Products.AutoUserMakerPASPlugin 2.1.1

2.1.1 (2017-02-01)

• Documentation RST fix [tomgross]

2.1 (2017-02-01)

• Don’t fail, if config properties are set as raw attributes [davidjb]

• Update default buildout to Plone 5.0 [tomgross]

• Support periodic user properties updates [sebasgo]

• Exclude user creation and update from plone.protect’s CSRF protection [sebasgo]

• Test on Plone 5.1 [tomgross]

2.0 (2016-01-14)

• Added challenge header and replacement pattern from WSA [tomgross]

• Plone 4.1 - 5.0 compatibility [tomgross]

• Ported tests to plone.app.testing [tomgross]

• Allow other default roles than Member [Sebastian Gottfried]

1.1 (2014-11-06)

• Remove triggering of UserLoggedInEvent (shouldn’t be done in PAS plugin) [gweis]

1.0 (2014-02-26)

• Let PAS decide where to store user properties. Allows e.g. Membrane to store properties on the user object itself. [gweis]

• Make update of users’s properties optional. [gweis]

0.9 (2014-02-04)

• Move the password generation function to be an instance method. This allows for the potential to override this function and performance actions using information drawn from the plugin, request etc. [davidjb]

• Update a user’s properties when they authenticate. This handles the situation where a user’s details may change (such as name, email address, etc) upon next authentication. [davidjb]

• Allow other PAS plugins to handle credentials by calling updateCredentials when authenticating. This allows for existing session or cookie plugins (implementing ICredentialsUpdatePlugin) to take over handling a user’s authentication. [davidjb]

• Ensure tests pass on Plone 4.1+. [davidjb]

0.8b1 (2010-11-04)

• Factored out setting of local roles to ShibbolethPermissions

• Trigger UserLoggedInEvent

• Added challenge-plugin

0.8a1 (2010-04-06)

• authzMappings needs to be a persistent list all the time [tom_gross]

• copied from old-style product 0.7 [tom_gross]

Overview

Accept Apache based authentication in Zope and create Plone users.

AutoUserMakerPasPlugin is a PAS plugin developed from apachepas, which allows Zope to delegate authentication concerns to Apache, and that automatically creates users as Apache lets them through. Using AutoUserMakerPasPlugin, you can configure your Plone site so any user known to your LDAP, Kerberos, Shibboleth, or Cosign (a.k.a. WebAccess) system–or indeed any other system which has an Apache authentication module–can transparently log in using his enterprise-wide credentials.

If you want only a few select users to be able to log into your site, don’t use Auto User Maker; stick to just apachepas, and create your few users manually. If, however, you want anyone with enterprise credentials to be able to authenticate, read on.

Requirements

• Plone 4.1 to 5.1 are tested and supported

• I test this with Shibboleth, currently 2.0 service provider.

Installation

1. Unzip the AutoUserMakerPASPlugin.zip file in $INSTANCE_HOME/Products.

2. Restart Zope.

3. Install the plugin:

   If you’re using Plone…

   1. Go to your-plone-site -> site setup -> Add/Remove Products, and install AutoUserMakerPASPlugin.

   If you’re not using Plone…

   1. In the Zope Management Interface, navigate to your-plone-site -> acl_users.

   2. Add an Auto User Maker to the folder.

   3. Navigate to your-plone-site -> acl_users -> plugins -> Authentication Plugins.

   2. Go to the Activate tab of your newly created Auth User Make instance, and turn on Authentication and Extraction.

4. Set up the required Apache directives. For example:

# Some Linux distributions (e.g., Debian Etch and Red Hat Enterprise
# Linux AS Release 4) have default settings which prevent the header
# rewrites below from working. Fix that:
<Proxy *>
    Order deny,allow
    Allow from all
</Proxy>

RewriteEngine On

# Grab the remote user as environment variable.
# (This RewriteRule doesn't actually rewrite anything URL-wise.)
RewriteCond %{LA-U:REMOTE_USER} (.+)
RewriteRule .* - [E=RU:%1]

# Put the username into a request header:
RequestHeader set X_REMOTE_USER %{RU}e

# For Shibboleth SP 2.0, you must also set HTTP headers, if you want
# account data populated.
        #RequestHeader set SHIB_PERSON_COMMONNAME %{displayName}e
#RequestHeader set SHIB_INETORGPERSON_MAIL %{mail}e
#RequestHeader set SHIB_ORGPERSON_LOCALITY %{l}e
#RequestHeader set SHIB_ORGPERSON_STATE %{st}e
#RequestHeader set SHIB_ORGPERSON_C %{c}e

