Re: Shibboleth authentication for Roundup

Yes, the config.ini has the http_auth = yes.

The problem is most certainly in the Apache configuration.  I am using the
Apache and mod_python configuration from Roundup documentation
<http://roundup.sourceforge.net/docs/installation.html#configure-a-web-interface>.
>From the documentation it looks like the Apache and mod_python is the only
option for HTTPS connection which is required for Shibboleth.

I consulted the Shibboleth mailing list and learned that the Shibboleth.sso
is a virtual resource and therefore cannot be excluded using the AliasMatch
rules as those require a pointer to a filesystem resource.  One suggestion
was to write the AliasMatch rules in such a way that would prevent the
Shibboleth.sso from being caught in the first place.  I haven't found a way
to do this yet and would gladly accept suggestions :-).

Thanks!





On Fri, Feb 24, 2017 at 3:46 AM, Ralf Schlatterbeck <[email protected]> wrote:

> On Thu, Feb 23, 2017 at 12:52:49PM -0600, Tonu Mikk wrote:
> > Yes.  I should have mentioned that when I access the URL for the
> tracker, I
> > am presented with the Shibboleth login window.  I successfully
> authenticate
> > and then get the error from Roundup.
>
> Have you set
> http_auth = yes
> in the section [web]
> in config.ini in your tracker directory?
>
> From the documentation of that option:
> # Whether to use HTTP Basic Authentication, if present.
> # Roundup will use either the REMOTE_USER or HTTP_AUTHORIZATION
> # variables supplied by your web server (in that order).
> # Set this option to 'no' if you do not wish to use HTTP Basic
> # Authentication in your web interface.
> # Allowed values: yes, no
> # Default: yes
>
> If it still doesn't work it almost certainly is a problem of your
> browser configuration not roundup.
> I'm using that option in several production systems with Kerberos
> authentication.
>
> Looking at the error message it looks like the shibboleth mechanism
> is trying to find Shibboleth.sso.
> Now roundup by default ships files with the path prefix
> @@file/
>
> So you probably need some additional apache magic to ship
> /Shibboleth.sso directly via apache not via roundup or talk
> apache into shipping @@file/Shibboleth.sso and put that file
> into the html directory of your tracker.
>
>
> Ralf
>
> >
> > On Thu, Feb 23, 2017 at 12:31 PM, Tom Ekberg <[email protected]> wrote:
> >
> > > Tonu,
> > >
> > > Not sure this will help, but did you enable the shib2 apache module?
> > >
> > > Tom Ekberg
> > > Senior Computer Specialist, Lab Medicine
> > > University of Washington Medical Center
> > > 1959 NE Pacific St, MS 357110
> > > Seattle WA 98195
> > > work: (206) 598-8544
> > > email: [email protected]
> > >
> > > On Thu, 23 Feb 2017, Tonu Mikk wrote:
> > >
> > > Date: Thu, 23 Feb 2017 10:37:25 -0600
> > >> From: Tonu Mikk <[email protected]>
> > >> To: [email protected]
> > >> Subject: [Roundup-users] Shibboleth authentication for Roundup
> > >>
> > >>
> > >> Hello,
> > >> I am interested in using Shibboleth authentication for Roundup Issue
> > >> Tracker.  One of the attributes returned by Shibboleth is
> REMOTE_USER.  I
> > >> was hoping that I would
> > >> be able to use the REMOTE_USER by Roundup Issue tracker and have the
> user
> > >> log in upon successful Shibboleth authentication as long as their
> > >> REMOTE_USER value matches
> > >> the username in the tracker. This doesn't seem to work.  I enabled
> Python
> > >> Debug in the Virtual config to see where the error appears and I
> include it
> > >> below.
> > >>
> > >> I tried the virtual host file in two ways - using the line
> "RequestHeader
> > >> set REMOTE-USER %{REMOTE_USER}s" and without it. And in both cases the
> > >> Python debug presents
> > >> the same error:
> > >>
> > >>   File "/usr/lib/python2.6/site-packages/roundup/cgi/client.py", line
> > >> 538, in inner_main
> > >>     raise NotFound(e)
> > >>
> > >> NotFound: Shibboleth.sso
> > >>
> > >> Looking for advice on how to proceed.  Thank you!
> > >>
> > >> I have configured the tracker using Apache and mod-python with the
> > >> following virtual host configuration:
> > >>
> > >> <VirtualHost xxx.xxx.xxx.xxx:443>
> > >>         ServerName      mydomain.com
> > >>         ServerAdmin     [email protected]
> > >>
