Changes between Version 333 and Version 334 of TracInstall

Timestamp:

Feb 27, 2011, 2:01:23 PM (13 years ago)

Author:

Christian Boos

Comment:

Moved TracCgi@50#AddingAuthentication to #ConfiguringAuthentication

TracInstall

@@ -292 +292 @@
 == Configuring Authentication ==
 
-The process of adding, removing, and configuring user accounts for authentication depends on the specific way you run Trac. The basic procedure is described in the [wiki:TracCgi#AddingAuthentication "Adding Authentication"] section on the TracCgi page. To learn how to setup authentication for the frontend you're using, please refer to one of the following pages:
+Trac uses HTTP authentication. You'll need to configure your webserver to request authentication when the `.../login` URL is hit (the virtual path of the "login" button). Trac will automatically pick the REMOTE_USER variable up after you provide your credentials. Therefore, all user management goes through your web server configuration. Please consult the documentation of your web server for more info.
+
+The process of adding, removing, and configuring user accounts for authentication depends on the specific way you run Trac. 
+
+
+We'll describe here the most common scenario.
+
+
+=== Example: Basic Authentication with Apache ===
+
+The simplest way to enable authentication with Apache is to create a password file. Use the `htpasswd` program to create the password file:
+{{{
+$ htpasswd -c /somewhere/trac.htpasswd admin
+New password: <type password>
+Re-type new password: <type password again>
+Adding password for user admin
+}}}
+
+After the first user, you dont need the "-c" option anymore:
+{{{
+$ htpasswd /somewhere/trac.htpasswd john
+New password: <type password>
+Re-type new password: <type password again>
+Adding password for user john
+}}}
+
+  ''See the man page for `htpasswd` for full documentation.''
+
+After you've created the users, you can set their permissions using TracPermissions.
+
+Now, you'll need to enable authentication against the password file in the Apache configuration:
+{{{
+<Location "/trac/login">
+  AuthType Basic
+  AuthName "Trac"
+  AuthUserFile /somewhere/trac.htpasswd
+  Require valid-user
+</Location>
+}}}
+
+If you're hosting multiple projects you can use the same password file for all of them:
+{{{
+<LocationMatch "/trac/[^/]+/login">
+  AuthType Basic
+  AuthName "Trac"
+  AuthUserFile /somewhere/trac.htpasswd
+  Require valid-user
+</LocationMatch>
+}}}
+
+=== Example: Digest Authentication with Apache ===
+
+For better security, it is recommended that you either enable SSL or at least use the “digest” authentication scheme instead of “Basic”. Please read the [http://httpd.apache.org/docs/2.0/ Apache HTTPD documentation] to find out more. For example, on a Debian 4.0r1 (etch) system the relevant section  in apache configuration can look like this:
+{{{
+<Location "/trac/login">
+    LoadModule auth_digest_module /usr/lib/apache2/modules/mod_auth_digest.so
+    AuthType Digest
+    AuthName "trac"
+    AuthDigestDomain /trac
+    AuthUserFile /somewhere/trac.htpasswd
+    Require valid-user
+</Location>
+}}}
+and you'll have to create your .htpasswd file with htdigest instead of htpasswd as follows:
+{{{
+# htdigest /somewhere/trac.htpasswd trac admin
+}}}
+where the "trac" parameter above is the same as !AuthName above  ("Realm" in apache-docs). 
+
+
+=== More authentication scenarios
+
+To learn more how to setup authentication for the frontend you're using, please refer to one of the following pages:
 
  * TracStandalone if you use the standalone server, `tracd`.
- * TracCgi if you use the CGI or FastCGI web front ends.
  * [wiki:TracModWSGI] if you use the Apache mod_wsgi web front end.
  * TracModPython if you use the Apache mod_python web front end.
 
 
-== Automatic reference to the SVN changesets in Trac tickets ==
+== Finishing the install
+
+=== Automatic reference to the SVN changesets in Trac tickets ===
 
 You can configure SVN to automatically add a reference to the changeset into the ticket comments, whenever changes are committed to the repository. The description of the commit needs to contain one of the following formulas:
@@ -312 +385 @@
 For more information, see the documentation of the `CommitTicketUpdater` component in the "Plugins" admin panel.
 
-== Using Trac ==
+=== Using Trac ===
 
 Once you have your Trac site up and running, you should be able to create tickets, view the timeline, browse your version control repository if configured, etc.
 
-Keep in mind that anonymous (not logged in) users can by default access most but not all of the features. You will need to configure authentication and grant additional [wiki:TracPermissions permissions] to authenticated users to see the full set of features.
+Keep in mind that //anonymous// (not logged in) users can by default access only a few of the features, in particular they will have a read-only access to the resources. You will need to configure authentication and grant additional [wiki:TracPermissions permissions] to authenticated users to see the full set of features.
 
 '' Enjoy! ''