Red Hat OpenShift Container Platform

Example Apache HTTPD configuration for basic identity providers

You can use CGI scripting in Apache HTTPD to configure a remote authentication server that returns JSON responses for basic identity providers in Red Hat OpenShift Container Platform.

The following is an example of an Apache VirtualHost configuration file.

<VirtualHost *:443>
  # CGI Scripts in here
  DocumentRoot /var/www/cgi-bin

  # SSL Directives
  SSLEngine on
  SSLCipherSuite PROFILE=SYSTEM
  SSLProxyCipherSuite PROFILE=SYSTEM
  SSLCertificateFile /etc/pki/tls/certs/localhost.crt
  SSLCertificateKeyFile /etc/pki/tls/private/localhost.key

  # Configure HTTPD to execute scripts
  ScriptAlias /basic /var/www/cgi-bin

  # Handles a failed login attempt
  ErrorDocument 401 /basic/fail.cgi

  # Handles authentication
  <Location /basic/login.cgi>
    AuthType Basic
    AuthName "Please Log In"
    AuthBasicProvider file
    AuthUserFile /etc/httpd/conf/passwords
    Require valid-user
  </Location>
</VirtualHost>

The following is an example of a login.cgi CGI script file.

#!/bin/bash
echo "Content-Type: application/json"
echo ""
echo '{"sub":"userid", "name":"'$REMOTE_USER'"}'
exit 0

The following is an example of a fail.cgi CGI script file.

#!/bin/bash
echo "Content-Type: application/json"
echo ""
echo '{"error": "Login failure"}'
exit 0

File requirements

These are the requirements for the files you create on an Apache HTTPD web server:

The login.cgi and fail.cgi CGI script files must be executable. Use the chmod +x command on both files.
If SELinux is enabled, the login.cgi and fail.cgi CGI script files must have proper SELinux security contexts. Run the restorecon -RFv /var/www/cgi-bin command, or ensure that the context is the httpd_sys_script_exec_t SELinux type by using the ls -laZ command.
The login.cgi CGI script file runs only when the user successfully logs in according to the Require and Auth Apache configuration directives.
The fail.cgi CGI script file runs when the user fails to log in and returns an HTTP 401 HTTP status code.