ELOG Forum

Hej, I just noted that when having an unknown (or presumably misspelled) user name in the "Admin user" line in the config file, that the other users are no longer treated as admins and do not see the corresponding link to the admin page e.g. on the list page. In my specific situation, I in fact have only one user registered (new password file) but two users still on the admin list (old config file). The one user is only treated as admin after removing the offending name from the list of admins. I understand that this might be the intended behavior -- but I wonder if this could lead to a situation where one locks oneself out, e.g. when adding a misspelled user name to the list. Thanks and cheers, Hanno

we would like to hook elog to our LDAP server. Instead of writing a full-featured LDAP auth module for elog, I have the following idea: use Apache's LDAP module to require LDAP auth for a single logbook:

<Location /elog/admin> Use PhysLDAP Use RequirePhysLDAPGroup isg RewriteEngine On RewriteCond %{LA-U:REMOTE_USER} (.+) RewriteRule . - [E=RU:%1] RequestHeader add X-Forwarded-User %{RU}e </Location>

   /* extract REMOTE_USER */

   if ((p = strstr(request, "X-Forwarded-User:")) != NULL) {

      p += 17;

      while (*p && *p == ' ')

         p++;

      strlcpy(remote_user, p, sizeof(remote_user));

      if (strchr(remote_user, '\r'))

         *strchr(remote_user, '\r') = 0;


         char sid[32];

         /* get a new session ID */

         sid_new(NULL, remote_user, (char *) inet_ntoa(rem_addr), sid);


         /* set SID cookie */

         set_sid_cookie(NULL, sid);

         // TODO: set lbs!

   }

to process_http_request in order to extract the LDAP login. I have managed to populate the author field with remote_user, but what I'd really like is to write a cookie containing this login name so that session handling kicks in. You can see that I attempt to write a cookie, but elogd segfaults at set_sid_cookie() (gdb backtrace:

set_cookie (lbs=0x0, name=0x483b22 "sid", value=0x7ffffffd7590 "4831386B7B333A99", 
global=0, expiration=0x7ffffffd7300 "")

Would anyone be willing to help me with this? I'm not at all familiar with the program flow in elogd and my C is a bit rusty...

