"require ip 127.0.0.1" was put to allow local mail requests to pass, moved it to a separate location in config.<div><br></div><div><div>#Allow mail gateway to send mails via RT site</div><div> <Location /REST/1.0/NoAuth/mail-gateway></div><div> Order deny,allow</div><div> Deny from all</div><div> Allow from localhost</div><div> Satisfy any</div><div> </Location></div><div><br></div><div> <Location /NoAuth></div><div> Satisfy any</div><div> Allow from all</div><div> </Location></div></div><div><br></div><div>SSO works fine with machines that are members of the local AD.</div><div>The authorization problem arises when I try to login from machine that is not a member of AD. I thought that with<span style="font-size:13.1999998092651px"> "</span><span style="font-size:13.1999998092651px">$WebFallbackToRTLogin" set to true, the user is redirected to RT login form when authentication with Kerberos fails. Am I missing something here? Or should I just setup another virtual host without SSO to be able to logon with local users as suggested in this <a href="http://www.gossamer-threads.com/lists/rt/users/117509#117509">post</a>?</span></div><div><span style="font-size:13.1999998092651px"><br></span></div><div><span style="font-size:13.1999998092651px">Regards,</span></div><div><span style="font-size:13.1999998092651px">Myrat</span></div><div><span style="font-size:13.1999998092651px"><br></span></div><div><span style="font-size:13.1999998092651px">On Tue Feb 03 2015 at 2:08:30 AM Kevin Falcone <<a href="mailto:falcone@bestpractical.com">falcone@bestpractical.com</a>> wrote:</span><br></div><div><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On Mon, Feb 02, 2015 at 07:51:20AM +0000, Myrat Saparow wrote:<br>
> I have been trying to implement SSO on our RT test enviroment, the SSO login<br>
> from machines that are authenticated by our dc works fine but I can't get it to<br>
> fall back to RT login when SSO fails. I constantly get the "Unauthorized" page<br>
> from Apache instead.<br>
<br>
I believe you want to read up on the Satisfy directive.<br>
There's some additional docs here:<br>
<a href="https://bestpractical.com/docs/rt/latest/authentication" target="_blank">https://bestpractical.com/<u></u>docs/rt/latest/authentication</a><br>
<a href="http://httpd.apache.org/docs/2.2/mod/core.html#satisfy" target="_blank">http://httpd.apache.org/docs/<u></u>2.2/mod/core.html#satisfy</a><br>
<br>
-kevin<br>
<br>
> Can someone help me with configuring falling back to RT login?<br>
><br>
> Environment:<br>
> Ubuntu Server 14.01<br>
> RT 4.2.9<br>
> Apache2<br>
> mod_auth_kerb + krb5<br>
><br>
> Relevant config file entries<br>
><br>
> RT_Siteconfig.pm<br>
><br>
> Set( $WebRemoteUserAuth, 1);<br>
> Set( $WebRemoteUserInfo, 1);<br>
> Set( $WebRemoteUserContinuous, 1);<br>
> Set( $WebFallbackToRTLogin, 1);<br>
> Set( $WebRemoteUserAutocreate, 1);<br>
> Set( $<u></u>UserAutocreateDefaultsOnLogin, { Privileged => 0 });<br>
><br>
><br>
> /etc/apache2/sites-available/<u></u>rt.conf<br>
><br>
> <Location /><br>
> AuthType Kerberos<br>
> Krb5Keytab /etc/apache2/http.keytab<br>
> KrbMethodNegotiate on<br>
> KrbMethodK5Passwd off<br>
> KrbLocalUserMapping on<br>
> Require valid-user<br>
> Require ip 127.0.0.1<br>