        # Don't send shib stuff to plone
        RewriteCond %{REQUEST_URI} !^/(shibboleth-(sp|idp)|Shibboleth.sso|SAML)
# Do the typical VirtualHostMonster rewrite:
RewriteRule ^/port_8080(.*) http://localhost:8080/VirtualHostBase/http//localhost:80/VirtualHostRoot/_vh_port_8080/$1 [L,P]

I (Alan Brenner) used the following on a virtual interface on my Apache 2.2 and Shibboleth 1.3 development system:

Listen 192.168.191.1:80
<VirtualHost 192.168.191.1:80>
    ServerName alan.ithaka.org
    DocumentRoot /usr/local/apache-httpd-2.2.4/htdocs
    ProxyRequests Off
    ProxyPass /server-status !
    ProxyPass /server-info !
    ProxyPass /index.php !
    ProxyPass /Shibboleth.sso !
    ProxyPass /shibboleth-sp !
    ProxyPass /shibboleth-idp !
    ProxyPass /php !
    ProxyPass / http://127.0.0.1:8253/VirtualHostBase/http/alan.ithaka.org:80/test/VirtualHostRoot/

    LoadModule mod_shib /usr/local/shibboleth-sp-1.3/libexec/mod_shib_22.so
    ShibSchemaDir /usr/local/shibboleth-sp-1.3/share/xml/shibboleth
    ShibConfig /usr/local/shibboleth-sp-1.3/etc/shibboleth/shibboleth.xml
    ShibURLScheme http
    <Location /php>
        AuthType shibboleth
        ShibRedirectToSSL 443
        # An index.php like:
        #<html><head><title>shib test</title></head><body><?php phpinfo(); ?></body></html>
        # is helpful to validate security, and see what values shib is setting.
    </Location>
</VirtualHost>

<Location /shibboleth-idp/SSO>
    AuthType Basic
    AuthName Test
    AuthUserFile /usr/local/apache-httpd-2.2.4/conf/users
    require valid-user
</Location>

<IfModule !mod_jk.c>
    LoadModule jk_module modules/mod_jk.so
    JkShmFile /usr/local/apache-httpd-2.2.4/logs/jk-runtime-status
    JkWorkersFile /usr/local/apache-tomcat-5.5.23/conf/jk/workers.properties
    JkLogFile /var/log/httpd/mod_jk.log
</IfModule>
JkLogLevel emerg
JkMount /shibboleth-idp/* ajp13
JkMount /jsp-examples ajp13
JkMount /jsp-examples/* ajp13
JkMount /tomcat-docs ajp13
JkMount /tomcat-docs/* ajp13
JkMount /admin ajp13
JkMount /admin/* ajp13

Listen 443
<VirtualHost 192.168.191.1:443>
    DocumentRoot "/usr/local/apache-httpd-2.2.4/htdocs"
    ServerName alan.ithaka.org
    ServerAdmin alan.brenner@ithaka.org
    ErrorLog /usr/local/apache-httpd-2.2.4/logs/error_log.443
    TransferLog /usr/local/apache-httpd-2.2.4/logs/access_log.443
    SSLEngine on
    SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
    SSLCertificateFile /usr/local/shibboleth-sp-1.3/etc/shibboleth/idp.crt
    SSLCertificateKeyFile /usr/local/shibboleth-sp-1.3/etc/shibboleth/idp.key
    <FilesMatch "\.(cgi|shtml|phtml|php)$">
        SSLOptions +StdEnvVars
    </FilesMatch>
    <Proxy *>
        Order deny,allow
        Allow from all
    </Proxy>
    RewriteEngine On
    RewriteCond %{LA-U:REMOTE_USER} (.+)
    RewriteRule .* - [E=RW_RU:%1]
    RequestHeader set X_REMOTE_USER %{RW_RU}e
    RewriteCond %{REQUEST_URI} !^/(shibboleth-(sp|idp)|Shibboleth.sso|SAML|WAYF|server-(status|info)|index.php|php)
    RewriteRule ^/(.*) http://127.0.0.1:8253/VirtualHostBase/https/alan.ithaka.org:443/test/VirtualHostRoot/$1 [L,P]
    <Location />
        AuthType shibboleth
        ShibRequireSession Off
        require shibboleth
    </Location>
</VirtualHost>

Listen 8443
<VirtualHost 192.168.191.1:8443>
    ErrorLog /usr/local/apache-httpd-2.2.4/logs/error_log.8443
    TransferLog /usr/local/apache-httpd-2.2.4/logs/access_log.8443
    SSLEngine on
    SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP
    SSLVerifyClient optional_no_ca
    SSLVerifyDepth 10
    SSLOptions +StdEnvVars +ExportCertData
    SSLCertificateFile /usr/local/shibboleth-sp-1.3/etc/shibboleth/idp.crt
    SSLCertificateKeyFile /usr/local/shibboleth-sp-1.3/etc/shibboleth/idp.key
    ProxyRequests Off
</VirtualHost>

