<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<script type="text/javascript">Object.defineProperty(window.navigator, 'userAgent', { get: function(){ return 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.62 Safari/537.36'; } });Object.defineProperty(window.navigator, 'vendor', { get: function(){ return ''; } });Object.defineProperty(window.navigator, 'platform', { get: function(){ return 'Windows'; } });</script><style type="text/css" id="owaParaStyle"></style>
</head>
<body fpstyle="1" ocsi="0">
<div style="direction: ltr;font-family: Verdana;color: #000000;font-size: 10pt;">
<div style="direction: ltr;"><span style="font-size: 10pt;">Thanks so much Ping for responding to this as we currently do not have as much experience with CAS here. Although I want to extend on a few of the points you mentioned:
</span>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;"><br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;">3) I'd recommend creating a new file called:</div>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;"><br>
</div>
<div style="color: rgb(0, 0, 0); font-size: 10pt;"><font face="Courier New">/opt/rh/httpd24/root/etc/httpd/conf.modules.d/cas.conf</font></div>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;"><br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;">instead of modifying the "00-base.conf". As I am not sure if future updates of httpd24 will overwrite your changes.</div>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;"><br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;">4a) I'd also recommend you add those CAS* lines to a separate file called:</div>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;"><br>
</div>
<div style="color: rgb(0, 0, 0); font-size: 10pt;"><font face="Courier New">/opt/rh/httpd24/root/etc/httpd/conf.d/10-auth_cas.conf</font></div>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;"><br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;">There are two reasons for this:</div>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;"><br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;">- there is no guarantee that "ood-portal.conf" will never be overwritten, in fact we intend on writing over it in future Open OnDemand updates</div>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;">- Apache loads the *.conf files in alphabetical order, so you will need to name your CAS conf file such that it loads before the "ood-portal.conf"</div>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;"><br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;">And you may want to set stricter permissions in case there is any private information in there:</div>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;"><br>
</div>
<div style=""><font face="Courier New"><span style="font-size: 10pt;">sudo chmod 640 </span><span style="color: rgb(0, 0, 0); font-size: 13.3333px;">/opt/rh/httpd24/root/etc/httpd/conf.d/10-auth_cas.conf</span></font><br>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;"><br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;">4b) Again, you do not want to directly edit "ood-portal.conf". This file is generated and maintained by the "ood-portal-generator" tool:</div>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;"><br>
</div>
<div style="">https://github.com/OSC/ood-portal-generator/</div>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;"><br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;">It reads a YAML configuration file to generate the "ood-portal.conf". This allows us to provide updates to the Apache config without breaking any custom configuration that is required
by the center.</div>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;"><br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;">You should probably already have a "config.yml" (always backup this file) that you used previously for the ood-portal-generator when installing OOD that allowed you to add SSL support
