Integrating with the Apache mod_auth_openidc module

Overview

This guide provides details on configuration of The Curity Identity Server working in conjunction with the mod_auth_openidc module to protect an application running in Apache.

The mod_auth_openidc module functions as an OpenID Connect Relying Party (RP) and enables authentication against an OpenID Connect Provider, in this case The Curity Identity Server.

The module is configured to protect an application and with that requires an access token in order for access to be granted. If no token is available the module will redirect to The Curity Identity Server for authentication and if successful, grant a token. The token is then used to gain access to the protected application(s).

Claims from the token are passed to the protected application and are checked against the configuration in order for access to be granted.

Prerequisites

• An installation of The Curity Identity Server
• A configured client as outlined by this tutorial Code Flow
• An Authenticator that the Client can use, see this tutorial for an example Username Password Authenticator
• Apache httpd with the mod_auth_openidc module installed.

If you do not have an installation of The Curity Identity Server, follow this tutorial installation of The Curity Identity Server and configure the installation by running the Basic Setup Wizard as outlined in this tutorial Basic Setup Wizard.

Configure mod_auth_openidc

Module Configuration

The OpenID Connect client is configured in auth_openidc.conf. The table below outlines some of the parameters. Further details and documentation in auth_openidc.conf.

auth_openidc.conf example snippet

OIDCRedirectURI /protected
OIDCCryptoPassphrase MyPa$$phrase
OIDCProviderMetadataURL https://idsvr.example.com/oauth/v2/oauth-anonymous/.well-known/openid-configuration
OIDCScope "openid email mycustomscope"

Apache configuration

The Apache configuration parameters are outlined below.

Protected locations can be specified. The example below has configured both /protected and /restricted. The /restricted location also requires a claim named read_restricted with the value of true in order for access to be granted.

openidc.conf example snippet

OIDCProviderMetadataURL https://idsvr.example.com/oauth/v2/oauth-anonymous/.well-known/openid-configuration
OIDCRedirectURI /protected
OIDCClientID mod-auth-client
OIDCClientSecret MyPa$$w0rd
OIDCCryptoPassphrase MyPa$$phrase

<Location /protected>
  AuthType openid-connect
  Require valid-user
</Location>

<Location /restricted>
  AuthType openid-connect
  Require claim read_restricted:true
</Location>

Conclusion

The mod_auth_openidc module is a trivial way of protecting web applications deployed in the Apache web server using The Curity Identity Server as an OP. The configuration in the server is very straight forward and without any custom additions can be used to achieve this integration.

Resources

The mod_auth_openidc Apache module.