ELOG Forum

we would like to hook elog to our LDAP server. Instead of writing a full-featured LDAP auth module for elog, I have the following idea: use Apache's LDAP module to require LDAP auth for a single logbook:

<Location /elog/admin> Use PhysLDAP Use RequirePhysLDAPGroup isg RewriteEngine On RewriteCond %{LA-U:REMOTE_USER} (.+) RewriteRule . - [E=RU:%1] RequestHeader add X-Forwarded-User %{RU}e </Location>

   /* extract REMOTE_USER */

   if ((p = strstr(request, "X-Forwarded-User:")) != NULL) {

      p += 17;

      while (*p && *p == ' ')

         p++;

      strlcpy(remote_user, p, sizeof(remote_user));

      if (strchr(remote_user, '\r'))

         *strchr(remote_user, '\r') = 0;


         char sid[32];

         /* get a new session ID */

         sid_new(NULL, remote_user, (char *) inet_ntoa(rem_addr), sid);


         /* set SID cookie */

         set_sid_cookie(NULL, sid);

         // TODO: set lbs!

   }

to process_http_request in order to extract the LDAP login. I have managed to populate the author field with remote_user, but what I'd really like is to write a cookie containing this login name so that session handling kicks in. You can see that I attempt to write a cookie, but elogd segfaults at set_sid_cookie() (gdb backtrace:

set_cookie (lbs=0x0, name=0x483b22 "sid", value=0x7ffffffd7590 "4831386B7B333A99", 
global=0, expiration=0x7ffffffd7300 "")

Would anyone be willing to help me with this? I'm not at all familiar with the program flow in elogd and my C is a bit rusty...