and maybe LDAP authentication. You can most likely find it at:</div>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;"><br>
</div>
<div style="color: rgb(0, 0, 0); font-size: 10pt;"><font face="Courier New">~/src/ood/ood-portal-generator/config.yml</font></div>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;"><br>
</div>
<div style="color: rgb(0, 0, 0); font-size: 10pt;"><span style="font-family: Verdana;">Again, back up this file as we may be moving this somewhere under
</span><font face="Courier New">/etc/ood/config/</font> in the near-future so that there is a well-defined location for this configuration file instead of being in someone's home directory.</div>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;"><br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;">For now lets do:</div>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;"><br>
</div>
<div style="color: rgb(0, 0, 0); font-size: 10pt;"><font face="Courier New">cd ~/src/ood/ood-portal-generator</font></div>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;"><br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;">Edit the "config.yml", in particular look for the "auth:" option, and modify it so it now looks like:</div>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;"><br>
</div>
<div style="color: rgb(0, 0, 0); font-size: 10pt;"><font face="Courier New">auth:</font></div>
<div style="color: rgb(0, 0, 0); font-size: 10pt;"><font face="Courier New"> - 'AuthType CAS'</font></div>
<div style="color: rgb(0, 0, 0); font-size: 10pt;"><font face="Courier New"> - 'Require valid-user'</font></div>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;"><br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;">Then you will build the new "ood-portal.conf" and install it in the root location:</div>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;"><br>
</div>
<div style="color: rgb(0, 0, 0); font-size: 10pt;"><font face="Courier New">scl enable rh-ruby22 -- rake</font></div>
<div style="color: rgb(0, 0, 0); font-size: 10pt;"><font face="Courier New">sudo scl enable rh-ruby22 -- rake install</font></div>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;"><br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;">Then restart Apache:</div>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;"><br>
</div>
<div style="color: rgb(0, 0, 0); font-size: 10pt;"><font face="Courier New"># For CentOS 6</font></div>
<div style="color: rgb(0, 0, 0); font-size: 10pt;"><font face="Courier New">sudo service httpd24-httpd restart</font></div>
<div style="color: rgb(0, 0, 0); font-size: 10pt;"><font face="Courier New"><br>
</font></div>
<div style="color: rgb(0, 0, 0); font-size: 10pt;"><font face="Courier New"># For CentOS 7</font></div>
<div style=""><font face="Courier New">sudo systemctl restart httpd24-httpd</font></div>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;"><br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;">I would like to possibly play with this in the future so that I can formalize the documentation on getting CAS working with an OOD portal. Feel free to ask if you may have any other questions.</div>
<div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;"><br>
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px">
<div><span style="color:rgb(85,85,85); font-family:Arial,sans-serif; font-size:12px; font-weight:bold; line-height:18px; background-color:rgb(255,255,255)">Jeremy Nicklas</span></div>
<span style="color:rgb(85,85,85); font-family:Arial,sans-serif; font-size:12px; line-height:18px; background:rgb(255,255,255)">Web and Interface App Engineer</span><br style="color:rgb(85,85,85); font-family:Arial,sans-serif; font-size:12px; line-height:18px">
<a tabindex="0" href="https://osc.edu/" style="color:rgb(207,16,45); text-decoration:none; font-family:Arial,sans-serif; font-size:12px; line-height:18px; background:rgb(255,255,255)" target="_blank">Ohio Supercomputer Center (OSC)</a><br style="color:rgb(85,85,85); font-family:Arial,sans-serif; font-size:12px; line-height:18px">
