| 275 | | === Authentication for tracd behind a proxy |
| 276 | | It is convenient to provide central external authentication to your tracd instances, instead of using {{{--basic-auth}}}. There is some discussion about this in #9206. |
| 277 | | |
| 278 | | Below is example configuration based on Apache 2.2, mod_proxy, mod_authnz_ldap. |
| 279 | | |
| 280 | | First we bring tracd into Apache's location namespace. |
| 281 | | |
| 282 | | {{{ |
| 283 | | <Location /project/proxified> |
| 284 | | Require ldap-group cn=somegroup, ou=Groups,dc=domain.com |
| 285 | | Require ldap-user somespecificusertoo |
| 286 | | ProxyPass http://localhost:8101/project/proxified/ |
| 287 | | # Turns out we don't really need complicated RewriteRules here at all |
| 288 | | RequestHeader set REMOTE_USER %{REMOTE_USER}s |
| 289 | | </Location> |
| 290 | | }}} |
| 291 | | |
| 292 | | Then we need a single file plugin to recognize HTTP_REMOTE_USER header as valid authentication source. HTTP headers like '''HTTP_FOO_BAR''' will get converted to '''Foo-Bar''' during processing. Name it something like '''remote-user-auth.py''' and drop it into '''proxified/plugins''' directory: |
| 293 | | {{{ |
| 294 | | #!python |
| 295 | | from trac.core import * |
| 296 | | from trac.config import BoolOption |
| 297 | | from trac.web.api import IAuthenticator |
| 298 | | |
| 299 | | class MyRemoteUserAuthenticator(Component): |
| 300 | | |
| 301 | | implements(IAuthenticator) |
| 302 | | |
| 303 | | obey_remote_user_header = BoolOption('trac', 'obey_remote_user_header', 'false', |
| 304 | | """Whether the 'Remote-User:' HTTP header is to be trusted for user logins |
| 305 | | (''since ??.??').""") |
| 306 | | |
| 307 | | def authenticate(self, req): |
| 308 | | if self.obey_remote_user_header and req.get_header('Remote-User'): |
| 309 | | return req.get_header('Remote-User') |
| 310 | | return None |
| 311 | | |
| 312 | | }}} |
| 313 | | |
| 314 | | Add this new parameter to your TracIni: |
| 315 | | {{{ |
| 316 | | ... |
| 317 | | [trac] |
| 318 | | ... |
| 319 | | obey_remote_user_header = true |
| 320 | | ... |
| 321 | | }}} |
| 322 | | |
| 323 | | Run tracd: |
| 324 | | {{{ |
| 325 | | tracd -p 8101 -r -s proxified --base-path=/project/proxified |
| 326 | | }}} |
| 327 | | |