Bug #30535
When using Puma with Foreman 2.1 FreeIPA external authentication does not work
Description
I looked into this a bit. It appears that all of the freeIPA authentication bits are configured to set internal apache variables, and mod_passenger would be able to read them as environment variables on each request. Because puma is being used as a generic http proxy via mod_proxy, no information about the intercepted form logins or kerberos auth makes its way to foreman through puma.
All of this needs to be reworked with puma in the mix. None of the existing IPA logic will work. (Check headers, not env if puma is used, etc).
Associated revisions
Fixes #30535 - Use HTTP headers in puma
Refs #30535 - Correctly unset remote user groups
This corrects a typo in the previous change, which unset
REMOTE_USER_USER_GROUPS instead of REMOTE_USER_GROUPS in the apache
configuration.
History
#1
Updated by Steve Jacobs almost 2 years ago
What I did to check this:
Turned up debug logging in apache and installed mod_dumpio.
I can verify that auth is occurring, and the ifp service is delivering email, etc.
mod_dumpio trace shows that no REMOTE_USER, etc header is being sent to puma on port 3000.
#2
Updated by Ewoud Kohl van Wijngaarden almost 2 years ago
- Triaged changed from No to Yes
- Category set to Foreman modules
- Project changed from Foreman to Installer
With 2.1 you can revert back to passenger using --foreman-passenger true. I consider that a workaround, not a solution since long term we want to align on Puma and this is a feature we support. This is something in the installer, so moving to the correct project.
#3
Updated by The Foreman Bot almost 2 years ago
- Status changed from New to Ready For Testing
- Pull request https://github.com/theforeman/puppet-foreman/pull/872 added
#4
Updated by Hesham Ahmed almost 2 years ago
- Pull request https://github.com/theforeman/foreman/pull/7909 added
- Pull request deleted (
https://github.com/theforeman/puppet-foreman/pull/872)
I have fixed this by changing app/services/sso/apache.rb to use HTTP_REMOTE_USER instead of REMOTE_USER and setting HTTP_REMOTE_USER in apache. I have created pull requests to foreman and puppet-foreman projects in case this is acceptable.
#5
Updated by Adam Winberg almost 2 years ago
Hesham Ahmed wrote:
I have fixed this by changing app/services/sso/apache.rb to use HTTP_REMOTE_USER instead of REMOTE_USER and setting HTTP_REMOTE_USER in apache. I have created pull requests to foreman and puppet-foreman projects in case this is acceptable.
Have you actually tested this? I have tried this with many variations and never got it to work. Tested on RHEL8.
#6
Updated by Hesham Ahmed almost 2 years ago
I have tested this and it works fine on EL7
#7
Updated by Adam Winberg almost 2 years ago
Ok, got it working. But when using mod_ssl the request header statement need to look a bit different:
RequestHeader set REMOTE_USER %{REMOTE_USER}s
Notice the ending 's' instead of 'e' to make it work with mod_ssl
#8
Updated by The Foreman Bot almost 2 years ago
- Pull request https://github.com/theforeman/puppet-foreman/pull/872 added
#9
Updated by Tomer Brisker almost 2 years ago
- Target version set to 2.1.3
#10
Updated by Ewoud Kohl van Wijngaarden almost 2 years ago
- Target version changed from 2.1.3 to 2.2.0
#11
Updated by Tomer Brisker almost 2 years ago
- Bugzilla link set to 1877307
#12
Updated by Tomer Brisker almost 2 years ago
- Category deleted (
Foreman modules) - Project changed from Installer to Foreman
#13
Updated by Tomer Brisker almost 2 years ago
- Category set to Authentication
#14
Updated by Anonymous over 1 year ago
- Status changed from Ready For Testing to Closed
Applied in changeset puppet-foreman:puppet-foreman|6f5b99bb08f19ff61410dc6208346b9c8c333221.
#15
Updated by The Foreman Bot over 1 year ago
- Fixed in Releases 2.3.0 added
#16
Updated by Tomer Brisker over 1 year ago
- Fixed in Releases 2.2.0 added
- Fixed in Releases deleted (
2.3.0)
#17
Updated by Ewoud Kohl van Wijngaarden over 1 year ago
- Subject changed from When using puma with foreman 2.1 freeipa external authentication does not work to When using Puma with Foreman 2.1 freeipa external authentication does not work
#18
Updated by Ewoud Kohl van Wijngaarden over 1 year ago
- Subject changed from When using Puma with Foreman 2.1 freeipa external authentication does not work to When using Puma with Foreman 2.1 FreeIPA external authentication does not work
#19
Updated by The Foreman Bot over 1 year ago
- Assignee set to Tomer Brisker
- Pull request https://github.com/theforeman/puppet-foreman/pull/896 added
#20
Updated by The Foreman Bot over 1 year ago
- Pull request https://github.com/theforeman/puppet-foreman/pull/902 added
Fixes #30535 - Set HTTP headers for proxy requests