Changes between Version 40 and Version 41 of TracModWSGI

Timestamp:

Dec 14, 2011, 9:28:03 PM (12 years ago)

Author:

Dennis McRitchie <dmcr@…>

Comment:

—

TracModWSGI

@@ -284 +284 @@
 See also [trac:TracOnWindows/Advanced].
 
+=== Configuring authentication using the Account Manager plugin's !LoginModule ===
+
+To begin with, see the basic instructions for using the !LoginModule [http://trac-hacks.org/wiki/AccountManagerPlugin/Modules#LoginModule here] and [http://trac-hacks.org/wiki/AccountManagerPlugin/AuthStores here].
+
+The differences you need to be aware of when using the !LoginModule with WSGI, is that if you're using its !HttpAuthStore authentication module, then the page identified by the trac.ini ''authentication_url'' directive '''must''' be fetchable. See this example from one of the above links for hosting a single project:
+{{{
+[components]
+; be sure to enable the component
+acct_mgr.http.HttpAuthStore = enabled
+
+[account-manager]
+; configure the plugin to use a page that is secured with http authentication
+authentication_url = http://hostname/trac/authFile
+password_store = HttpAuthStore
+}}}
+This will generally be matched with an Apache config like:
+{{{
+<Location /trac/authFile>
+   …HTTP authentication configuration…
+   Require valid-user
+</Directory>
+}}}
+Note that '''authFile''' must exist, and be a file (not directory) that can be accessed via ''authentication_url''. With Trac running under WSGI, making this happen is not obvious. There are 4 ways you can do this:
+ 1. You can place a 0-length file called authFile somewhere under the Apache !DocumentRoot but outside of the Trac project. A standard ''authentication_url'' value can then be used, but this may make your project more difficult to maintain, especially if you host multiple projects and need authentication to be specific to each project.
+ 1. Put authFile in your project's htdocs directory, and change ''authentication_url'' to:
+{{{
+   authentication_url = http://hostname/trac/chrome/site/authFile
+}}}
+   This has the advantage that your Trac project need not be under Apache's !DocumentRoot, thereby making it more secure.
+ 1. Follow the directions in the [http://code.google.com/p/modwsgi/wiki/ConfigurationGuidelines WSGI Configuration Guidelines] article's "Hosting Of Static Files" section on how to exempt specific paths from being routed through WSGI. With this method, a standard ''authentication_url'' value can be used, and authFile can be placed where you like within the Trac environment. Note that if your Trac projects are not under !DocumentRoot, you will need an 'Allow all' directive within your <Location> section.
+ 1. Contrary to the recommendation in the WSGI article above, you could use the !SetHandler directive to reset the Apache content handler back to 'None' for URLs mapped to static files. This would work in a similar fashion to example 3.
 
 === Example: Apache/mod_wsgi with Basic Authentication, Trac being at the root of a virtual host