Re: Shibboleth authentication for Roundup

On Thu, Feb 23, 2017 at 12:52:49PM -0600, Tonu Mikk wrote:
> Yes.  I should have mentioned that when I access the URL for the tracker, I
> am presented with the Shibboleth login window.  I successfully authenticate
> and then get the error from Roundup.

Have you set
http_auth = yes
in the section [web]
in config.ini in your tracker directory?

>From the documentation of that option:
# Whether to use HTTP Basic Authentication, if present.
# Roundup will use either the REMOTE_USER or HTTP_AUTHORIZATION
# variables supplied by your web server (in that order).
# Set this option to 'no' if you do not wish to use HTTP Basic
# Authentication in your web interface.
# Allowed values: yes, no
# Default: yes

If it still doesn't work it almost certainly is a problem of your
browser configuration not roundup.
I'm using that option in several production systems with Kerberos
authentication.

Looking at the error message it looks like the shibboleth mechanism
is trying to find Shibboleth.sso.
Now roundup by default ships files with the path prefix
@@file/

So you probably need some additional apache magic to ship
/Shibboleth.sso directly via apache not via roundup or talk
apache into shipping @@file/Shibboleth.sso and put that file
into the html directory of your tracker.


Ralf

> 
> On Thu, Feb 23, 2017 at 12:31 PM, Tom Ekberg <[email protected]> wrote:
> 
> > Tonu,
> >
> > Not sure this will help, but did you enable the shib2 apache module?
> >
> > Tom Ekberg
> > Senior Computer Specialist, Lab Medicine
> > University of Washington Medical Center
> > 1959 NE Pacific St, MS 357110
> > Seattle WA 98195
> > work: (206) 598-8544
> > email: [email protected]
> >
> > On Thu, 23 Feb 2017, Tonu Mikk wrote:
> >
> > Date: Thu, 23 Feb 2017 10:37:25 -0600
> >> From: Tonu Mikk <[email protected]>
> >> To: [email protected]
> >> Subject: [Roundup-users] Shibboleth authentication for Roundup
> >>
> >>
> >> Hello,
> >> I am interested in using Shibboleth authentication for Roundup Issue
> >> Tracker.  One of the attributes returned by Shibboleth is REMOTE_USER.  I
> >> was hoping that I would
> >> be able to use the REMOTE_USER by Roundup Issue tracker and have the user
> >> log in upon successful Shibboleth authentication as long as their
> >> REMOTE_USER value matches
> >> the username in the tracker. This doesn't seem to work.  I enabled Python
> >> Debug in the Virtual config to see where the error appears and I include it
> >> below.
> >>
> >> I tried the virtual host file in two ways - using the line "RequestHeader
> >> set REMOTE-USER %{REMOTE_USER}s" and without it. And in both cases the
> >> Python debug presents
> >> the same error:
> >>
> >>   File "/usr/lib/python2.6/site-packages/roundup/cgi/client.py", line
> >> 538, in inner_main
> >>     raise NotFound(e)
> >>
> >> NotFound: Shibboleth.sso
> >>
> >> Looking for advice on how to proceed.  Thank you!
> >>
> >> I have configured the tracker using Apache and mod-python with the
> >> following virtual host configuration:
> >>
> >> <VirtualHost xxx.xxx.xxx.xxx:443>
> >>         ServerName      mydomain.com
> >>         ServerAdmin     [email protected]
> >>
> >>         AliasMatch ^/@@file(.*) /swadm/roundup/trackers/wcag/html$1
> >>         AliasMatch ^/(?!@@file)(.*) /swadm/roundup/trackers/wcag/html/
> >> dummy.py/$1
> >>
> >>         DocumentRoot    /swadm/roundup/trackers/wcag/html
> >>
> >>         <Directory      /swadm/roundup/trackers/wcag/html>
> >>                 # Default allow policy
> >>                 Order Deny,Allow
> >>         AuthType shibboleth
> >>         ShibRequestSetting requireSession 1
> >>         Require valid-user
> >>         RequestHeader set REMOTE-USER %{REMOTE_USER}s
> >>
> >>         </Directory>
> >>
> >>         AddHandler      python-program .py
> >>         PythonOptimize  On
> >>         PythonPath      "sys.path + ['/usr/lib64/python2.6/site-pa
> >> ckages']"
> >>         PythonHandler   roundup.cgi.apache
> >>         PythonOption    TrackerHome     /swadm/roundup/trackers/wcag
> >>         PythonDebug On
> >>
> >>       # SSL information omitted for brevity.
> >> </VirtualHost>
> >>
> >> Python Debug:
> >>
> >> MOD_PYTHON ERROR
> >>
> >> ProcessId:      23377
> >> Interpreter:    'mydomain.com'
> >>
> >> ServerName:     'mydomain.com'
> >> DocumentRoot:   '/swadm/roundup/trackers/wcag/html'
> >>
> >> URI:            '/Shibboleth.sso/SAML2/POST'
> >> Location:       None
> >> Directory:      None
> >> Filename:       '/swadm/roundup/trackers/wcag/html/dummy.py'
> >> PathInfo:       '/Shibboleth.sso/SAML2/POST'
> >>
> >> Phase:          'PythonHandler'
> >> Handler:        'roundup.cgi.apache'
> >>
> >> Traceback (most recent call last):
> >>
> >>   File "/usr/lib64/python2.6/site-packages/mod_python/importer.py", line
> >> 1540, in HandlerDispatch
> >>     default=default_handler, arg=req, silent=hlist.silent)
> >>
> >>   File "/usr/lib64/python2.6/site-packages/mod_python/importer.py", line
> >> 1232, in _process_target
> >>     result = _execute_target(config, req, object, arg)
> >>
> >>   File "/usr/lib64/python2.6/site-packages/mod_python/importer.py", line
> >> 1131, in _execute_target
> >>     result = object(arg)
> >>
> >>   File "/usr/lib/python2.6/site-packages/roundup/cgi/apache.py", line
> >> 135, in handler
> >>     _client.main()
> >>
> >>   File "/usr/lib/python2.6/site-packages/roundup/cgi/client.py", line
> >> 367, in main
> >>     self.inner_main()
> >>
> >>   File "/usr/lib/python2.6/site-packages/roundup/cgi/client.py", line
> >> 538, in inner_main
> >>     raise NotFound(e)
> >>
> >> NotFound: Shibboleth.sso
> >>
> >> --
> >> Tonu Mikk
> >> Adaptive Technologist | Disability Resource Center |
> >> diversity.umn.edu/disability
> >> University of Minnesota | umn.edu
> >> [email protected] | 612-625-3307
> >>
> >>
> >>
> 
> 
> -- 
> Tonu Mikk
> Adaptive Technologist | Disability Resource Center |
> diversity.umn.edu/disability
> University of Minnesota | umn.edu
> [email protected] | 612-625-3307

> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, SlashDot.org! http://sdm.link/slashdot

> _______________________________________________
> Roundup-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/roundup-users


-- 
Dr. Ralf Schlatterbeck                  Tel:   +43/2243/26465-16
Open Source Consulting                  www:   http://www.runtux.com
Reichergasse 131, A-3411 Weidling       email: [email protected]

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot