Hello Alexander,

Thanks for help. I found that I have to name pam.d service with same name as HBAC service in IPA and it works. My mistake when reading documentation.

With kind regards, Jan Gardian

On 08/28/2018 05:44 PM, Alexander Bokovoy wrote:

On ti, 28 elo 2018, Jan Gardian via FreeIPA-users wrote:

...

Hello,

Could you please be so kind provide me advice how to setup HBAC rule to allow user authentication/authorization to web service but not to server where this web run.

Our ipa runs at Centos 7.5.1804, version of IPA 4.5.4, API_VERSION: 2.228.

Web service runs at Ubuntu 16.06.5 LTS on Apache2.

In Apache configuration is setup kerberos authentication and authorization is directed to pam_sss.so SSSD module which we use for server login.        <Location />                 AuthType                     Kerberos                 AuthName                  "Kerberos Login"                 KrbMethodNegotiate   On                 KrbAuthoritative          On                 KrbMethodK5Passwd   Off                 KrbServiceName HTTP/web_server.domain.com                 KrbAuthRealms           DOMAIN.COM                 Krb5KeyTab /etc/apache2/http-web_server.keytab                 KrbVerifyKDC              Off                 KrbSaveCredentials    On                 KrbLocalUserMapping On                 Require                   pam-account crm-production         </Location>

/etc/pam.d/crm-production: auth    required   pam_sss.so                # pam_sss.so for SSSD account required   pam_sss.so                # or other PAM module

---

HBAC rule with bellow setting works but it allow any service. Specified User and Groups

• testuser

Specified Hosts and Groups

• web_server.domain.com

Any Service

How can I tell in HBAC rule to allow only HTTP/web_server.domain.com?

Did you disable allow_all HBAC rule? That rule allows access to any service on any machine by default. You'd need to create specific rules for specific users/groups/hosts/services when allow_all rule is disabled.