thanks,

-Christian

Dr. Christian Herzog <herzog@phys.ethz.ch> support: +41 44 633 26 68

IT Services Group, HPT H 8 voice: +41 44 633 39 50

Department of Physics, ETH Zurich

8093 Zurich, Switzerland http://nic.phys.ethz.ch/

--- trunk/webservices/ELOG/elog-2.9.0/src/elogd.c 2011/10/20 14:36:27 3247 +++ trunk/webservices/ELOG/elog-2.9.0/src/elogd.c 2012/01/30 08:14:32 4130 @@ -37,6 +37,7 @@ char listen_interface[256]; char theme_name[80]; char http_host[256]; +char http_user[256]; char _param[MAX_PARAM][NAME_LENGTH]; char _value[MAX_PARAM][NAME_LENGTH]; @@ -8534,7 +8535,7 @@ if (old_pwd[0] || new_pwd[0]) { if (user[0]) { - if (stristr(auth, "Kerberos")) { + if (stristr(auth, "Kerberos") || stristr(auth, "Webserver")) { if (strcmp(new_pwd, new_pwd2) != 0) wrong_pwd = 2; } else { @@ -12677,6 +12679,12 @@ return 0; } + /* if we have outsourced the authentication, use external username */ + getcfg(lbs->name, "Authentication", str, sizeof(str)); + if ( stristr(str, "Webserver")) { + strncpy(user,http_user,sizeof(user)); + } + /* check for full name */ if (!isparam("new_full_name") || *getparam("new_full_name") == 0) { sprintf(str, loc("Please enter \"%s\""), loc("Full name")); @@ -13247,7 +13255,7 @@ rsprintf("<tr><td nowrap width=\"15%%\">%s:</td>\n", loc("Login name")); getcfg(lbs->name, "Authentication", auth, sizeof(auth)); - if (stristr(auth, "Kerberos")) + if (stristr(auth, "Kerberos") || stristr(auth, "Webserver")) rsprintf("<td><input type=text size=40 name=new_user_name value=\"%s\" readonly></td></tr>\n", str); else rsprintf("<td><input type=text size=40 name=new_user_name value=\"%s\"></td></tr>\n", str); @@ -13334,6 +13342,7 @@ rsprintf("<tr><td class=\"menuframe\"><span class=\"menu1\">\n"); + /* remove user-management buttons if (is_admin_user(logbook, getparam("unm")) || !getcfg(logbook, "allow password change", str, sizeof(str)) || atoi(str) == 1) rsprintf("<input type=submit name=cmd value=\"%s\">\n", loc("Change password")); @@ -13345,7 +13354,7 @@ strlcpy(str, loc("Change config file"), sizeof(str)); rsprintf("<input type=submit name=cmd value=\"%s\">\n", str); } - + */ rsprintf("</span></td></tr></table>\n\n"); show_bottom_text(lbs); rsprintf("</form></body></html>\r\n"); @@ -13579,9 +13588,9 @@ /*---- header ----*/ getcfg(lbs->name, "Authentication", str, sizeof(str)); - if (stristr(str, "Kerberos")) { + if (stristr(str, "Kerberos")|| stristr(str, "Webserver")) { show_error - ("This installation of ELOG uses site authentification\nwhere password recovery is not possible"); + ("This installation of ELOG has outsourced its authentification\nwhere password recovery is not possible"); return; } @@ -13609,6 +13618,7 @@ void show_new_user_page(LOGBOOK * lbs, char *user) { + char str[256]; /*---- header ----*/ show_html_header(lbs, TRUE, loc("ELOG new user"), TRUE, FALSE, NULL, FALSE); @@ -13644,13 +13654,14 @@ rsprintf("<tr><td nowrap>Email:</td>\n"); rsprintf("<td colspan=2><input type=text size=40 name=new_user_email></tr>\n"); + getcfg(lbs->name, "Authentication", str, sizeof(str)); + if (!stristr(str, "Kerberos") && !stristr(str, "Webserver")) { + rsprintf("<tr><td nowrap>%s:</td>\n", loc("Password")); + rsprintf("<td colspan=2><input type=password size=40 name=newpwd>\n"); - rsprintf("<tr><td nowrap>%s:</td>\n", loc("Password")); - rsprintf("<td colspan=2><input type=password size=40 name=newpwd>\n"); - - rsprintf("<tr><td nowrap>%s:</td>\n", loc("Retype password")); - rsprintf("<td colspan=2><input type=password size=40 name=newpwd2>\n"); - + rsprintf("<tr><td nowrap>%s:</td>\n", loc("Retype password")); + rsprintf("<td colspan=2><input type=password size=40 name=newpwd2>\n"); + } rsprintf("</td></tr></table>\n"); /*---- menu buttons ----*/ @@ -25391,7 +25402,12 @@ if (!enum_user_line(lbs, 0, str, sizeof(str))) { if (isparam("new_user_name")) return TRUE; - show_new_user_page(lbs, NULL); + getcfg(lbs->name, "Authentication", str, sizeof(str)); + if (stristr(str, "Webserver")) { + show_new_user_page(lbs, http_user); + } else { + show_new_user_page(lbs, NULL); + } return FALSE; } @@ -25417,7 +25433,9 @@ } } - /* if invalid or no session ID, show login page */ + /* if invalid or no session ID, show login page, + unless we have outsourced the authentication to webserver + */ if (!skip_sid_check && !sid_check(sid, user_name)) { if (isparam("redir")) strlcpy(str, getparam("redir"), sizeof(str)); @@ -26397,6 +26415,25 @@ if (lbs->n_attr < 0) return; + /* if we outsource the authentication to Webserver and have no sid, just set a new sid */ + getcfg(lbs->name, "Authentication", str, sizeof(str)); + if (stristr(str, "Webserver")) { + if (http_user[0]) { + if (!sid_check(getparam("sid"), http_user)) { /* if we don't have a sid yet, set it */ + /* get a new session ID */ + sid_new(lbs, http_user, (char *) inet_ntoa(rem_addr), sid); + /* set SID cookie */ + set_sid_cookie(lbs, sid); + } + } else { + sprintf(str, "Error: Misconfigured webserver, did not get X-Forwarded-User from it."); + show_error(str); + return; + } + } + + + /* check for new login */ if (isparam("uname") && isparam("upassword")) { /* log logins */ @@ -27650,6 +27693,17 @@ *strchr(http_host, '\r') = 0; } + /* extract X-Forwarded-User into http_user if Authentication==Webserver */ + http_user[0] = 0; + if ((p = strstr(request, "X-Forwarded-User:")) != NULL) { + p += 17; + while (*p && *p == ' ') + p++; + strlcpy(http_user, p, sizeof(http_user)); + if (strchr(http_user, '\r')) + *strchr(http_user, '\r') = 0; + } + /* extract "X-Forwarded-For:" */ if ((p = strstr(request, "X-Forwarded-For:")) != NULL) { p += 16;

