I have a domain-joined (via
CentOS 7 server, acting as a SFTP server, which has a mountpoint mapped to a Windows' share:
SFTP Client -> Linux SFTP Server -> Windows File Server
My goal here is to eliminate Linux-sided permissions and configs as much as possible.
The mount is configured with
sec=krb5 options. Users logging into the SFTP server are authenticated against AD database, and everything works great: for each user logging in and accessing the mounted/shared folder, the
krb5 settings kick in and folder permissions are fully controlled by the Windows File Server holding the files, since each user mounts this share using their own kerberos ticket obtained upon logon to the SFTP server.
Great. Now onto the sad part of the story.
I have to provide HTTPS access to the same files mentioned above. The problem is that I couldn't find a way to make
httpd access files using the authenticated user's credentials, which would cause the share to be mounted with the right (requesting user's) credentials, instead of Apache's user.
I could work around this by setting mod ldap's group authorization, but I REALLY wanted to control everything using Windows' permissions, just as I do with SFTP access. Any ideas aside from using
IIS (which does exactly what I want by default)?
I can already use
Single Sign-On through Apache, and even cache the kerberos tickets. So what's stopping me (aside from my lack of programming skills) from using that same ticket (and username info) to call
automount with it?