Can we have acl ?

[Et7f3]

Hello,

I saw all the option and the closest I come is https://github.com/gssapi/mod_auth_gssapi?tab=readme-ov-file#gssapirequirednameattributes

I would like to allow only certain username to connect and/or group. I think username should be feasible since we send username and if I am correct also in ticket, I don't know if group and other customs attributes are available.

Ideally I would like to do something like:
https://httpd.apache.org/docs/2.4/fr/mod/mod_authz_core.html

or just a simpler (old config with ldap):

Require ldap-user ADM1 ADM2 ADM3

I tried:

Require user ADM1
Require valid-user

but it seems anybody (with a kerberos ticket) can connect.

[amessina]

Have you tried

<RequireAny>
  Require user ADM1
  Require ldap-group ...
</RequireAny>

[Et7f3]

Oh no I want to migrate from my ldap config to this module. I showed my old config.

[Et7f3]

I read in http dev manual:

Authn/Authz
The bundled authentication and authorization modules have been renamed along the following lines:

   mod_auth_* -> Modules that implement an HTTP authentication mechanism
   mod_authn_* -> Modules that provide a backend authentication provider
   mod_authz_* -> Modules that implement authorization (or access)
   mod_authnz_* -> Module that implements both authentication & authorization

There is a new authentication backend provider scheme which greatly eases the construction of new authentication backends.

Since this module is called mod_auth_gssapi and not mot_authz_gssapi it seems expected it doesn't provide access filter.

Just for info mod_authnz_ldap register those variable so it can be used with the Require statement.

https://github.com/apache/httpd/blob/07c50195643ddb3ca8f58a010c7d6ff4645c5675/modules/aaa/mod_authnz_ldap.c#L2027-L2064

Is their another module that can register such variables used from gssapi ?