Bug #30535
closed
When using Puma with Foreman 2.1 FreeIPA external authentication does not work
Added by Steve Jacobs over 4 years ago.
Updated almost 4 years ago.
Description
I looked into this a bit. It appears that all of the freeIPA authentication bits are configured to set internal apache variables, and mod_passenger would be able to read them as environment variables on each request. Because puma is being used as a generic http proxy via mod_proxy, no information about the intercepted form logins or kerberos auth makes its way to foreman through puma.
All of this needs to be reworked with puma in the mix. None of the existing IPA logic will work. (Check headers, not env if puma is used, etc).
What I did to check this:
Turned up debug logging in apache and installed mod_dumpio.
I can verify that auth is occurring, and the ifp service is delivering email, etc.
mod_dumpio trace shows that no REMOTE_USER, etc header is being sent to puma on port 3000.
- Project changed from Foreman to Installer
- Category set to Foreman modules
- Triaged changed from No to Yes
With 2.1 you can revert back to passenger using --foreman-passenger true. I consider that a workaround, not a solution since long term we want to align on Puma and this is a feature we support. This is something in the installer, so moving to the correct project.
- Status changed from New to Ready For Testing
- Pull request https://github.com/theforeman/puppet-foreman/pull/872 added
- Pull request https://github.com/theforeman/foreman/pull/7909 added
- Pull request deleted (
https://github.com/theforeman/puppet-foreman/pull/872)
I have fixed this by changing app/services/sso/apache.rb to use HTTP_REMOTE_USER instead of REMOTE_USER and setting HTTP_REMOTE_USER in apache. I have created pull requests to foreman and puppet-foreman projects in case this is acceptable.
Hesham Ahmed wrote:
I have fixed this by changing app/services/sso/apache.rb to use HTTP_REMOTE_USER instead of REMOTE_USER and setting HTTP_REMOTE_USER in apache. I have created pull requests to foreman and puppet-foreman projects in case this is acceptable.
Have you actually tested this? I have tried this with many variations and never got it to work. Tested on RHEL8.
I have tested this and it works fine on EL7
Ok, got it working. But when using mod_ssl the request header statement need to look a bit different:
RequestHeader set REMOTE_USER %{REMOTE_USER}s
Notice the ending 's' instead of 'e' to make it work with mod_ssl
- Pull request https://github.com/theforeman/puppet-foreman/pull/872 added
- Target version set to 2.1.3
- Target version changed from 2.1.3 to 2.2.0
- Bugzilla link set to 1877307
- Project changed from Installer to Foreman
- Category deleted (
Foreman modules)
- Category set to Authentication
- Status changed from Ready For Testing to Closed
- Fixed in Releases 2.3.0 added
- Fixed in Releases 2.2.0 added
- Fixed in Releases deleted (
2.3.0)
- Subject changed from When using puma with foreman 2.1 freeipa external authentication does not work to When using Puma with Foreman 2.1 freeipa external authentication does not work
- Subject changed from When using Puma with Foreman 2.1 freeipa external authentication does not work to When using Puma with Foreman 2.1 FreeIPA external authentication does not work
- Assignee set to Tomer Brisker
- Pull request https://github.com/theforeman/puppet-foreman/pull/896 added
- Pull request https://github.com/theforeman/puppet-foreman/pull/902 added
Also available in: Atom
PDF
Updated by 
Updated by 
Updated by 
Updated by 
Updated by 
Updated by 
Updated by Anonymous