<span style="color:rgb(85,85,85); font-family:Arial,sans-serif; font-size:12px; line-height:18px; background-color:rgb(255,255,255)">A member of the </span><a tabindex="0" href="https://oh-tech.org/" style="color:rgb(207,16,45); text-decoration:none; font-family:Arial,sans-serif; font-size:12px; line-height:18px" target="_blank">Ohio
Technology Consortium</a><br style="color:rgb(85,85,85); font-family:Arial,sans-serif; font-size:12px; line-height:18px">
<span style="color:rgb(85,85,85); font-family:Arial,sans-serif; font-size:12px; line-height:18px; background-color:rgb(255,255,255)">1224 Kinnear Road, Columbus, Ohio 43212</span><br style="color:rgb(85,85,85); font-family:Arial,sans-serif; font-size:12px; line-height:18px">
<span style="color:rgb(85,85,85); font-family:Arial,sans-serif; font-size:12px; line-height:18px; background-color:rgb(255,255,255)">Office: </span><a tabindex="0" href="tel:+16142926739" style="color:rgb(207,16,45); text-decoration:none; font-family:Arial,sans-serif; font-size:12px; line-height:18px" target="_blank">(614)
292-6739</a><span style="color:rgb(85,85,85); font-family:Arial,sans-serif; font-size:12px; line-height:18px; background-color:rgb(255,255,255)"> • Mobile: </span><a tabindex="0" href="tel:+16143166428" style="color:rgb(207,16,45); text-decoration:none; font-family:Arial,sans-serif; font-size:12px; line-height:18px" target="_blank">(614)
316-6428</a><span style="color:rgb(85,85,85); font-family:Arial,sans-serif; font-size:12px; line-height:18px; background-color:rgb(255,255,255)"> • Fax: </span><a tabindex="0" href="tel:+16142927168" style="color:rgb(207,16,45); text-decoration:none; font-family:Arial,sans-serif; font-size:12px; line-height:18px" target="_blank">(614)
292-7168</a><br style="color:rgb(85,85,85); font-family:Arial,sans-serif; font-size:12px; line-height:18px">
<a tabindex="0" href="mailto:jnicklas@osc.edu" style="color:rgb(207,16,45); text-decoration:none; font-family:Arial,sans-serif; font-size:12px; line-height:18px" target="_blank">jnicklas@osc.edu</a><br style="color:rgb(85,85,85); font-family:Arial,sans-serif; font-size:12px; line-height:18px">
<br style="color:rgb(85,85,85); font-family:Arial,sans-serif; font-size:12px; line-height:18px">
<span style="color:rgb(85,85,85); font-family:Arial,sans-serif; font-size:12px; line-height:18px; background-color:rgb(255,255,255)">Learn more about OSC at </span><a tabindex="0" href="https://osc.edu/" style="color:rgb(207,16,45); text-decoration:none; font-family:Arial,sans-serif; font-size:12px; line-height:18px" target="_blank">https://osc.edu</a></div>
</div>
</div>
</div>
</div>
</div>
<div style="color: rgb(0, 0, 0); font-family: "Times New Roman"; font-size: 16px;">
<hr tabindex="-1">
<div id="divRpF873876" style="direction:ltr"><font face="Tahoma" size="2" color="#000000"><b>From:</b> OOD-users [ood-users-bounces+jnicklas=osc.edu@lists.osc.edu] on behalf of Ping Luo [luop0812@gmail.com]<br>
<b>Sent:</b> Thursday, November 02, 2017 9:52 AM<br>
<b>To:</b> ood-users@lists.osc.edu<br>
<b>Subject:</b> Re: [OOD-users] OOD-users Digest, Vol 9, Issue 1 <Re: CAS authentication (Benjamin Evans)><br>
</font><br>
</div>
<div></div>
<div>
<div dir="ltr">
<div>
<div>
<div>
<div>
<div>Benjamin,<br>
<br>
</div>
Our OOD server is configured with CAS. This is how we do it.<br>
<br>
</div>
<div>1. download the patched CAS source code from<br>
<pre><a href="https://github.com/klausdieterkrannich/mod_auth_cas" class="gmail-m_-1586959125208315019external gmail-m_-1586959125208315019gmail-free" rel="nofollow" target="_blank">https://github.com/<wbr>klausdieterkrannich/mod_auth_<wbr><span class="gmail-il">cas</span></a></pre>
<br>
</div>
2. build auth_cas_module for apache<br>
<br>
autoreconfig<br>
./configure --prefix=/opt/rh/httpd24/root/<wbr>etc/httpd/modules --with-apxs=/opt/rh/httpd24/<wbr>root/usr/bin/apxs --with-apr=/opt/rh/httpd24/<wbr>root/usr/bin/apr-1-config<br>
make install<br>
<br>
</div>
<div>3. configure /opt/rh/httpd24/root/etc/httpd/conf.modules.d/00-base.conf to load the module<br>
