Jakub, wasn't there an idea to create HBAC enforcing mod_ for apache? I think I recall some relevant discussion.

(In reply to comment #1)
> Jakub, wasn't there an idea to create HBAC enforcing mod_ for apache? I
> think I recall some relevant discussion.

There was a proposal to develop a standalone PAM HBAC module, but I don't remember anything about an Apache module.

The problem is that there would be no way to distinguish one application running in Apache from another. We have looked into this several times and every time the biggest problem is to identify one Apache apps from another. A separate complication is that the identities logging into the web app running in Apache and identities logging into the OS are in many cases different identities, in sssd lingo two different domains. And the problem arises in SSSD to determine which domains should be served to which Apache instances and applications. So far there is no go solution to that problem.
Realistically you want Kerberos SSO + Siteminder. HBAC is just a simplified access control engine in comparison to Siteminder. 
This is probably a route to go but this would be a huge undertaking and it is not clear if IPA+SSSD is the right place and vehicle to define, manage and deliver access control rules around URLs and if not it immediately falls outside of our scope.
I think there should be an open source equivalent of Siteminder but so far I am unaware of it. If there is it might make sense (or might not) to store its access control rules in IPA so please if you know about such project point us to it.

Well the idea was to use different principals for virtual servers, for example:
HTTP/a.example.com 
HTTP/b.example.com
and define different HBAC(?) rules for these services. This might work with pure apache kerberos auth if the KDC would check wether you have authorization for the service, wouldn't it?

I have an update on this front. I think this request could be fulfilled with mod_authnz_pam that Jan Pazdziora developed. You can find more information here:

http://www.freeipa.org/page/Web_App_Authentication#Host_and_service_based_access_control

Packages are on their way Fedora:
https://admin.fedoraproject.org/updates/mod_authnz_pam-0.8.1-1.fc20,mod_intercept_form_submit-0.9.5-1.fc20

Confirming that the mod_authnz_pam should address all the requirements from comment 0 -- see http://www.adelton.com/apache/mod_authnz_pam/ for documentation.

As for distinguishing applications in Apache (problem mentioned in comment 3), my proposal is to use different HBAC service name for each (class of) application and the matching PAM service name. So you can have 'www-controlling' and 'www-controlling-stage', or you can have 'www-controlling.company.a' and 'www-controlling.company.b'. It's just a string, which will however allow you to come up with virtually unlimited set of rules.

In the Apache configuration,

   Require pam-account www-controlling-stage

will then select the correct service (and thus HBAC rules).

Lukáš, could you please check if the module seems like a fit for your needs? Packages for RHEL 6 and RHEL 7 are in repos at
http://copr-fe.cloud.fedoraproject.org/coprs/adelton/identity_demo/

This request is currently tracked in Bug 1107555 - it contains FreeIPA apache modules as specified above.

Closing this bug as duplicate so that the effort can be tracked in one location.

*** This bug has been marked as a duplicate of bug 1107555 ***

The needinfo request[s] on this closed bug have been removed as they have been unresolved for 1000 days