilities

A script to use mod-authnz-external (apache) is included, providing secure session cache.

Features

• API key validation
• Uses flood control etc
• Integrates with LDAP module (adds exclude paths etc)
• Apache script: SSL
• Apache script: Secure session cache

Todo

• Make authentication more transparent by using the login form (internal handling)
  At this moment standard drupal authentication code is used, hence using flood control etc, but bypassing LDAP and other modules
• Standard scripts for pam-exec and nginx

Instructions (from README)

Base on Ubuntu 14.04 LTS, assuming you're using Apache2:
-> sudo apt-get install libapache2-mod-authnz-external

-> Include this in the VHOST you'd like to protect:

AuthType Basic
AuthName "Restricted"
AuthBasicProvider external
AuthExternal drupal-backend
require valid-user

DefineExternalAuth drupal-backend pipe "/ABSOLUTE/PATH/TO/DRUPAL/PROJECT/sites/all/modules/custom/finalist_apache_auth_backend/finalist_apache_auth_backend.php https://my.drupal.website"
Be aware that the script-path must be absolute.

-> Make sure sites/all/modules/custom/finalist_apache_auth_backend/finalist_apache_auth_backend.php is EXECUTABLE (chmod +x [file]).
If risk of resetting filemode is too high, copy the file outside the webroot, and point DefineExternalAuth (vhost) to it.
-> Visit /admin/finalist/external-auth-settings and configure an API-Key.
-> Configure finalist_apache_auth_backend.php (edit the file).

Notes:

• The php-script finalist_apache_auth_backend.php does not allow for redirects because of security issues.
  For the ldap_sso module this is fixed by adding the api path to excludes, but other modules or server-configs might interfere.
• The php-script keeps it's own secure cache in the system temp folder.
  Sessions stay alive for 5 minutes, and are saved in hashed files, which cannot be resolved to usernames or passwords.
  Old session files are automatically removed during requests.
• Be aware that passwords are sent plain-text. ALWAYS MAKE SURE TO RUN YOUR DRUPAL INSTANCE BEHIND SSL.
• SSL: if using SSL (Drupal url starts with https://), only valid certificates are allowed!
  Self-signed certificates won't work, as it is not secure in any context running Drupal.
• If using a SSL3 certificate on the webhost, you should use the curl method by configuring in the script.

mod-authnz package name for other distributions:
- Ubuntu 12.04 LTS: libapache2-mod-authnz-external
- Debian 7: libapache2-mod-authnz-external

Compile on your own (CentOS, RHEL etc)? See https://code.google.com/p/mod-auth-external/wiki/Installation .

Vhost addition example for use of caa-apache.php

<Location />
         AuthType Basic
         AuthName "Restricted"
         AuthBasicProvider external
         AuthExternal drupal-backend
         require valid-user
   </Location>

   DefineExternalAuth drupal-backend pipe "/ABSOLUTE/PATH/TO/DRUPAL/PROJECT/sites/all/modules/custom/caa/scripts/caa-apache.php https://my.drupal.website"