Implements LDAP based Single Sign On #151
Conversation
There was a problem hiding this comment.
I'm a little confused as to why you need to also check LDAP for the user if the incoming source is trusted. Seems inefficient to me.
There was a problem hiding this comment.
Well, still the user details have to be looked up from LDAP to create the user if needed (e.g. mail address, full name).
There was a problem hiding this comment.
Ah, and you'd probably want to keep the users up to date as well. Makes sense.
|
It's open source, isn't it? @monitorjbl could extend my code proposal, if it is not sufficient for him. If you - as the code maintainer - say you need extensions to this feature to be able to merge it into the master branch, I will see what I can do. But I am not paid by my company to handle random feature requests of third parties, which do not make any sense to us. For us, our custom-built Mamute works great with this SSO extension (in production for nearly three months now). |
|
@falbrech-hsdg thank you for this patchset! Could you please share the details how you are running mamute on a tomcat? |
|
@xdarklight Sorry, it is quite a long time that I supported our Ops team in setting up mamute, and now I do not have access to the server anymore... According to stackoverflow, you could have to set a flag on Tomcat's AJP connector to enable authentication from the outside: But I cannot remember if we have set this flag... |
|
Since @falbrech-hsdg and @xdarklight are successfully using this feature, I'm merging :-) It would be awesome if you guys could provide an integrated test with a running ldap service in the future. (we could setup the ldap service with a docker container, for example) |
Implements LDAP based Single Sign On
This commit implements a Single Sign On for Mamute which loads all required user information for a trusted SSO user name from LDAP.
We implemented this for use in an Active Directory Environment with Kerberos authentication. To have this working with Mamute, we set up an Apache httpd dealing with Kerberos, setting REMOTE_USER, and forwarding this to an Apache Tomcat. Mamute runs on the Tomcat.
This is not yet tested with Jetty, as I really could not figure out how to easily pass the REMOTE_USER to Jetty WITHOUT using mod_ajp.
To enable SSO, add to your [environment].properties (together with all required LDAP configuration):
ldap.sso = true