View source for ACP Apache Authentication

*<font color=blue>This is for installing ACP with Apache authentication.</font> ''If you want to install ACP with the default firebase authentication ,  [[To install ACP|use the instructions on the main install page here]].''

==PHP==
''Php is used to pass the user name to ACP via an environment variable.''
*Install php 8.38 to c.\php 
*[https://windows.php.net/downloads/releases/ Download the latest PHP 8.3.8 binaries from the official site]. Eg https://windows.php.net/downloads/releases/php-8.3.8-Win32-vs16-x64.zip . Then extract the downloaded zip folder to <code>C:\php</code>.<br />

*In c:\php Rename <code>php-ini-development.ini</code> to <code>php.ini</code>.
*Add the php directory to the path

*In the search box type <code>environment</code> and select edit the system environment variables
*In system properties select Environment variables
*Select <code>system variables>Path </code> and press <code>'''Edit'''</code>.
*Select <code>'''New'''</code> and add <code>C:\php</code> then press <code>'''OK'''</code>. Then exit the system properties dialog.

*In a command prompt enter <code>php</code> - if you get an error you will probably need to reboot. php should start and you will get a blinking cursor. Press Control + C to get out of the php loop.

==Apache Authentication==
===Password file===

*(Create a file <code>passwords</code> without extension. Save this in <code>C:\Apache24\password</code>
(This file should be placed somewhere not accessible from the web so that it cannot be downloaded}.
*To create the file, use the htpasswd utility that came with Apache. This will be located in Apache24 bin directory. In a command prompt:
(Substitute your desired username here>.
<code>c:\Apache24\bin>htpasswd -c c:\Apache24\passwords <yourusername></code><br />
{The -c flag creates a new file}

*htpasswd will ask you for the password, and then ask you to type it again to confirm it:<br />

<code>New password: ************</code><br />
<code>Re-type new password: ************</code><br />
<code>Adding password for user yourusername</code>

====Add/Manage users====
Add any other users and password pairs later. You can refer to [https://httpd.apache.org/docs/2.4/programs/htpasswd.html this page]

===Apache windows sspi authentication===
<font color=blue>The mod_authnz_sspi module is no longer available from Apachehaus. It has been replaced by the NTLM module. We have not configured this module on our servers and cannot provide further instructions at this time, but the folllowing may still work if you replace the mod_authnz_sspi with the mod_authn_ntml module .</font> 
====Add the Apache Windows sspi Authentication module====
*Download the module and unzip it to a folder.
https://www.apachehaus.net/modules/mod_authnz_sspi/mod_authnz_sspi-0.1.1a1-2.4.x-x64-vc15.zip

*Note that this module is not from Apache. This most recent version is vc15 - this is an add on done by the community. 

*From the downloaded folder: <code>Apache24\modules</code> copy  <code>mod_authnz_sspi.so</code> and save to the Apache modules directory.

<code>C:\Apache24\modules\mod_authnz_sspi.so</code>

*Copy: <code>Apache24\bin\sspipkgs.exe</code> and save it in the Apache bin directory.

<code>C:\Apache24\bin\sspipkgs.exe</code>

====Add/Manage users====
*Ensure each user has a windows account. (If not, add them as a local user from computer management and create a password for them). This will be the user name to sign into ACP and the windows password will be the password for ACP. So if they are a new user you will need to give then the windows credentials. There is no way for a user to set their own password unless they have access to the server's computer management.
*An admin will need to add the users to the ACP projects they will be a member of.
* An admin will need to change passwords.

==Connect to a Microsoft on premises active directory with LDAP==
LDAP Documentation:

https://httpd.apache.org/docs/2.2/mod/mod_authnz_ldap.html
https://coderanger.net/~coderanger/tracdoc/install/apacheauth.html#windows-active-directory

*Uncomment these 2 lines in the httpd.conf file
<code>LoadModule authnz_ldap_module modules/mod_authnz_ldap.so</code><br />
<code>LoadModule ldap_module modules/mod_ldap.so</code><br />


Binding information: To connect to the active directory, we need the values for these 3 Apache configuration variables:<br />
<code>AuthLDAPBindDN </code><br />
<code>AuthLDAPBindPassword </code><br />
<code>AuthLDAPURL )</code><br />

*Add the authentication section to the httpd.conf file in the directory tags (Lumina will normally do this as part of the apache httpd.conf file setup).
<code>#Auth section<br />
AuthType Basic<br />
AuthName "ldap authentication"<br />
AuthBasicProvider ldap<br />
AuthLDAPBindDN "<<Enclode the BindDN in quotes, with single quotes around filters with spaces.>>"<br />
AuthLDAPBindPassword<br />
AuthLDAPURL 'Single quotes around the entire LDAP URL and double quotes around any filters with spaces'<br />
LDAPReferrals Off<br />
Require valid-user<br />
RequestHeader set X-Remote-User %{REMOTE_USER}s<br />
<nowiki>#</nowiki>end auth_basic_module#</code><br />

==A ==
==B==