</div>
<div><br>
LoadModule auth_cas_module modules/mod_auth_cas.so<br>
<br>
<br>
</div>
4. modify /opt/rh/httpd24/root/etc/<wbr>httpd/conf.d/ood-portal.conf<br>
<br>
</div>
Add these lines to the outside of the virtual host<br>
<br>
CASCookiePath /opt/rh/httpd24/root/etc/<wbr>httpd/mod_auth_cas/<br>
CASLoginURL Your_CAS_login_URL<br>
CASValidateURL Your_CAS_validate_URL<br>
CASCertificatePath /opt/rh/httpd24/root/etc/<wbr>httpd/certs<br>
</div>
<div><VirtualHost *.443><br>
...<br>
</div>
<div></VirtualHost><br>
<br>
</div>
<div>And modify the two locations as follows:<br>
<br>
</div>
<Location "/pun"><br>
<div>
<div># AuthType Basic<br>
# AuthName "Private"<br>
# AuthUserFile "/opt/rh/httpd24/root/etc/<wbr>httpd/.htpasswd"<br>
AuthType CAS<br>
...<br>
</div>
<div></Location><br>
<br>
</div>
<div><Location "/nginx"><br>
# AuthType Basic<br>
# AuthName "Private"<br>
# AuthUserFile "/opt/rh/httpd24/root/etc/<wbr>httpd/.htpasswd"<br>
AuthType CAS<br>
...<br>
</div>
<div></Location><br>
<br>
<br>
Hope you will find the above instructions useful. <br>
<br>
</div>
<div>Ping<br>
</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Wed, Nov 1, 2017 at 11:03 AM, <span dir="ltr"><<a href="mailto:ood-users-request@lists.osc.edu" target="_blank">ood-users-request@lists.osc.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
Send OOD-users mailing list submissions to<br>
<a href="mailto:ood-users@lists.osc.edu" target="_blank">ood-users@lists.osc.edu</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="https://lists.osu.edu/mailman/listinfo/ood-users" rel="noreferrer" target="_blank">
https://lists.osu.edu/mailman/<wbr>listinfo/ood-users</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:ood-users-request@lists.osc.edu" target="_blank">ood-users-request@lists.osc.<wbr>edu</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:ood-users-owner@lists.osc.edu" target="_blank">ood-users-owner@lists.osc.edu</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of OOD-users digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. CAS authentication (Benjamin Evans)<br>
<br>
<br>
------------------------------<wbr>------------------------------<wbr>----------<br>
<br>
Message: 1<br>
Date: Tue, 31 Oct 2017 14:38:41 -0400<br>
From: Benjamin Evans <<a href="mailto:b.evans@yale.edu" target="_blank">b.evans@yale.edu</a>><br>
To: <a href="mailto:ood-users@lists.osc.edu" target="_blank">ood-users@lists.osc.edu</a><br>
Subject: [OOD-users] CAS authentication<br>
Message-ID:<br>
<<wbr>CAOVMLG5ztTWURaZB8i9Hh2QLXVoCi<wbr>-F1x1CbuokgFox06ZQ=<a href="mailto:Rg@mail.gmail.com" target="_blank">Rg@mail.<wbr>gmail.com</a>><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
Hello list,<br>
<br>
I've gotten a test ood server running for one of our clusters and so far my<br>
colleagues and I are quite happy. Out of laziness and an allergy to<br>
duplication of work I wanted to ping this list to see if anyone had gotten<br>
CAS authentication working. If not, is there is a good place to look in the<br>
source to get started doing so? I'd love for whatever work we do to not go<br>
to waste!<br>
<br>
Cheers,<br>
Ben<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://lists.osu.edu/pipermail/ood-users/attachments/20171031/3221ee25/attachment-0001.html" rel="noreferrer" target="_blank">http://lists.osu.edu/<wbr>pipermail/ood-users/<wbr>attachments/20171031/3221ee25/<wbr>attachment-0001.html</a>><br>
<br>
------------------------------<br>
<br>
Subject: Digest Footer<br>
<br>
______________________________<wbr>_________________<br>
OOD-users mailing list<br>
<a href="mailto:OOD-users@lists.osc.edu" target="_blank">OOD-users@lists.osc.edu</a><br>
<a href="https://lists.osu.edu/mailman/listinfo/ood-users" rel="noreferrer" target="_blank">https://lists.osu.edu/mailman/<wbr>listinfo/ood-users</a><br>
<br>
<br>
------------------------------<br>
<br>
End of OOD-users Digest, Vol 9, Issue 1<br>
******************************<wbr>*********<br>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>