[Request] Add spnego-http-auth-nginx module to enable SSO AD authentication

[Mant1kor]

To enable SSO Active Directory authentication(without entering login/password), nginx must be compile with spnego-http-auth-nginx module.

[zulipbot]

Hello @zulip/server-authentication members, this issue was labeled with the "area: authentication" label, so you may want to check it out!

[timabbott]

@Mant1kor we currently rely on the version of nginx included with your OS. You're welcome to replace it with an nginx you compile locally. Given that we don't ship nginx at all, this is not something we can fix directly.

I tracked down the current status of Ubuntu providing a package one can install here:

• get spnego module part of an existing binary distribution stnoonan/spnego-http-auth-nginx-module#54
• https://bugs.launchpad.net/nginx/+bug/1486532
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=796094

Which doesn't seem like it's likely to be fixed on any bounded timeline.

Your best option is probably to have Apache do the auth for your Zulip server (I think Apache has better support for SPNEGO auth). You can follow these instructions to have Apache handle the authentication requests for Zulip: https://zulip.readthedocs.io/en/latest/production/authentication-methods.html#apache-based-sso-with-remote-user, and then configure SPNEGO auth in Apache.

(If that works out for you, we can resolve this issue by covering how to do this in the documentation)

[Mant1kor]

I tried to compile nginx with this module, but it failed with error in another module.
OK, i'll try to use Apache.

[Mant1kor]

Seems like I stuck on converting nginx to apache config files.

[timabbott]

@Mant1kor can you explain why you're trying to convert nginx to apache config files? That shouldn't be required.

(As a sidenote, if you want hands-on support with integrating Zulip in your environment, you can consider getting a support contract)

[Mant1kor]

Emm... I'm trying to convert nginx to apache config files to use Apache SSO login over mod_auth_kerb. I'm almost done, configure Apache is the last step.
Or am I doing something wrong? @timabbott