Summary: | Allow a header to be considered trusted to provide the userid | ||
---|---|---|---|
Product: | Koha | Reporter: | Robin Sheat <robin> |
Component: | Authentication | Assignee: | Robin Sheat <robin> |
Status: | Patch doesn't apply --- | QA Contact: | Testopia <testopia> |
Severity: | enhancement | ||
Priority: | P5 - low | CC: | chris, dpavlin, sven+koha |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | Medium patch |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: | ||
Circulation function: | |||
Attachments: |
Bug 13932: add support for a trusted HTTP header
Bug 13932: unset userenv when using trusted header |
Description
Robin Sheat
2015-03-31 00:27:48 UTC
Created attachment 38301 [details] [review] Bug 13932: add support for a trusted HTTP header This adds support for a 'trusted_header' option in koha-conf.xml that specified an HTTP header that you trust that contains the userid. This is to allow Koha to be behind a reverse proxy (for example, running plack fronted by apache) that does user authentication/authorisation. Note: for reasons I can't really tell, this doesn't work when apache is running Koha as CGI, but does work under plack. Test plan: * have a koha-plack setup. * configure apache to send it a header: RequestHeader set X_REMOTE_USER "testuserid" * add <trusted_header>X_REMOTE_USER</trusted_header> to koha-conf.xml * verify that the user behaves as though they're logged in. Created attachment 38627 [details] [review] Bug 13932: unset userenv when using trusted header As the trusted header system doesn't keep a session hanging around, when running with plack it can end up with the userenv of another user, which is bad. So this clears it forcing it to be recreated cleanly. fatal: sha1 information is lacking or useless (C4/Auth.pm). error: could not build fake ancestor at ./getter.pl line 196. It would be really useful to get support for the REMOTE_USER environment variable as a way for authentication. This would at once enable support for many different authentication providers, for example mod_auth_openidc. |