mod_auth_mellon

mod_auth_mellon
Name	mod_auth_mellon
Developer	Mellon Project
Released	2010s
Operating system	Apache HTTP Server on Unix-like systems
License	Apache License 2.0

mod_auth_mellon is an Apache HTTP Server module that provides SAML 2.0 Service Provider functionality for web applications, enabling single sign-on and federated authentication. It integrates SAML assertions from Identity Providers to manage access to protected resources and can work with existing session management, proxying, and reverse proxy setups. The module is commonly used in conjunction with enterprise identity systems and higher education federations to bridge web servers and federated identity providers.

Overview

mod_auth_mellon connects Apache HTTP Server with SAML 2.0 Identity Providers such as Shibboleth, Okta, Microsoft Azure Active Directory, Google Workspace, and OneLogin, and is often deployed alongside reverse proxies like HAProxy, NGINX, and load balancers from F5 Networks. Institutions such as Internet2, EDUCAUSE, University of Michigan, and University of Oxford use federated SSO solutions that can include mod_auth_mellon to authenticate users from identity federations like InCommon, UK Access Management Federation, and eduGAIN. The module interoperates with directory services including Microsoft Active Directory, OpenLDAP, and identity frameworks like SAML 2.0, OAuth 2.0, and OpenID Connect gateways.

Features

mod_auth_mellon implements SAML 2.0 Service Provider features such as assertion consumer service handling, artifact binding, and single logout, aligning with specifications from the OASIS Technical Committee and interoperating with implementations like Shibboleth Service Provider and cloud providers such as Amazon Web Services and Google Cloud Platform. It supports attribute mapping to HTTP headers for downstream applications like Moodle, WordPress, Jenkins, GitLab, and Confluence, and can integrate with session stores used by Redis, Memcached, or Apache modules. The module also offers cryptographic support compatible with libraries such as OpenSSL and key management approaches used by Let's Encrypt and enterprise certificate authorities like DigiCert.

Architecture and Components

The architecture comprises an Apache module that handles SAML protocol messages, XML signature verification, and session management, relying on XML processing libraries and TLS stacks such as OpenSSL and system components like mod_ssl and mod_proxy. Core components include metadata handling similar to Shibboleth Metadata, keypair and certificate management akin to practices used by Certificate Transparency, and integration points for attribute release policies used by federations like InCommon. Deployments often interact with identity providers including CILogon, GLUU Server, Ping Identity, and ForgeRock, and are designed to coexist with service registries, DNS providers like Cloudflare, and logging stacks such as ELK Stack.

Configuration

Configuration of mod_auth_mellon uses Apache directives placed in virtual host or directory contexts and involves generating Service Provider metadata, private keys, and SAML metadata exchange with Identity Providers such as Shibboleth, Okta, and Azure AD. Administrators follow practices established by organizations like NIST for cryptographic configuration and by academic federations like Internet2 for metadata exchange. Typical configuration tasks mirror procedures used in systems like Shibboleth, SimpleSAMLphp, and Keycloak for certificate rotation, attribute mapping, and logout handling, and are often automated with orchestration tools such as Ansible, Puppet, or Chef.

Authentication Flow

A typical authentication flow begins when a user attempts to access a protected resource served by Apache, triggering a SAML AuthnRequest to an Identity Provider like Azure AD, Google Workspace, or Okta; the Identity Provider authenticates the user using methods such as SAML 2.0, Kerberos, or multi-factor authentication provided by vendors like Duo Security or Yubico. The Identity Provider returns a SAML Response with assertions and attributes, which mod_auth_mellon validates by checking XML signatures and metadata that follow standards endorsed by OASIS and IETF working groups. After successful validation mod_auth_mellon sets attributes as HTTP headers or environment variables consumed by downstream applications such as Moodle, Jenkins, or GitLab.

Security Considerations

Security considerations include robust XML signature validation, protection against replay attacks, strict TLS configuration consistent with NIST guidelines, and careful handling of attribute release to prevent overexposure of identity attributes to applications like WordPress or Confluence. Administrators should manage private keys and metadata updates following best practices adopted by Let's Encrypt, DigiCert, and enterprise PKI operators, and monitor logs with observability tools such as Splunk or ELK Stack. Interoperability testing with Identity Providers like Shibboleth, Ping Identity, and Okta helps surface edge cases in algorithm negotiation or time skew that can affect assertion validation.

Deployment and Integration

Common deployment patterns include integrating mod_auth_mellon with reverse proxies such as HAProxy and NGINX in front of application servers like Tomcat, Apache Tomcat, Node.js, and Gunicorn, or embedding it directly in Apache virtual hosts serving CMS platforms like Drupal or WordPress. Enterprises often pair mod_auth_mellon with identity federation options provided by InCommon, eduGAIN, or commercial providers such as Okta and Ping Identity, and automate configuration and certificate management using tools like Ansible and Certbot. Scaling considerations mirror those for large web platforms operated by organizations such as GitHub, GitLab Inc., and cloud providers like Amazon Web Services and Google Cloud Platform.

Category:Apache modules