diff --git a/src/elogd.c b/src/elogd.c index 601639c..0f976be 100755 --- a/src/elogd.c +++ b/src/elogd.c @@ -27975,6 +27975,11 @@ void interprete(char *lbook, char *path) if (getcfg(lbs->name, "Logout to main", str, sizeof(str)) && atoi(str) == 1) { sprintf(str, "../"); setparam("redir", str); + } else { + getcfg(lbs->name, "Logout to page", str, sizeof(str)); + if (str[0]) { + setparam("redir", str); + } } set_sid_cookie(lbs, "", ""); sid_remove(getparam("sid"));

diff --git a/doc/adminguide.html b/doc/adminguide.html index da25388..0568ae3 100755 --- a/doc/adminguide.html +++ b/doc/adminguide.html @@ -243,6 +243,37 @@ URL = http://your.proxy.host/subdir/ into elogd.cfg.<p> +<h3><hr><i>Using apache authentication:</i></h3> +It is also possible to login via an apache-auth module.
+In elogd.cfg you should use the keyword "Webserver" for Authentication: + +<ul><pre> +Authentication = Webserver +</pre></ul> +This triggers elogd to use the environment variable "X-Forwarded-User" as the logged in user.
+A simple example of a apache configuration (including the proxy) is : +<ul><pre> +# this required to pass on the generated env-variable X-Forwarded-User to the proxy +ProxyPassInterpolateEnv On + +ProxyPass /elog/ http://your.host.domain:8080/ + +<Location "/elog"> + Order allow,deny + Allow from all + AuthType Basic + AuthName "elog-server" + AuthUserFile "/opt/elog/htpasswd" + require valid-user + RequestHeader unset Authorization + RequestHeader add X-Forwarded-User %{REMOTE_USER}s + # elog doesn't like the '@', so we need to cut it + RequestHeader edit X-Forwarded-User "@(.*)$" "" +</Location> +</pre></ul> + + + <hr><a name="imagemagick"> <div class=section>  Installing ImageMagick  </div> <p> When images are attached to ELOG entries, thumbnails can be created for quick preview. This works also for PDF and PostScript files. ELOG forwards any image operation diff --git a/doc/config.html b/doc/config.html index 9848f58..9e98855 100755 --- a/doc/config.html +++ b/doc/config.html @@ -2207,6 +2207,22 @@ Options Location = Main Building{a}, New Building{b}, Old Building{c} you have to change your password by other means (such as via the Windows login if you use a Windows Domain). </p> + <p> + Beside the Kerberos authentication, elogd version 3.0 and higher can be configured to accept a authentication done + by the webserver. + <ul> + <li> + <b><code>Authentication = Webserver</code></b> + </li> + </ul> + </p> + <p> + You can also combine it with other authentication methods as shown for Kerberos. + </p> + <p> + Elogd is then accepting the username set in the Request-Header "X-Forwarded-User" as already logged in.<br/> + To make this work, you need to configure the webserver correctly, as describe in the adminguide. + </p> <p> <a name="email" id="email"></a>

