<div dir="ltr"><div class="gmail_quote"><div dir="ltr">Hi Peter,<div><br></div><div>As you noted your web environment is essentially holding the login token.</div><div>When you click logout, Apache serves up the "you are logged out" page, processes the authentication configuration and, because of this line:,</div>
<div class="">
<div><span style="font-family:arial,sans-serif;font-size:13px"># allow web auth to pass login status to RT</span><br style="font-family:arial,sans-serif;font-size:13px"><span style="font-family:arial,sans-serif;font-size:13px">Set($WebRemoteUserAuth, 1);</span><br>
</div></div><div><span style="font-family:arial,sans-serif;font-size:13px">RT accepts the authentication from Apache which logs the user back in.</span></div><div><span style="font-family:arial,sans-serif;font-size:13px"><br>
</span></div>
<div><span style="font-family:arial,sans-serif;font-size:13px">Consider it from the point of view that the Apache based authentication controls access to the directory on the webserver that contains the website files. As far as RT is concerned it is piggy backing on this authentication procedure so that it can figure out who's logged in. In order for one of your users to log out they need to kill the session with Apache i.e. close the browser</span></div>
<div><span style="font-family:arial,sans-serif;font-size:13px">So in short, your login session on RT is tied to the web browsers session with the web server.</span></div><div><br></div><div>To make it work as you would like (clicking logout ends Apaches login session) the website would need to make a change to the web server. This generally is not allowed to happen as it's a potential security flaw.</div>
<div><br></div><div>If you want the users login session to be controlled by the RT application then you'll need to configure LDAP authentication within the RT Configuration.</div><div>To be able to do this you need at least these Perl modules (and maybe some others that I'm neglecting too);</div>
<div>Net::LDAP</div><div>RT::Authen::ExternalAuth<br></div><div><br></div><div>You then need to add the plugin to your RT_SiteConfig.pm;</div><div>Set( @Plugins, qw(RT::Authen::ExternalAuth) );<br></div><div><br></div><div>
And set the LDAP configuration by following the example SiteConfig file in the plugin etc directory.</div><div>Lastly you'll need to remove the Auth config from your Apache virtual host and change:</div><div><span style="font-family:arial,sans-serif;font-size:13px">Set($WebRemoteUserAuth, 1);</span><br>
</div><div><span style="font-family:arial,sans-serif;font-size:13px">to</span></div><div><span style="font-family:arial,sans-serif;font-size:13px">Set($WebRemoteUserAuth, 0);</span><span style="font-family:arial,sans-serif;font-size:13px"><br>
</span></div><div><br></div><div><br></div><div>Kind regards,</div><div>Rory Clerkin</div></div><div class="gmail_extra"><br><div><div class="h5">
<br><br><div class="gmail_quote">On 23 May 2014 09:27, Flynn, Peter <span dir="ltr"><<a href="mailto:pflynn@ucc.ie" target="_blank">pflynn@ucc.ie</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
I have managed to get authentication using LDAP working OK, but I seem<br>
to have missed or misunderstood something about persistence.<br>
<br>
When I click on Logout, I get logged out and immediately logged back in<br>
again. I think I can see why this would happen, in the sense that the<br>
web environment still holds the authenticated token, and presumably RT<br>
just looks for it and finds it again.<br>
<br>
Is there a way to stop this happening? Closing the tab doesn't prevent<br>
it; closing down the browser does, of course, but most users will not<br>
want to do that (being required to close a sovereign application simply<br>
to terminate a session in a tab is not a good practice).<br>
<br>
After a logout from an LDAP-authenticated session, it should display<br>
RT's own login screen. If the user really, really, really wants another<br>
session with different LDAP credentials (or even a repeat of her own),<br>
then indeed closing the browser is required, but that's an edge case.<br>
<br>
The settings I am using are:<br>
<br>
httpd.conf<br>
----------<br>
<VirtualHost *:80><br>
ServerAdmin <a href="mailto:pflynn@ucc.ie" target="_blank">pflynn@ucc.ie</a><br>
ServerName <a href="http://foobar.ucc.ie" target="_blank">foobar.ucc.ie</a><br>
ErrorLog logs/foobar.ucc.ie-error_log<br>
LogLevel debug<br>
CustomLog logs/foobar.ucc.ie-access_log combined<br>
AddDefaultCharset UTF-8<br>
FcgidMaxRequestLen 1073741824<br>
ScriptAlias / /opt/rt4/sbin/rt-server.fcgi/<br>
DocumentRoot "/opt/rt4/share/html"<br>
<Location /><br>
Order allow,deny<br>
Allow from all<br>
Options +ExecCGI<br>
AddHandler fcgid-script fcgi<br>
</Location><br>
<Directory /><br>
Order deny,allow<br>
Deny from All<br>
AuthType Basic<br>
AuthBasicProvider file ldap<br>
AuthBasicAuthoritative off<br>
AuthUserFile /var/www/htaccess/foobar<br>
AuthGroupFile /dev/null<br>
AuthzLDAPAuthoritative off<br>
AuthName "Login with your email address and password"<br>
AuthLDAPURL ldap://aaa.bbb.ccc.ddd:ppp/DC=ad,DC=ucc,DC=ie?mail<br>
AuthLDAPBindDN "xxxxx"<br>
AuthLDAPBindPassword 'yyyyy'<br>
Require valid-user<br>
</Directory><br>
</VirtualHost><br>
<br>
RT_SiteConfig.pm (omitting values set at webconfig time)<br>
----------------<br>
# allow web auth to pass login status to RT<br>
Set($WebRemoteUserAuth, 1);<br>
# allow RT to show login screen if web auth failed<br>
Set($WebFallbackToRTLogin, 1);<br>
# allow an hour's inactivity (10 min for testing)<br>
Set($AutoLogoff, 10);<br>
# standard password must be 10 chars min<br>
Set($MinimumPasswordLength, 10);<br>
# use ISO dates<br>
Set($DateTimeFormat, { Format => "ISO", Seconds => 0 });<br>
<br>
///Peter<br>
<span><font color="#888888">--<br>
Peter Flynn | Academic & Collaborative Technologies | University College<br>
Cork IT Services | ☎ <a href="tel:%2B353%2021%20490%202609" value="+353214902609" target="_blank">+353 21 490 2609</a> | ✉ <a href="mailto:pflynn@ucc.ie" target="_blank">pflynn@ucc.ie</a> | 🌍 <a href="http://www.ucc.ie" target="_blank">www.ucc.ie</a><br>
--<br>
RT Training - Boston, September 9-10<br>
<a href="http://bestpractical.com/training" target="_blank">http://bestpractical.com/training</a></font></span></blockquote></div><br></div></div></div>
</div><br></div>