######################################################################
#  Modifications to the httpd.conf file for mod_auth_radius.c
#  written by Alan DeKok <aland@freeradius.org>
#
#  Version: $Id: httpd.conf,v 1.7 2003/03/24 19:16:15 aland Exp $
#
######################################################################
#
#  These configuration options should be ADDED to the httpd.conf file
#  for your site.
#
######################################################################


######################################################################
#
# Tell Apache to load the module.
#
LoadModule radius_auth_module   libexec/mod_auth_radius.so

######################################################################
#
#  The order of the modules listed by 'AddModule' can be important.
# This seems to work for me.
#

#
# just AFTER 'AddModule mod_auth.c
# Add the module 'mod_auth_radius.c'
#
AddModule mod_auth_radius.c


######################################################################
#
# Add to the BOTTOM of httpd.conf
# If we're using mod_auth_radius, then add it's specific
# configuration options.
#
<IfModule mod_auth_radius.c>

#
# AddRadiusAuth server[:port] <shared-secret> [ timeout [ : retries ]]
#

# Use localhost, the old RADIUS port, secret 'testing123',
# time out after 5 seconds, and retry 3 times.
AddRadiusAuth localhost:1645 testing123 5:3

#
# AuthRadiusBindAddress <hostname/ip-address>
#
# Bind client (local) socket to this local IP address.
# The server will then see RADIUS client requests will come from
# the given IP address.
#
# By default, the module does not bind to any particular address,
# and the operating system chooses the address to use.
#

#
# AddRadiusCookieValid <minutes-for-which-cookie-is-valid>
#
# the special value of 0 (zero) means the cookie is valid forever.
#
AddRadiusCookieValid 5
</IfModule>

######################################################################
#
#  A sample per-directory access-control configuration.  This may
#  go into httpd.conf.  When used in an '.htaccess' file, the
#  text BETWEEN the <Location /secure/> </Location> directives
#  should go into the .htaccess file.
#
#  If you want to be sure it only applies when mod_auth_radius is used,
#  you can also wrap it in an <IfModule> directive, as above.
#
<Location /secure/>

#
# Use basic password authentication.
# AuthType Digest won't work with RADIUS authentication.
#
AuthType Basic

#
# Tell the user the realm to which they're authenticating.
# This string should be configured for your site.
#
AuthName "RADIUS authentication for localhost"

#
# don't use 'mod_auth'.
# You might want to disable other authentication types here.
# You can get a similar effect by commenting out the
# 'AddModule mod_auth_*' lines, previously in httpd.conf
#
AuthAuthoritative off

#
# Use mod_auth_radius for all authentication, and make the responses
# from it authoritative.
#
AuthRadiusAuthoritative on

#
# Make a local variation of AddRadiusCookieValid.  The server will choose
# the MINIMUM of the two values.
#
# AuthRadiusCookieValid <minutes-for-which-cookie-is-valid>
#
AuthRadiusCookieValid 5

#
# Set the use of RADIUS authentication at this <Location>"
#
# Globally set the RADIUS authentication active.
#
#
# If there is a directory which you do NOT want to have RADIUS
# authentication for, then use a <Directory> or <Location> directive,
# and set "AuthRadiusActive Off".  The default is "On".
#
AuthRadiusActive On

#
# require that mod_auth_radius return a valid user, otherwise
# access is denied.
#
require valid-user

#
# end of the per-location directives
#
</Location>