diff --git a/src/elogd.c b/src/elogd.c index 601639c..de4734b 100755 --- a/src/elogd.c +++ b/src/elogd.c @@ -13142,12 +13142,13 @@ int save_user_config(LOGBOOK * lbs, char *user, BOOL new_user) /* if we outsourced the authentication, use external username */ getcfg(lbs->name, "Authentication", str, sizeof(str)); - if ( stristr(str, "Webserver")) { - strlcpy(user, http_user, sizeof(user)); - } /* do not allow HTML in user name */ - strencode2(user_enc, user, sizeof(user_enc)); + if ( stristr(str, "Webserver")) { + strencode2(user_enc, http_user, sizeof(user_enc)); + } else { + strencode2(user_enc, user, sizeof(user_enc)); + } /* check for user name */ if (!isparam("new_user_name") || *getparam("new_user_name") == 0) {

> Hi, > I have an elog server which uses apache/ldap for authentication. > I would like to have the username used for ldap to be set automatically as author field in the elog. > > I'm using: > Authentication = Webserver > and I do set the env-variable X-Forwarded-User correctly to the ldap username > > GET /test/?cmd=New HTTP/1.1 > Host: localhost:8080 > Authorization: Basic bGFjYXByYXI6TWEwMiSyYnVt > ... > Cookie: elmode=Summary; sid=D7DE678B7CAA1D10; ufnm=lacaprar; urem=0 > ... > X-Forwarded-User: lacaprar > > How can I preset author to X-Forwarded-User? > Preset Author = $?? > I've tried $short_name/$long_name but I got Anonymous. > I understand that it is so because these are meant to be filled when password authentication is used: any way to use some other variable with the Webserver auth? > > thanks in advance, > Stefano Hi, I use an older version of elog, but Preset Author = $short_name <$long_name> works for me. One thing to note is that I also have : Self register = 1 So at first login, the user has to type in his name and email adress, maybe that's why you got "Anonymous". (Otherwise the variable $shortname etc. are not set.) HTH, Christof

> > I use an older version of elog, but > > > > Preset Author = $short_name <$long_name> > > > > works for me. > > > > One thing to note is that I also have : > > Self register = 1 > > > > So at first login, the user has to type in his name and email adress, > > maybe that's why you got "Anonymous". (Otherwise the variable $shortname etc. are not set.) > > > > HTH, > > > > Christof > > Many thanks for your answer. > however it seems that your solution requires to have a eLog "password" authentication, which I'd like to avoid since I'd like to use only webserver one. > No, I'm also using the webserver authentication. May I ask why you think "password" auth is required ? The elog has an internal userdatabase with longname, shortname, email etc. Even if you are authenticated via the webserver, you also have to have an entry in that userdatabase. This entry has to be created by the user who is allowed to get into elog by the webserver. Thus, the Self register option. Bests, Christof

> > > I use an older version of elog, but > > > > > > Preset Author = $short_name <$long_name> > > > > > > works for me. > > > > > > One thing to note is that I also have : > > > Self register = 1 > > > > > > So at first login, the user has to type in his name and email adress, > > > maybe that's why you got "Anonymous". (Otherwise the variable $shortname etc. are not set.) > > > > > > HTH, > > > > > > Christof > > > > Many thanks for your answer. > > however it seems that your solution requires to have a eLog "password" authentication, which I'd like to avoid since I'd like to use only webserver one. > > > No, I'm also using the webserver authentication. > May I ask why you think "password" auth is required ? > > The elog has an internal userdatabase with longname, shortname, email etc. > Even if you are authenticated via the webserver, you also have to have an entry in that userdatabase. > This entry has to be created by the user who is allowed to get into elog by the webserver. > Thus, the Self register option. > > Bests, > > Christof Sorry, I just double-checked, this userdatabase, I was talking about is the Password-file... Please try the following snippet : allow password change = 0 Authentication = Webserver, File Preset Author = $short_name <$long_name> Locked Attributes = Author Password file = PASSWD.file Christof