University of Pennsylvania wants to protect part of Apache with Grouper based on a SQL loaded group for a new application. Note that most institutions can use the apache mod_authnz_ldap, but our LDAP doesn't have memberOf and isn't conducive to it.
So the architecture we will have is the grouperClient which calls a WS to keep an apache .htaccess up to date via cron.
First, we use kerberos principals for authentication to Grouper WS, so we created a kerberos principal / pass: application_grouper/server.school.edu
Then we have a custom non-grouper application to enter this kerberos principal into our kerberos principal subject source, note, this is an admin action.
Then I add this kerberos principal to the WS users group: school:etc:webServiceClientUsers
This is an application which didn't previously use Grouper, so I create a folder in the applications folders in the IT department: school:it:ait:apps:appName
In there, I like to keep the privileges in groups, so make a group for that: school:it:ait:apps:appName:etc:appNameReaders
Add the kerberosPrincipal and the client person to that group.
Make a loader group: school:it:ait:apps:appName:groups:apacheGroup
Make sure that group is of grouperLoader type
Add the school:it:ait:apps:appName:etc:appNameReaders group to have the READ privilege on school:it:ait:apps:appName:groups:apacheGroup. Note, dont give admin because you dont want a non admin editing the attributes on a loader group. Generally you dont give "update" to a grouper loader group since the memberships will be reset. Maybe the updater knows what they are doing and can onboard quicker...
In this case we have a new database connection since the SQL is not loaded from the Grouper database. The DBA setup a new schema for use so that all we have permissions in the DB is to select from a certain view. We need to add in a database connection in the grouper-loader.properties:
db.application.user = APP_SCHEMA db.application.pass = /home/user/pass/grouper/grouperMorphApp.pass db.application.url = jdbc:oracle:thin:@(DESCRIPTION=(LOAD_BALANCE=YES)(FAILOVER=YES)(ADDRESS_LIST=(ADDRESS=(PROTOCOL=tcp)(HOST=1.2.3.4)(PORT=1234))(ADDRESS=(PROTOCOL=tcp)(HOST=1.2.3.5)(PORT=1235)))(CONNECT_DATA=(SERVICE_NAME=appdb.school.edu))) db.application.driver = oracle.jdbc.driver.OracleDriver
Note the password is not in the file, so encrypt that and put it in the file:
[user@server bin]$ cd /opt/tomcat_9b/webapps/grouper/WEB-INF/lib [user@server lib]$ java -jar morphString.jar Enter the location of morphString.properties: ../classes/morphString.properties Type the string to encrypt (note: pasting might echo it back): The encrypted string is: abc123abc123abc123== [user@server lib]$ echo abc123abc123abc123== > /home/user/pass/grouper/grouperMorphApp.pass
Now we can fill in the grouperLoader attributes, this will update every couple of hours during the day, and simple sql: 
Run this with GSH to test it out:
gsh 0% grouperSession = GrouperSession.startRootSession(); gsh 1% loaderGroup = GroupFinder.findByName(grouperSession, "school:it:ait:apps:appName:groups:apacheGroup"); gsh 2% loaderRunOneJob(loaderGroup);
Bounce the grouper-loader process (at Penn this run in a tomcat, so we bounce that tomcat).
Make a .htaccess file to protect a directory in apache (or do something else in apache config) (note, we use cosign, protect with whatever authentication you have)
[mchyzer@flash public_html]$ pwd /home/mchyzer/public_html [mchyzer@flash public_html]$ cat .htaccess CosignService isc-seo-studentHomeSso_dev-0 CosignCrypto /opt/appserv/weblogin/cert_isc-seo-studentHomeSso_dev/isc-seo-studentHomeSso_dev-0.key /opt/appserv/weblogin/cert_isc-seo-studentHomeSso_dev/isc-seo-studentHomeSso_dev-0.crt /opt/appserv/weblogin/ca/ CosignProtected On AuthType Cosign CosignRequireFactor UPENN.EDU AuthGroupFile /home/mchyzer/public_html_config/appUsers.txt Require group appUsers [mchyzer@flash public_html]$
Now we need the beginning and end of the generated group file:
[mchyzer@flash public_html_config]$ more appUsersStart.txt appUsers: [mchyzer@flash public_html_config]$
Get the grouper client in that dir, and configure the grouper.client.properties WS URL, user, pass (based on kerberos principal):
[mchyzer@flash public_html_config]$ ls grouper* grouperClient.jar grouper.client.properties grouper.client.properties~ [mchyzer@flash public_html_config]$ cat grouper.client.properties ... # url of web service, should include everything up to the first resource to access # e.g. http://groups.school.edu:8090/grouperWs/servicesRest # e.g. https://groups.school.edu/grouperWs/servicesRest grouperClient.webService.url = http://server.school.edu/grouperWs/servicesRest # kerberos principal used to connect to web service # e.g. name/server.whatever.upenn.edu grouperClient.webService.kerberosPrincipal = application_grouper/server.school.edu # password for shared secret authentication to web service # or you can put a filename with an encrypted password grouperClient.webService.password = abc123abc123abc123 ...
Test the connection:
[mchyzer@flash public_html_config]$ java -jar grouperClient.jar --operation=getMembersWs --groupNames=school:it:ait:apps:appName:groups:apacheGroup GroupIndex 0: success: T: code: SUCCESS: group: school:it:ait:apps:appName:groups:apacheGroup: subjectIndex: 0: 12345678 GroupIndex 0: success: T: code: SUCCESS: group: school:it:ait:apps:appName:groups:apacheGroup: subjectIndex: 1: 87654321 [mchyzer@flash public_html_config]$
Write a script to generate the user file:
[mchyzer@flash public_html_config\]$ more appUsers.sh
#!/bin/bash
#make a backup
cp /home/mchyzer/public_html_config/appUsers.txt /home/mchyzer/public_html_config/appUsersBak.txt
#build the new file into a temp file so its not temporarily empty
cat /home/mchyzer/public_html_config/appUsersStart.txt > /home/mchyzer/public_html_config/appUsersTemp.txt
/opt/java6/bin/java -jar /home/mchyzer/public_html_config/grouperClient.jar--operation=getMembersWs --groupNames=school:it:ait:apps:appName:groups:apacheGroup --subjectAttributeNames=PENNNAME --outputTemplate='${wsSubject.attributeValues\[0\]}$space$' >> /home/mchyzer/public_html_config/appUsersTemp.txt 2>/home/mchyzer/public_html_config/appUsersLog.txt
ret=$?
if [ $ret -ne 0 ]; then
mail someone@school.edu -s "Error syncing app apache group" < /home/mchyzer/public_html_config/appUsersLog.txt
exit 1
fi
mv /home/mchyzer/public_html_config/appUsersTemp.txt /home/mchyzer/public_html_config/appUsers.txt
Put this in a cron, note, this cron should be right after the previous loader cron
[mchyzer@flash public_html_config]$ crontab -l 25 8,10,12,14,16 * * * /home/mchyzer/public_html_config/appUsers.sh > /home/mchyzer/public_html_config/appUsers.log 2>&1
sdf