<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"comic sans ms";
panose-1:3 15 7 2 3 3 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.m3299963118336498496hoenzb
{mso-style-name:m_3299963118336498496hoenzb;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Your auth lines look good, my previous email forgot the unset of Authorization header. I don’t think AuthName will get used because that typically is what populates basic auth dialogue box. Every time I’ve used CAS the request redirects
to CAS login form so you won’t get the basic auth dialogue box.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">- Trey<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">-- <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">Trey Dockendorf<o:p></o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">HPC Systems Engineer<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">Ohio Supercomputer Center</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">OOD-users <ood-users-bounces@lists.osc.edu> on behalf of "E.M. Dragowsky" <dragowsky@case.edu><br>
<b>Reply-To: </b>User support mailing list for Open OnDemand <ood-users@lists.osc.edu><br>
<b>Date: </b>Monday, August 20, 2018 at 11:45 AM<br>
<b>To: </b>User support mailing list for Open OnDemand <ood-users@lists.osc.edu><br>
<b>Subject: </b>Re: [OOD-users] Implementing authentication via CAS<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-family:"comic sans ms"">Ah...a simple resolution: In ood_portal.yml, the 'servername' field requires specifying a public IP, which I had inadvertently not supplied.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-family:"comic sans ms"">So for our site, authentication using CAS is working, and it seems reasonably straightforward to configure. If anyone can review what I've done, I'm open to receiving
critiques:<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"comic sans ms"">ood_portal.yml<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-family:"comic sans ms"">servername: [public-ip-name]<br>
<br>
auth:<br>
- 'AuthType CAS'<br>
- 'AuthName "Private"'<br>
- 'RequestHeader unset Authorization'<br>
- 'Require valid-user'<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-family:"comic sans ms"">/opt/rh/httpd24/root/etc/httpd/conf.d/cas.conf<br>
LoadModule auth_cas_module /opt/rh/httpd24/root/etc/httpd/modules/mod_auth_cas.so<br>
CASLoginURL [local-login-url]<br>
CASValidateURL [local-validate-url]<br>
CASCertificatePath /opt/rh/httpd24/root/etc/httpd/cas-cert/ca-certificate.crt<br>
CASDebug On<br>
CASCookiePath /opt/rh/httpd24/root/etc/httpd/run/cookie/<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"comic sans ms"">Cheers<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"comic sans ms"">~ Em<o:p></o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Mon, Aug 20, 2018 at 10:27 AM, E.M. Dragowsky <<a href="mailto:dragowsky@case.edu" target="_blank">dragowsky@case.edu</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">In reviewing the differences between ood-portal.conf in the successful test case, and the 'standard' configuration, the meaningful differences are few:<br>
<br>
< <VirtualHost [host-public-ip]:80><br>
---<br>
> <VirtualHost *:80><br>
87c87<br>
< AuthType CAS<br>
---<br>
> AuthType Basic<br>
89c89<br>
< #AuthUserFile "/opt/rh/httpd24/root/etc/httpd/.htpasswd"<br>
---<br>
> AuthUserFile "/opt/rh/httpd24/root/etc/httpd/.htpasswd"<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Only setting the VIrtualHost through ood_config.yml is unclear -- the other two values are somewhat documented in the code. I tried to set the public IP using the 'servername' keyword, and then also 'virtualhost', and in both cases the
result was 'VIrtualHost *:80'<br>
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks<o:p></o:p></p>
</div>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Fri, Aug 17, 2018 at 4:45 PM, E.M. Dragowsky <<a href="mailto:dragowsky@case.edu" target="_blank">dragowsky@case.edu</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">Greetings --<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">Is anyone able to provide guidance on editing ood_portal.yml to support CAS authentication? I tried a few ideas that did not work, based on our implementation test outlined below -- which provided a successful
test.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">Thanks in advance<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">=-=-=-=-=<br>
We have implemented CAS through a download and build of mod_auth_cas from this repo:
<a href="https://github.com/apereo/mod_auth_cas" target="_blank">https://github.com/apereo/mod_auth_cas</a>. The service was configured in the system, and then we made ad-hoc edits to the existing ood configuration in /opt/rh/httpd24/root/etc/httpd/conf.d to
verify that the service would recognize OoD.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">This was realized through direct edit of the ood-portal.conf, and by creating a cas.conf file in /opt/rh/httpd24/root/etc/httpd/conf.d<o:p></o:p></p>
</div>
<p class="MsoNormal"><span class="m3299963118336498496hoenzb"><span style="color:#888888"><o:p> </o:p></span></span></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#888888"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span style="color:#888888"><br>
<br>
<br>
<span class="m3299963118336498496hoenzb">-- </span></span><span class="m3299963118336498496hoenzb"><o:p></o:p></span></p>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"comic sans ms";color:#888888">E.M. Dragowsky, Ph.D.</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"comic sans ms";color:#888888">Research Computing -- UTech</span><span style="color:#888888"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"comic sans ms";color:#888888">Case Western Reserve University</span><span style="color:#888888"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"comic sans ms";color:#888888">(216) 368-0082</span><span style="color:#888888"><o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><br>
<br clear="all">
<br>
-- <o:p></o:p></p>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"comic sans ms"">E.M. Dragowsky, Ph.D.</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"comic sans ms"">Research Computing -- UTech</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"comic sans ms"">Case Western Reserve University</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"comic sans ms"">(216) 368-0082</span><o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><br>
<br clear="all">
<br>
-- <o:p></o:p></p>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"comic sans ms"">E.M. Dragowsky, Ph.D.</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"comic sans ms"">Research Computing -- UTech</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"comic sans ms"">Case Western Reserve University</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"comic sans ms"">(216) 368-0082</span><o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>