Hej,

I just noted that when having an unknown (or presumably misspelled) user name in the "Admin user" line in the
config file, that the other users are no longer treated as admins and do not see the corresponding link to the
admin page e.g. on the list page. In my specific situation, I in fact have only one user registered (new
password file) but two users still on the admin list (old config file). The one user is only treated as admin
after removing the offending name from the list of admins.

I understand that this might be the intended behavior -- but I wonder if this could lead to a situation where
one locks oneself out, e.g. when adding a misspelled user name to the list.


Thanks and cheers,

Hanno

Hej Stefan,

thanks for the suggestion -- through a Apache proxy the upload does indeed work without problems.

Cheers,

Hanno

Hi Christian,

 I have also the need to do auth on the webserver, but  I tried to integrate it into elogd as far as I could.

However, I do not try to set a special cookie to set the username, but always use 
 "X-Forwarded-User".  Like this, every request is authenticated by the webserver in front.

If that's not too heavy for you, try out the applied patch.

HTH,

Christof

PS:

@Stefan:

If you are willing to integrate this into the official tree, 

I can provide some docs for it (like setting author 

directly etc.)

-----------------------------------------------------------------
Christof Hanke e-mail hanke@rzg.mpg.de
RZG (Rechenzentrum Garching) phone +49-89-3299-1041
Computing Center of the Max-Planck-Gesellschaft (MPG) and the
Institut für Plasmaphysik (IPP)
 

 <Location /elog/admin>

        Use PhysLDAP

        Use RequirePhysLDAPGroup isg


        RewriteEngine On

        RewriteCond %{LA-U:REMOTE_USER} (.+)

        RewriteRule . - [E=RU:%1]

        RequestHeader add X-Forwarded-User %{RU}e

</Location>

   /* extract REMOTE_USER */

   if ((p = strstr(request, "X-Forwarded-User:")) != NULL) {

      p += 17;

      while (*p && *p == ' ')

         p++;

      strlcpy(remote_user, p, sizeof(remote_user));

      if (strchr(remote_user, '\r'))

         *strchr(remote_user, '\r') = 0;


         char sid[32];

         /* get a new session ID */

         sid_new(NULL, remote_user, (char *) inet_ntoa(rem_addr), sid);


         /* set SID cookie */

         set_sid_cookie(NULL, sid);

         // TODO: set lbs!

   }

set_cookie (lbs=0x0, name=0x483b22 "sid", value=0x7ffffffd7590 "4831386B7B333A99", 
global=0, expiration=0x7ffffffd7300 "")

Hi Stefan,

I am happy to see that you include the webserver authentication.
So I can now login at some other page and then access elog.
However, I would also need some means of logging out some where else.

For this I propose a new Configuration option "Logout to page" which redirects to another page if set and "Logout to main" is 0.

See the attached patch (against git HEAD)

Does this make sense to you ?

Christof

PS: Many thanks for the autosave mode,  I already used it ;-)
 

Hi Stefan,

here is a draft of how you could describe the webserver authentication in your docs.

T/Christof

Hi Stefan,

When we use Webserver authentication, we have the correct username already in the variable http_user.

The old way of copying this http_user to "user" is wrong since we don't use the size of http_user.

Instead, just encode the http_user variable directly.

See attached patch against git HEAD.

Christof

Yes, I saw it on bitbucket, also all the commits. Thanks!

> Hi,
>   I have an elog server which uses apache/ldap for authentication.
> I would like to have the username used for ldap to be set automatically as author field in the elog.
> 
> I'm using: 
> Authentication = Webserver
> and I do set the env-variable X-Forwarded-User correctly to the ldap username
> 
> GET /test/?cmd=New HTTP/1.1
> Host: localhost:8080
> Authorization: Basic bGFjYXByYXI6TWEwMiSyYnVt
> ...
> Cookie: elmode=Summary; sid=D7DE678B7CAA1D10; ufnm=lacaprar; urem=0
> ...
> X-Forwarded-User: lacaprar
> 
> How can I preset author to X-Forwarded-User?
> Preset Author = $??
> I've tried $short_name/$long_name but I got Anonymous.
> I understand that it is so because these are meant to be filled when password authentication is used: any way to use some other variable with the Webserver auth?
> 
> thanks in advance,
>   Stefano


Hi,

I use an older version of elog, but
 
Preset Author = $short_name <$long_name>

works for me.

One thing to note is that I also have :
Self register = 1

So at first login, the user has to type in his name and email adress,
maybe that's why you got "Anonymous". (Otherwise the variable $shortname etc. are not set.)

HTH,

Christof