2

I have a domain-joined (via samba/sssd) CentOS 7 server, acting as a SFTP server, which has a mountpoint mapped to a Windows' share:

SFTP Client -> Linux SFTP Server -> Windows File Server

My goal here is to eliminate Linux-sided permissions and configs as much as possible.

The mount is configured with multiuser and sec=krb5 options. Users logging into the SFTP server are authenticated against AD database, and everything works great: for each user logging in and accessing the mounted/shared folder, the multiuser+krb5 settings kick in and folder permissions are fully controlled by the Windows File Server holding the files, since each user mounts this share using their own kerberos ticket obtained upon logon to the SFTP server.

Great. Now onto the sad part of the story.

I have to provide HTTPS access to the same files mentioned above. The problem is that I couldn't find a way to make Apache/httpd access files using the authenticated user's credentials, which would cause the share to be mounted with the right (requesting user's) credentials, instead of Apache's user.

I could work around this by setting mod ldap's group authorization, but I REALLY wanted to control everything using Windows' permissions, just as I do with SFTP access. Any ideas aside from using IIS (which does exactly what I want by default)?

I can already use Single Sign-On through Apache, and even cache the kerberos tickets. So what's stopping me (aside from my lack of programming skills) from using that same ticket (and username info) to call automount with it?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.