thanks,

-Christian

Dr. Christian Herzog <herzog@phys.ethz.ch> support: +41 44 633 26 68

IT Services Group, HPT H 8 voice: +41 44 633 39 50

Department of Physics, ETH Zurich

8093 Zurich, Switzerland http://nic.phys.ethz.ch/

--- trunk/webservices/ELOG/elog-2.9.0/src/elogd.c 2011/10/20 14:36:27 3247 +++ trunk/webservices/ELOG/elog-2.9.0/src/elogd.c 2012/01/30 08:14:32 4130 @@ -37,6 +37,7 @@ char listen_interface[256]; char theme_name[80]; char http_host[256]; +char http_user[256]; char _param[MAX_PARAM][NAME_LENGTH]; char _value[MAX_PARAM][NAME_LENGTH]; @@ -8534,7 +8535,7 @@ if (old_pwd[0] || new_pwd[0]) { if (user[0]) { - if (stristr(auth, "Kerberos")) { + if (stristr(auth, "Kerberos") || stristr(auth, "Webserver")) { if (strcmp(new_pwd, new_pwd2) != 0) wrong_pwd = 2; } else { @@ -12677,6 +12679,12 @@ return 0; } + /* if we have outsourced the authentication, use external username */ + getcfg(lbs->name, "Authentication", str, sizeof(str)); + if ( stristr(str, "Webserver")) { + strncpy(user,http_user,sizeof(user)); + } + /* check for full name */ if (!isparam("new_full_name") || *getparam("new_full_name") == 0) { sprintf(str, loc("Please enter \"%s\""), loc("Full name")); @@ -13247,7 +13255,7 @@ rsprintf("<tr><td nowrap width=\"15%%\">%s:</td>\n", loc("Login name")); getcfg(lbs->name, "Authentication", auth, sizeof(auth)); - if (stristr(auth, "Kerberos")) + if (stristr(auth, "Kerberos") || stristr(auth, "Webserver")) rsprintf("<td><input type=text size=40 name=new_user_name value=\"%s\" readonly></td></tr>\n", str); else rsprintf("<td><input type=text size=40 name=new_user_name value=\"%s\"></td></tr>\n", str); @@ -13334,6 +13342,7 @@ rsprintf("<tr><td class=\"menuframe\"><span class=\"menu1\">\n"); + /* remove user-management buttons if (is_admin_user(logbook, getparam("unm")) || !getcfg(logbook, "allow password change", str, sizeof(str)) || atoi(str) == 1) rsprintf("<input type=submit name=cmd value=\"%s\">\n", loc("Change password")); @@ -13345,7 +13354,7 @@ strlcpy(str, loc("Change config file"), sizeof(str)); rsprintf("<input type=submit name=cmd value=\"%s\">\n", str); } - + */ rsprintf("</span></td></tr></table>\n\n"); show_bottom_text(lbs); rsprintf("</form></body></html>\r\n"); @@ -13579,9 +13588,9 @@ /*---- header ----*/ getcfg(lbs->name, "Authentication", str, sizeof(str)); - if (stristr(str, "Kerberos")) { + if (stristr(str, "Kerberos")|| stristr(str, "Webserver")) { show_error - ("This installation of ELOG uses site authentification\nwhere password recovery is not possible"); + ("This installation of ELOG has outsourced its authentification\nwhere password recovery is not possible"); return; } @@ -13609,6 +13618,7 @@ void show_new_user_page(LOGBOOK * lbs, char *user) { + char str[256]; /*---- header ----*/ show_html_header(lbs, TRUE, loc("ELOG new user"), TRUE, FALSE, NULL, FALSE); @@ -13644,13 +13654,14 @@ rsprintf("<tr><td nowrap>Email:</td>\n"); rsprintf("<td colspan=2><input type=text size=40 name=new_user_email></tr>\n"); + getcfg(lbs->name, "Authentication", str, sizeof(str)); + if (!stristr(str, "Kerberos") && !stristr(str, "Webserver")) { + rsprintf("<tr><td nowrap>%s:</td>\n", loc("Password")); + rsprintf("<td colspan=2><input type=password size=40 name=newpwd>\n"); - rsprintf("<tr><td nowrap>%s:</td>\n", loc("Password")); - rsprintf("<td colspan=2><input type=password size=40 name=newpwd>\n"); - - rsprintf("<tr><td nowrap>%s:</td>\n", loc("Retype password")); - rsprintf("<td colspan=2><input type=password size=40 name=newpwd2>\n"); - + rsprintf("<tr><td nowrap>%s:</td>\n", loc("Retype password")); + rsprintf("<td colspan=2><input type=password size=40 name=newpwd2>\n"); + } rsprintf("</td></tr></table>\n"); /*---- menu buttons ----*/ @@ -25391,7 +25402,12 @@ if (!enum_user_line(lbs, 0, str, sizeof(str))) { if (isparam("new_user_name")) return TRUE; - show_new_user_page(lbs, NULL); + getcfg(lbs->name, "Authentication", str, sizeof(str)); + if (stristr(str, "Webserver")) { + show_new_user_page(lbs, http_user); + } else { + show_new_user_page(lbs, NULL); + } return FALSE; } @@ -25417,7 +25433,9 @@ } } - /* if invalid or no session ID, show login page */ + /* if invalid or no session ID, show login page, + unless we have outsourced the authentication to webserver + */ if (!skip_sid_check && !sid_check(sid, user_name)) { if (isparam("redir")) strlcpy(str, getparam("redir"), sizeof(str)); @@ -26397,6 +26415,25 @@ if (lbs->n_attr < 0) return; + /* if we outsource the authentication to Webserver and have no sid, just set a new sid */ + getcfg(lbs->name, "Authentication", str, sizeof(str)); + if (stristr(str, "Webserver")) { + if (http_user[0]) { + if (!sid_check(getparam("sid"), http_user)) { /* if we don't have a sid yet, set it */ + /* get a new session ID */ + sid_new(lbs, http_user, (char *) inet_ntoa(rem_addr), sid); + /* set SID cookie */ + set_sid_cookie(lbs, sid); + } + } else { + sprintf(str, "Error: Misconfigured webserver, did not get X-Forwarded-User from it."); + show_error(str); + return; + } + } + + + /* check for new login */ if (isparam("uname") && isparam("upassword")) { /* log logins */ @@ -27650,6 +27693,17 @@ *strchr(http_host, '\r') = 0; } + /* extract X-Forwarded-User into http_user if Authentication==Webserver */ + http_user[0] = 0; + if ((p = strstr(request, "X-Forwarded-User:")) != NULL) { + p += 17; + while (*p && *p == ' ') + p++; + strlcpy(http_user, p, sizeof(http_user)); + if (strchr(http_user, '\r')) + *strchr(http_user, '\r') = 0; + } + /* extract "X-Forwarded-For:" */ if ((p = strstr(request, "X-Forwarded-For:")) != NULL) { p += 16;

diff --git a/src/elogd.c b/src/elogd.c index 601639c..0f976be 100755 --- a/src/elogd.c +++ b/src/elogd.c @@ -27975,6 +27975,11 @@ void interprete(char *lbook, char *path) if (getcfg(lbs->name, "Logout to main", str, sizeof(str)) && atoi(str) == 1) { sprintf(str, "../"); setparam("redir", str); + } else { + getcfg(lbs->name, "Logout to page", str, sizeof(str)); + if (str[0]) { + setparam("redir", str); + } } set_sid_cookie(lbs, "", ""); sid_remove(getparam("sid"));

