Changes between Version 89 and Version 90 of TracStandalone

Timestamp:

Aug 8, 2011, 3:21:52 PM (13 years ago)

Author:

lkraav <leho@…>

Comment:

instructions how to provide external authentication to tracd instances with REMOTE_USER, apache mod_proxy example

TracStandalone

@@ -262 +262 @@
 See also [trac:TracOnWindowsIisAjp], [trac:TracNginxRecipe].
 
+=== Authentication for tracd behind a proxy
+It is convenient to provide central external authentication to your tracd instances, instead of using {{{--basic-auth}}}. There is some discussion about this in #9206.
+
+Below is example configuration based on Apache 2.2, mod_proxy, mod_authnz_ldap.
+
+First we bring tracd into Apache's location namespace.
+
+{{{
+<Location /project/proxified>
+        Require ldap-group cn=somegroup, ou=Groups,dc=domain.com
+        Require ldap-user somespecificusertoo
+        ProxyPass http://localhost:8101/project/proxified/
+        # Turns out we don't really need complicated RewriteRules here at all
+        RequestHeader set REMOTE_USER %{REMOTE_USER}s
+</Location>
+}}}
+
+Then we need a single file plugin to recognize HTTP_REMOTE_USER header as valid authentication source. HTTP headers like '''HTTP_FOO_BAR''' will get converted to '''Foo-Bar''' during processing. Name it something like '''remote-user-auth.py''' and drop it into '''proxified/plugins''' directory:
+{{{
+#!python
+from trac.core import *
+from trac.config import BoolOption
+from trac.web.api import IAuthenticator
+
+class MyRemoteUserAuthenticator(Component):
+
+    implements(IAuthenticator)
+
+    obey_remote_user_header = BoolOption('trac', 'obey_remote_user_header', 'false', 
+               """Whether the 'Remote-User:' HTTP header is to be trusted for user logins 
+                (''since ??.??').""") 
+
+    def authenticate(self, req):
+        if self.obey_remote_user_header and req.get_header('Remote-User'): 
+            return req.get_header('Remote-User') 
+        return None
+
+}}}
+
+Add this new parameter to your TracIni:
+{{{
+...
+[trac]
+...
+obey_remote_user_header = true
+...
+}}}
+
+Run tracd:
+{{{
+tracd -p 8101 -r -s proxified --base-path=/project/proxified
+}}}
+
 === Serving a different base path than / ===
 Tracd supports serving projects with different base urls than /<project>. The parameter name to change this is