I use this for Apache 2.2 and Shibboleth 2.0 (and please see the page at https://spaces.internet2.edu/display/SHIB2/IdPSPLocalTestInstall for a more complete set of instructions on the Shibboleth side):

Include /etc/shibboleth/apache22.config

<VirtualHost *:80>
    ServerName alan.ithaka.org
    ServerAdmin alan.brenner@ithaka.org
    DocumentRoot /Library/WebServer/Documents
    ProxyRequests Off
    ProxyPass /server-status !
    ProxyPass /server-info !
    ProxyPass /index.php !
    ProxyPass / http://127.0.0.1:8253/VirtualHostBase/http/alan.ithaka.org:80/test/VirtualHostRoot/
</VirtualHost>

Listen 443
<VirtualHost 172.16.209.1:443>
    DocumentRoot "/Library/WebServer/Documents"
    ServerName alan.ithaka.org:443
    ServerAdmin alan.brenner@ithaka.org
    ErrorLog "/var/log/apache2/error_log"
    TransferLog "/var/log/apache2/access_log"
    SSLEngine on
    SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
    SSLCertificateFile "/etc/apache2/server.crt"
    SSLCertificateKeyFile "/etc/apache2/server.key"
    <FilesMatch "\.(cgi|shtml|phtml|php)$">
        SSLOptions +StdEnvVars
    </FilesMatch>
    <Directory "/Library/WebServer/CGI-Executables">
        SSLOptions +StdEnvVars
    </Directory>
    BrowserMatch ".*MSIE.*" \
             nokeepalive ssl-unclean-shutdown \
             downgrade-1.0 force-response-1.0
    CustomLog "/var/log/apache2/ssl_request_log" \
              "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
    <Proxy *>
        Order deny,allow
        Allow from all
    </Proxy>
    RewriteEngine On
    RewriteCond %{LA-U:REMOTE_USER} (.+)
    RewriteRule .* - [E=RW_RU:%1]
    RequestHeader set X_REMOTE_USER %{RW_RU}e
    RequestHeader set SHIB_PERSON_COMMONNAME %{displayName}e
    RequestHeader set SHIB_INETORGPERSON_MAIL %{mail}e
    RequestHeader set SHIB_ORGPERSON_LOCALITY %{l}e
    RequestHeader set SHIB_ORGPERSON_STATE %{st}e
    RequestHeader set SHIB_ORGPERSON_C %{c}e
    RewriteCond %{REQUEST_URI} !^/(shibboleth-sp|server-(status|info)|index.php|secure)
    RewriteRule ^/(.*) http://127.0.0.1:8253/VirtualHostBase/https/alan.ithaka.org:443/test/VirtualHostRoot/$1 [L,P]
    <Location />
        AuthType shibboleth
        ShibRequireSession On
        require shibboleth
    </Location>
</VirtualHost>

<VirtualHost 172.16.60.1:443>
    DocumentRoot "/Library/WebServer/Documents"
    ServerName alanidp.ithaka.org:443
    ServerAdmin alan.brenner@ithaka.org
    ErrorLog "/var/log/apache2/error_idp_log"
    TransferLog "/var/log/apache2/access_idp_log"
    SSLEngine on
    SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
    SSLCertificateFile "/etc/apache2/server_idp.crt"
    SSLCertificateKeyFile "/etc/apache2/server_idp.key"
    <FilesMatch "\.(cgi|shtml|phtml|php)$">
        SSLOptions +StdEnvVars
    </FilesMatch>
    <Directory "/Library/WebServer/CGI-Executables">
        SSLOptions +StdEnvVars
    </Directory>
    BrowserMatch ".*MSIE.*" \
             nokeepalive ssl-unclean-shutdown \
             downgrade-1.0 force-response-1.0
    <FilesMatch "\.(cgi|shtml|phtml|php)$">
        SSLOptions +StdEnvVars
    </FilesMatch>
    <Proxy *>
        Order deny,allow
        Allow from all
    </Proxy>
    ProxyPass /idp/ ajp://127.0.0.1:8009/idp/
    <Location /idp/Authn/RemoteUser>
        AuthType Basic
        AuthName "IdPTest"
        AuthUserfile /etc/apache2/pass
        require valid-user
    </Location>
</VirtualHost>

Notice for Shibboleth 2, I’ve had to use a different host for the Identity Provider.

Configuration

Design Rationale (technical and only for the curious)

Testing

To run the AutoUserMakerPASPlugin tests, use the standard Zope testrunner:

$INSTANCE_HOME/bin/zopectl test -s Products.AutoUserMakerPASPlugin

Credits