diff --git a/doc/adminguide.html b/doc/adminguide.html index da25388..0568ae3 100755 --- a/doc/adminguide.html +++ b/doc/adminguide.html @@ -243,6 +243,37 @@ URL = http://your.proxy.host/subdir/ into elogd.cfg.<p> +<h3><hr><i>Using apache authentication:</i></h3> +It is also possible to login via an apache-auth module.
+In elogd.cfg you should use the keyword "Webserver" for Authentication: + +<ul><pre> +Authentication = Webserver +</pre></ul> +This triggers elogd to use the environment variable "X-Forwarded-User" as the logged in user.
+A simple example of a apache configuration (including the proxy) is : +<ul><pre> +# this required to pass on the generated env-variable X-Forwarded-User to the proxy +ProxyPassInterpolateEnv On + +ProxyPass /elog/ http://your.host.domain:8080/ + +<Location "/elog"> + Order allow,deny + Allow from all + AuthType Basic + AuthName "elog-server" + AuthUserFile "/opt/elog/htpasswd" + require valid-user + RequestHeader unset Authorization + RequestHeader add X-Forwarded-User %{REMOTE_USER}s + # elog doesn't like the '@', so we need to cut it + RequestHeader edit X-Forwarded-User "@(.*)$" "" +</Location> +</pre></ul> + + + <hr><a name="imagemagick"> <div class=section>  Installing ImageMagick  </div> <p> When images are attached to ELOG entries, thumbnails can be created for quick preview. This works also for PDF and PostScript files. ELOG forwards any image operation diff --git a/doc/config.html b/doc/config.html index 9848f58..9e98855 100755 --- a/doc/config.html +++ b/doc/config.html @@ -2207,6 +2207,22 @@ Options Location = Main Building{a}, New Building{b}, Old Building{c} you have to change your password by other means (such as via the Windows login if you use a Windows Domain). </p> + <p> + Beside the Kerberos authentication, elogd version 3.0 and higher can be configured to accept a authentication done + by the webserver. + <ul> + <li> + <b><code>Authentication = Webserver</code></b> + </li> + </ul> + </p> + <p> + You can also combine it with other authentication methods as shown for Kerberos. + </p> + <p> + Elogd is then accepting the username set in the Request-Header "X-Forwarded-User" as already logged in.<br/> + To make this work, you need to configure the webserver correctly, as describe in the adminguide. + </p> <p> <a name="email" id="email"></a>

diff --git a/src/elogd.c b/src/elogd.c index 601639c..de4734b 100755 --- a/src/elogd.c +++ b/src/elogd.c @@ -13142,12 +13142,13 @@ int save_user_config(LOGBOOK * lbs, char *user, BOOL new_user) /* if we outsourced the authentication, use external username */ getcfg(lbs->name, "Authentication", str, sizeof(str)); - if ( stristr(str, "Webserver")) { - strlcpy(user, http_user, sizeof(user)); - } /* do not allow HTML in user name */ - strencode2(user_enc, user, sizeof(user_enc)); + if ( stristr(str, "Webserver")) { + strencode2(user_enc, http_user, sizeof(user_enc)); + } else { + strencode2(user_enc, user, sizeof(user_enc)); + } /* check for user name */ if (!isparam("new_user_name") || *getparam("new_user_name") == 0) {

> Hi, > I have an elog server which uses apache/ldap for authentication. > I would like to have the username used for ldap to be set automatically as author field in the elog. > > I'm using: > Authentication = Webserver > and I do set the env-variable X-Forwarded-User correctly to the ldap username > > GET /test/?cmd=New HTTP/1.1 > Host: localhost:8080 > Authorization: Basic bGFjYXByYXI6TWEwMiSyYnVt > ... > Cookie: elmode=Summary; sid=D7DE678B7CAA1D10; ufnm=lacaprar; urem=0 > ... > X-Forwarded-User: lacaprar > > How can I preset author to X-Forwarded-User? > Preset Author = $?? > I've tried $short_name/$long_name but I got Anonymous. > I understand that it is so because these are meant to be filled when password authentication is used: any way to use some other variable with the Webserver auth? > > thanks in advance, > Stefano Hi, I use an older version of elog, but Preset Author = $short_name <$long_name> works for me. One thing to note is that I also have : Self register = 1 So at first login, the user has to type in his name and email adress, maybe that's why you got "Anonymous". (Otherwise the variable $shortname etc. are not set.) HTH, Christof