# Apache HTTP Server

## Presentation

The Apache HTTP Server is a free and open-source cross-platform web server software, released under the terms of Apache License 2.0.

It can be used to protect applications and transmit user identity information to them through HTTP headers.

Apache is highly customizable and can protect applications in many different ways.

## Handler

LemonLDAP::NG can be directly integrated into Apache to protect applications using Perl rules.

The LemonLDAP::NG Handler uses mod_perl.

See the Virtual Hosts documentation for details.

## mod_auth_mellon

You can use mod_auth_mellon as an alternative to the LemonLDAP::NG handler if you do not want to use mod_perl.

You first need to enable the SAML Issuer.

First, download the metadata file from LemonLDAP::NG

    wget -O /etc/apache2/idp-metadata.xml https://auth.example.com/saml/metadata/idp

Location parameters

    <Location /secured>
        Require valid-user
        AuthType "Mellon"

        MellonEnable "auth"
        MellonEndpointPath "/secured/saml"
        MellonIDPMetadataFile /etc/apache2/idp-metadata.xml

        # Certificate for signing SAML requests
        MellonSPPrivateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key
        MellonSPCertFile /etc/ssl/certs/ssl-cert-snakeoil.pem
        </Location>

You can then obtain the SAML SP metadata at `https://apache.example.com/secured/saml/metadata`, you need to input it in LemonLDAP::NG when creating the SAML service provider configuration.

## mod_auth_openidc

You can use mod_auth_openidc as an alternative to the LemonLDAP::NG handler if you do not want to use mod_perl.

You first need to enable the OpenID Connect Issuer.

VirtualHosts parameters

    # Apache-specific configuration
    OIDCCryptoPassphrase changeme
    OIDCRedirectURI https://apache.example.com/secret/oauth2callback

    # URL of LemonLDAP::NG OIDC metadata
    OIDCProviderMetadataURL https://auth.example.com/.well-known/openid-configuration
    # Client ID and client secret from LemonLDAP::NG configuration
    OIDCClientID testrp
    OIDCClientSecret testrp

Location parameters

    <Location /secured>
          AuthType openid-connect
          Require valid-user
    </Location>

## mod_auth_cas

You can use mod_auth_cas as an alternative to the LemonLDAP::NG handler if you do not want to use mod_perl.

You first need to enable the CAS Issuer.

Global parameters

    CASCookiePath /var/cache/apache2/mod_auth_cas/
    CASLoginURL https://auth.example.com/cas/login
    CASValidateURL https://auth.example.com/cas/serviceValidate

VirtualHosts parameters

    <Location /secured>
                Authtype CAS
                Require valid-user
    </Location>