> > >>         AliasMatch ^/@@file(.*) /swadm/roundup/trackers/wcag/html$1
> > >>         AliasMatch ^/(?!@@file)(.*) /swadm/roundup/trackers/wcag/
> html/
> > >> dummy.py/$1
> > >>
> > >>         DocumentRoot    /swadm/roundup/trackers/wcag/html
> > >>
> > >>         <Directory      /swadm/roundup/trackers/wcag/html>
> > >>                 # Default allow policy
> > >>                 Order Deny,Allow
> > >>         AuthType shibboleth
> > >>         ShibRequestSetting requireSession 1
> > >>         Require valid-user
> > >>         RequestHeader set REMOTE-USER %{REMOTE_USER}s
> > >>
> > >>         </Directory>
> > >>
> > >>         AddHandler      python-program .py
> > >>         PythonOptimize  On
> > >>         PythonPath      "sys.path + ['/usr/lib64/python2.6/site-pa
> > >> ckages']"
> > >>         PythonHandler   roundup.cgi.apache
> > >>         PythonOption    TrackerHome     /swadm/roundup/trackers/wcag
> > >>         PythonDebug On
> > >>
> > >>       # SSL information omitted for brevity.
> > >> </VirtualHost>
> > >>
> > >> Python Debug:
> > >>
> > >> MOD_PYTHON ERROR
> > >>
> > >> ProcessId:      23377
> > >> Interpreter:    'mydomain.com'
> > >>
> > >> ServerName:     'mydomain.com'
> > >> DocumentRoot:   '/swadm/roundup/trackers/wcag/html'
> > >>
> > >> URI:            '/Shibboleth.sso/SAML2/POST'
> > >> Location:       None
> > >> Directory:      None
> > >> Filename:       '/swadm/roundup/trackers/wcag/html/dummy.py'
> > >> PathInfo:       '/Shibboleth.sso/SAML2/POST'
> > >>
> > >> Phase:          'PythonHandler'
> > >> Handler:        'roundup.cgi.apache'
> > >>
> > >> Traceback (most recent call last):
> > >>
> > >>   File "/usr/lib64/python2.6/site-packages/mod_python/importer.py",
> line
> > >> 1540, in HandlerDispatch
> > >>     default=default_handler, arg=req, silent=hlist.silent)
> > >>
> > >>   File "/usr/lib64/python2.6/site-packages/mod_python/importer.py",
> line
> > >> 1232, in _process_target
> > >>     result = _execute_target(config, req, object, arg)
> > >>
> > >>   File "/usr/lib64/python2.6/site-packages/mod_python/importer.py",
> line
> > >> 1131, in _execute_target
> > >>     result = object(arg)
> > >>
> > >>   File "/usr/lib/python2.6/site-packages/roundup/cgi/apache.py", line
> > >> 135, in handler
> > >>     _client.main()
> > >>
> > >>   File "/usr/lib/python2.6/site-packages/roundup/cgi/client.py", line
> > >> 367, in main
> > >>     self.inner_main()
> > >>
> > >>   File "/usr/lib/python2.6/site-packages/roundup/cgi/client.py", line
> > >> 538, in inner_main
> > >>     raise NotFound(e)
> > >>
> > >> NotFound: Shibboleth.sso
> > >>
> > >> --
> > >> Tonu Mikk
> > >> Adaptive Technologist | Disability Resource Center |
> > >> diversity.umn.edu/disability
> > >> University of Minnesota | umn.edu
> > >> [email protected] | 612-625-3307
> > >>
> > >>
> > >>
> >
> >
> > --
> > Tonu Mikk
> > Adaptive Technologist | Disability Resource Center |
> > diversity.umn.edu/disability
> > University of Minnesota | umn.edu
> > [email protected] | 612-625-3307
>
> > ------------------------------------------------------------
> ------------------
> > Check out the vibrant tech community on one of the world's most
> > engaging tech sites, SlashDot.org! http://sdm.link/slashdot
>
> > _______________________________________________
> > Roundup-users mailing list
> > [email protected]
> > https://lists.sourceforge.net/lists/listinfo/roundup-users
>
>
> --
> Dr. Ralf Schlatterbeck                  Tel:   +43/2243/26465-16
> Open Source Consulting                  www:   http://www.runtux.com
> Reichergasse 131, A-3411 Weidling       email: [email protected]
>



-- 
Tonu Mikk
Adaptive Technologist | Disability Resource Center |
diversity.umn.edu/disability
University of Minnesota | umn.edu
[email protected] | 612-625-3307

------------------------------------------------------------------------------
Announcing the Oxford Dictionaries API! The API offers world-renowned
dictionary content that is easy and intuitive to access. Sign up for an
account today to start using our lexical data to power your apps and
projects. Get started today and enter our developer competition.
http://sdm.link/oxford

_______________________________________________
Roundup-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/roundup-users