Protecting your site with CUWebauth/Netid

When requesting a new url/virtual host for your application, this is a good time to think whether or not your site, or any part of your website will need to be protected by CU WebAuth and require visitors to log in with their NetID and password.

Sites that utilize CU WebAuth are required to use SSL.

There are two options for having an SSL configured. One is referred to as "HTTPS" and one as "BOTH".

If you wish to have ALL traffic protected by SSL we recommend that you request "HTTPS" for the protocol. This will create a redirect so that any traffic that goes to http://\[my site]/ will be redirected to https://\[my site]/.

However if only parts of your site need login access, this means a portion of your site will be protected by SSL while the other portion is not. In this case if you specify "BOTH" then you will be responsible for determining whether a page can be displayed using SSL or non-SSL.

The use of .htaccess files or an Apache Include file will need to be created and configured to achieve partial "protected" sites. Both are viable options, and use many if not the same configurations, however they are implemented differently and can cause problems if not done correctly. For the CUWebauth specific information to use within an .htaccess file or Apache Include, please see Restricting and Opening Access to Your Site

Using .htaccess file in an "Open" site

When using "BOTH", the non-SSL connections have NO restrictions, that means that all files are publicly available unless you explicitly put in a ".htaccess" to protect the directory using CU WebAuth. Apache reads and executes the .htaccess at time of access (when the visitor to the site requests that page or something within that directory). There is no need for an Apache restart to have the .htaccess configuration "go-live". It works (as long as it is configured properly) as soon as the file is written to the server (maybe uploaded via webdav or through the Splash page editor).

Some examples of restricting access via a ".htaccess" file:

Require SSL (will just cause a 403 error)

SSLRequireSSL

Redirect to SSL

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

Note that if you protect a directory with CU WebAuth and you go to the non-SSL site you will get the following error "CUWebAuth error... Server is not properly configured. Check the Kerberos principal.". In this case you need to be sure to specify the "https" URL and not the "http" URL to avoid getting the error. If you wish to setup a redirect from the non-SSL site to the SSL site for the ".htaccess" protected directory you'll either need to specify the redirect in a parent directory or via a custom vhost include.

More information on .htaccess files from the Apache Foundation

Using Customer VirtualHost Apache Includes

Virtualhost Apache include files are configuration files the Apache server reads at start-up/graceful restart. These files look very much like any other apache config file - and can also look very similar to .htaccess files. Virutalhost Apache include files can utilize more options and settings than a .htaccess file can, so this provides customers greater flexibility and control over how their web server performs.

For more specific information, please see VirtualHost Apache Include Files.

  • No labels