View source for ACP Apache Authentication

*<font color=blue>This is for installing ACP with Apache authentication.</font> ''If you want to install ACP with the default firebase authentication ,  [[To install ACP|use the instructions on the main install page here]].''

==PHP==
''Php is used to pass the user name to ACP via an environment variable.''
*Install php 8.38 to c.\php 
*[https://windows.php.net/downloads/releases/ Download the latest PHP 8.3.8 binaries from the official site]. Eg https://windows.php.net/downloads/releases/php-8.3.8-Win32-vs16-x64.zip . Then extract the downloaded zip folder to <code>C:\php</code>.<br />

*In c:\php Rename <code>php-ini-development.ini</code> to <code>php.ini</code>.
*Add the php directory to the path

*In the search box type <code>environment</code> and select edit the system environment variables
*In system properties select Environment variables
*Select <code>system variables>Path </code> and press <code>'''Edit'''</code>.
*Select <code>'''New'''</code> and add <code>C:\php</code> then press <code>'''OK'''</code>. Then exit the system properties dialog.

*In a command prompt enter <code>php</code> - if you get an error you will probably need to reboot. php should start and you will get a blinking cursor. Press Control + C to get out of the php loop.

==Apache Authentication==
===Password file===

*(Create a file <code>passwords</code> without extension. Save this in <code>C:\Apache24\password</code>
(This file should be placed somewhere not accessible from the web so that it cannot be downloaded}.
*To create the file, use the htpasswd utility that came with Apache. This will be located in Apache24 bin directory. In a command prompt:
(Substitute your desired username here>.
<code>c:\Apache24\bin>htpasswd -c c:\Apache24\passwords <yourusername></code><br />
{The -c flag creates a new file}

*htpasswd will ask you for the password, and then ask you to type it again to confirm it:<br />

<code>New password: ************</code><br />
<code>Re-type new password: ************</code><br />
<code>Adding password for user yourusername</code>

====Add/Manage users====
Add any other users and password pairs later. You can refer to [https://httpd.apache.org/docs/2.4/programs/htpasswd.html this page]

===Apache windows sspi authentication===
====Add the Apache Windows sspi Authentication module====
*Download the module and unzip it to a folder.
https://www.apachehaus.net/modules/mod_authnz_sspi/mod_authnz_sspi-0.1.1a1-2.4.x-x64-vc15.zip

*Note that this module is not from Apache. This most recent version is vc15 - this is an add on done by the community. 

*From the downloaded folder: <code>Apache24\modules</code> copy  <code>mod_authnz_sspi.so</code> and save to the Apache modules directory.

<code>C:\Apache24\modules\mod_authnz_sspi.so</code>

*Copy: <code>Apache24\bin\sspipkgs.exe</code> and save it in the Apache bin directory.

<code>C:\Apache24\bin\sspipkgs.exe</code>

====Add/Manage users====
*Ensure each user has a windows account. (If not, add them as a local user from computer management and create a password for them). This will be the user name to sign into ACP and the windows password will be the password for ACP. So if they are a new user you will need to give then the windows credentials. There is no way for a user to set their own password unless they have access to the server's computer management.
*An admin will need to add the users to the ACP projects they will be a member of.
* An admin will need to change passwords.

==Connect to a Microsoft on premises active directory with LDAP==
LDAP Documentation:

https://httpd.apache.org/docs/2.2/mod/mod_authnz_ldap.html
https://coderanger.net/~coderanger/tracdoc/install/apacheauth.html#windows-active-directory

*Uncomment these 2 lines in the httpd.conf file
<code>LoadModule authnz_ldap_module modules/mod_authnz_ldap.so</code><br />
<code>LoadModule ldap_module modules/mod_ldap.so</code><br />


Binding information: To connect to the active directory, we need the values for these 3 Apache configuration variables:<br />
<code>AuthLDAPBindDN </code><br />
<code>AuthLDAPBindPassword </code><br />
<code>AuthLDAPURL )</code><br />

*Add the authentication section to the httpd.conf file in the directory tags (Lumina will normally do this as part of the apache httpd.conf file setup).
<code>#Auth section<br />
AuthType Basic<br />
AuthName "ldap authentication"<br />
AuthBasicProvider ldap<br />
AuthLDAPBindDN "<<Enclode the BindDN in quotes, with single quotes around filters with spaces.>>"<br />
AuthLDAPBindPassword<br />
AuthLDAPURL 'Single quotes around the entire LDAP URL and double quotes around any filters with spaces'<br />
LDAPReferrals Off<br />
Require valid-user<br />
RequestHeader set X-Remote-User %{REMOTE_USER}s<br />
<nowiki>#</nowiki>end auth_basic_module#</code><br />

==A ==
==B==