Control web page access for Pages
On this page:
- Overview
- Register your site's URLs with IU Login
- Allow all IU users
- Restrict to specific IU users
- Restrict to specific ADS groups
Overview
You can control who is able to view your web pages by using .htaccess
files in your web
directory and subdirectories.
By adding an Error Document Directive
to your
.htaccess
file, you can provide custom error messages so that users can contact you in case of problems.
When a user tries to access one of your web pages, the web server looks for a .htaccess
file in the directory where the file is stored. If there is a .htaccess
file present, the user must meet the authentication requirements defined in the file in order to view the page. If there is no .htaccess
file present, the web page will be displayed.
- If there is a problem with the way the
.htaccess
file is written, an Internal Server Error page will be displayed. - To control access by a method other than the
.htaccess
file, see Connect to IU Login with the CAS protocol.
Register your site's URLs with IU Login
In order to control web page access using IU Login, you must register your website's URLs via the CAS Protocol Integration Request form. The form will ask for pre-production and production URLs. You can skip the "Pre-production URL(s)" field, since Pages does not provide a test environment. For the production URL, enter account.pages.iu.edu
. Once you submit the form, your URLs should be registered within five business days.
To verify registration, visit:
https://idp.login.iu.edu/idp/profile/cas/login?service=your site's url
If registration is not complete, you will see an "Error - Unsupported Request" message. Otherwise, you will be successfully redirected to your site.
Allow all IU users
If you wish to restrict access to anyone who has a University account, you may do so by using a predefined access control option within the web
directory within your account.
To activate this option, log into your account and move to the web
directory. (To restrict access to only certain subdirectories, move to the directory you wish to restrict.) Type the following command:
iu_cas
Any person with an IU username and passphrase will be able to authenticate; others will receive a "403 Forbidden" error message.
Restrict to specific IU users
To restrict access to certain IU credentials, create or modify a
.htaccess
file to look something like this:
AuthGroupFile /dev/null
AuthType CAS
AuthName "IU Network ID"
<Limit GET POST>
require user greg peter bobby sam oliver
</Limit>
The "AuthType" field is defined as CAS
, so website visitors will be directed to the IU Login screen, and must use their IU Network usernames and passphrases to authenticate. The require user
directive within the Limit
tags lists the IU Network usernames allowed to access the files in this directory. In this case, the network usernames greg
, peter
, bobby
, sam
, and oliver
are permitted access. Everyone else will receive an error message if they try to log in.
If your list of required users is long, make sure there are no line breaks in the list of names. If your list exceeds the number of characters that can be contained in one line, your users may receive an "Internal Server Error" message instead of a login box. The solution is to separate your list of users into several require user
statements, as shown:
<Limit GET POST>
require user greg peter bobby sam oliver james ebenezer harold scott robert
require user kate elizabeth sarah jennifer alison susan megan erica leslie
</Limit>
With this type of authentication, users log in with their network usernames and passphrases, so you don't have to maintain passwords for them.
Restrict to specific ADS groups
The following shows how to use LDAP in the .htaccess
file to restrict access based on ADS groups. This method also uses IU Login initially authenticate the user. For security reasons, you may use this only in the wwws
directory within your account.
Put the following in your .htaccess
file:
AuthType CAS
AuthName "LOGIN"
AuthUserFile /dev/null
AuthLDAPAuthoritative off
AuthLDAPURL "ldaps://ads.iu.edu/ou=Accounts,dc=ads,dc=iu,dc=edu?cn"
AuthLDAPBindDN "cn=<user to bind to ldap>,ou=accounts,dc=ads,dc=iu,dc=edu"
AuthLDAPBindPassword "exec:<path to password script>"
#To restrict based on group membership:
Require ldap-group <ldap-group path>
#To restrict based on user:
Require ldap-user <ldap user>
<ldap-group path>
is the full Distinguished Name of the LDAP group. For example, the group of all UITS employees would be:CN=IU-UITS-MANAGED-DEPT-UA-VPIT,OU=Department,OU=Groups,OU=Managed,DC=ads,DC=iu,DC=edu
-
For the
<user to bind to ldap>
, UITS strongly recommends that you request a separate group account that will only be used for this purpose. Do not use a personal account for this purpose.
In order to secure your LDAP account password, do the following:
- Create a directory in the home directory of your account and set the permissions as follows:
mkdir /groups/<account>/.ldap chmod 6711 .ldap
The directory permissions should look like this:
drws--s--x 2 <account> sitehost-groups 2048 Jul 26 09:47 .ldap
- Create a script in this directory with the following code. For purposes of this example, we'll call it
ldap.sh
.#!/bin/sh echo "<ldap_password>"
Note:Certain special characters will cause a passphrase to not work in this script. To test your passphrase, execute the script:
.ldap/ldap.sh
If your passphrase displays correctly, the script is fine. If there is an error, escape the problematic characters with a
\
. For example, to fix123$456`789
, escape the$
and`
characters like so:123\$456\`789
- Set the following permissions on your password script:
chmod 700 ldap.sh ; setfacl -m www-data:r-x ldap.sh
The file permissions should look like this:
-rwxr-x---+ 1 <account> sitehost-groups 37 Jul 26 09:47 ldap.sh
- In this example, the relevant line in the
.htaccess
file would look like:AuthLDAPBindPassword "exec:/groups/<account>/.ldap/ldap.sh"
This is document bfro in the Knowledge Base.
Last modified on 2023-07-19 11:02:34.