You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Jon Hadley <jo...@gmail.com> on 2010/09/15 00:39:06 UTC
[users@httpd] LDAP authentication behind proxy?
In the following, the service on 8002 is a theming proxy, which also proxies the trac service on 8202 (among other things). All public requests come via 8022 (a testing port, that would usually be 80)
The problem is, LDAP authentication (fairly obviously) only works when accessing the trac site via the latter port 8202, not via 8002, or indeed 8022.
Is there *any* way of configuring apache so it works on the other port too?
More background here: http://serverfault.com/questions/180845/
<VirtualHost foo.bar.com:8022>
ServerName foo.bar.com
ServerAlias foo.bar.com
ProxyRequests Off
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
ProxyPreserveHost On
RewriteEngine On
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule ^/(.*) http://0.0.0.0:8002/$1 [P]
</VirtualHost>
WSGIDaemonProcess trac stack-size=524288 python-path=/usr/lib/python2.5/site-packages
WSGIScriptAlias /trac /home/web/foo/parts/trac/tracwsgi/cgi-bin/trac.wsgi
WSGIProcessGroup trac
WSGIApplicationGroup %{GLOBAL}
<VirtualHost foo.bar.com:8202>
ServerName foo.bar.com
ServerAlias foo.bar.com
<Directory "/home/web/foo/parts/trac/tracwsgi/cgi-bin">
Options +Indexes FollowSymLinks
AllowOverride None
Allow from all
Order allow,deny
</Directory>
<Location "/trac">
AuthBasicProvider ldap
AuthType Basic
AuthzLDAPAuthoritative off
AuthName "Login"
AuthLDAPURL "ldap://127.0.0.1:389/dc=foo-bar,dc=org?uid"
AuthLDAPBindDN "cn=admin, dc=foo-bar, dc=org"
AuthLDAPBindPassword secretword
require valid-user
</Location>
</VirtualHost>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] LDAP authentication behind proxy?
Posted by Jon Hadley <jo...@gmail.com>.
On 15 Sep 2010, at 02:52, Eric Covener wrote:
> You defined your trac wsgi stuff outside of the vhosts and the LDAP
> authentication only in one vhost.
Yes, I seemed to get a 'WSGIDaemonProcess' syntax error if the trac wsgi stuff was inside the second vhost
> I'm guessing the "themeing proxy" is actually accessing a backend
> ip:port other than the one associated with the vhost with
> authentication configured.
It is. There is a Plone CMS system that serves on 8282, which the theming proxy (collective.xdv) accesses. It deals with LDAP authentication without Apache.
I have tried moving the LDAP authentication within the first vhost, in the theory that the path name would be challenged there too. It is and authenticates successfully with the LDAP server, but doesn't get passed successfully to Trac's authentication system.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] LDAP authentication behind proxy?
Posted by Eric Covener <co...@gmail.com>.
On Tue, Sep 14, 2010 at 6:39 PM, Jon Hadley <jo...@gmail.com> wrote:
> In the following, the service on 8002 is a theming proxy, which also proxies the trac service on 8202 (among other things). All public requests come via 8022 (a testing port, that would usually be 80)
>
> The problem is, LDAP authentication (fairly obviously) only works when accessing the trac site via the latter port 8202, not via 8002, or indeed 8022.
>
> Is there *any* way of configuring apache so it works on the other port too?
You defined your trac wsgi stuff outside of the vhosts and the LDAP
authentication only in one vhost.
I'm guessing the "themeing proxy" is actually accessing a backend
ip:port other than the one associated with the vhost with
authentication configured.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org