The document describes the Odin Authenticator, a cookie-based single sign-on system for Apache, aimed at simplifying authentication across multiple web applications. It outlines the shortcomings of existing solutions like HTTP auth, LDAP, and OpenID, and presents Odin as a more user-friendly and efficient alternative. The author provides setup instructions, configuration details, and future enhancements for the system.

2. Odin Authenticator
A cookie-based single sign-on system for Apache

3. Act I
The Sad Situation

4. You are in a maze of twisty
little webapps, all alike.
• Munin • Rundeck
• Icinga • Logstash
• Resque-Web • Graphite
• Jenkins • …
Multiple servers, same users

5. How to authenticate?
• HTTP auth? – Awful UX & UI. Syncing
passwords is tricky.
• LDAP? – No. Just no.
• OpenID? – Dependency on a new third
party, frequent callbacks, slow, inconvenient.
• FreeIPA? – Overkill.

6. GodAuth
• https://github.com/exflickr/GodAuth
• A mod_perl module shared by Flickr
• Shared cookie, HMAC-signed with a shared
secret
• Clunky, manual installation & setup
• Badly needed a rewrite

7. Act II
Light in the tunnel

8. Odin Authenticator
The badly needed rewrite of GodAuth
http://ginzamarkets.github.com/odin_authenticator/

9. General setup
• Individual services under single domain
(something.i.yourdomain.com)
• Domain root (i.yourdomain.com) serves
the authenticator, which sets the cookie

10. OdinAuth
• ginzamarkets/Apache2-Authen-OdinAuth
on GitHub
• Apache2::Authen::OdinAuth on CPAN
• Apache 2 mod_perl handler
• Sane(r) config in YAML
• Automated installation

11. OdinAuth
1. cpan install Apache2::Authen::OdinAuth
2. PerlSetVar odinauth_config
/path/to/odin_auth.yml
3. PerlFixupHandler Apache2::Authen::OdinAuth
4. Copy and edit odin_auth.yml config file

12. Odin Authorizer App
• ginzamarkets/App-OdinAuthorizer
on GitHub
• Perl Dancer webapp that calls out to
Google Apps for Domains to authenticate
and sets the signed cookie if successful
• Simple & basic – no user roles, single
configured valid domain

13. Odin Authorizer App
1. hub clone
ginzamarkets/App-OdinAuthorizer
2. perl Build.pl
./Build installdeps
3. ./bin/app.pl
Use Apache, mod_perl, and http://plackperl.org/
for real deployment

14. DEMO TIME

15. Act III
The Bright Future

16. • Move Apache handler config into httpd.conf
• Make authorizer webapp more flexible
• Different sources of identity
• Multi-factor authentication
• RBAC
• More eyeballs on the crypto stuff

17. Have fun!
http://ginzamarkets.github.com/odin_authenticator/