> AllowOverride None<br>
> </Location><br>
><br>
> /var/log/apache2/error.log<br>
><br>
> [Mon Feb 02 12:10:45.728093 2015] [ssl:info] [pid 27607:tid 140437369087744]<br>
> [client xxx.xxx.xxx.xxx:3832] AH01964: Connection to child 10 established<br>
> (server rt.server:443)<br>
> [Mon Feb 02 12:10:45.728678 2015] [socache_shmcb:debug] [pid 27607:tid<br>
> 140437369087744] mod_socache_shmcb.c(520): AH00835: socache_shmcb_retrieve<br>
> (0xc1 -> subcache 1)<br>
> [Mon Feb 02 12:10:45.728708 2015] [socache_shmcb:debug] [pid 27607:tid<br>
> 140437369087744] mod_socache_shmcb.c(843): AH00849: match at idx=0, data=0<br>
> [Mon Feb 02 12:10:45.728716 2015] [socache_shmcb:debug] [pid 27607:tid<br>
> 140437369087744] mod_socache_shmcb.c(530): AH00836: leaving<br>
> socache_shmcb_retrieve successfully<br>
> [Mon Feb 02 12:10:45.730549 2015] [ssl:debug] [pid 27607:tid 140437369087744]<br>
> ssl_engine_kernel.c(1844): [client xxx.xxx.xxx.xxx:3832] AH02041: Protocol:<br>
> TLSv1, Cipher: RC4-SHA (128/128 bits)<br>
> [Mon Feb 02 12:10:45.732144 2015] [ssl:debug] [pid 27607:tid 140437369087744]<br>
> ssl_engine_kernel.c(222): [client xxx.xxx.xxx.xxx:3832] AH02034: Initial (No.1)<br>
> HTTPS request received for child 10 (server rt.server:443)<br>
> [Mon Feb 02 12:10:45.732270 2015] [authz_core:debug] [pid 27607:tid<br>
> 140437369087744] mod_authz_core.c(802): [client xxx.xxx.xxx.xxx:3832] AH01626:<br>
> authorization result of Require valid-user : denied (no authenticated user yet)<br>
> [Mon Feb 02 12:10:45.732312 2015] [authz_core:debug] [pid 27607:tid<br>
> 140437369087744] mod_authz_core.c(802): [client xxx.xxx.xxx.xxx:3832] AH01626:<br>
> authorization result of Require ip [1]<a href="http://127.0.0.1" target="_blank">127.0.0.1</a>: denied<br>
> [Mon Feb 02 12:10:45.732336 2015] [authz_core:debug] [pid 27607:tid<br>
> 140437369087744] mod_authz_core.c(802): [client xxx.xxx.xxx.xxx:3832] AH01626:<br>
> authorization result of <RequireAny>: denied (no authenticated user yet)<br>
> [Mon Feb 02 12:10:45.732377 2015] [auth_kerb:debug] [pid 27607:tid<br>
> 140437369087744] src/mod_auth_kerb.c(1652): [client xxx.xxx.xxx.xxx:3832]<br>
> kerb_authenticate_user entered with user (NULL) and auth_type Kerberos<br>
> [Mon Feb 02 12:10:45.734251 2015] [ssl:debug] [pid 27607:tid 140437360695040]<br>
> ssl_engine_kernel.c(222): [client xxx.xxx.xxx.xxx:3832] AH02034: Subsequent<br>
> (No.2) HTTPS request received for child 10 (server rt.server:443)<br>
> [Mon Feb 02 12:10:45.734355 2015] [authz_core:debug] [pid 27607:tid<br>
> 140437360695040] mod_authz_core.c(802): [client xxx.xxx.xxx.xxx:3832] AH01626:<br>
> authorization result of Require valid-user : denied (no authenticated user yet)<br>
> [Mon Feb 02 12:10:45.734390 2015] [authz_core:debug] [pid 27607:tid<br>
> 140437360695040] mod_authz_core.c(802): [client xxx.xxx.xxx.xxx:3832] AH01626:<br>
> authorization result of Require ip [2]<a href="http://127.0.0.1" target="_blank">127.0.0.1</a>: denied<br>
> [Mon Feb 02 12:10:45.734413 2015] [authz_core:debug] [pid 27607:tid<br>
> 140437360695040] mod_authz_core.c(802): [client xxx.xxx.xxx.xxx:3832] AH01626:<br>
> authorization result of <RequireAny>: denied (no authenticated user yet)<br>
> [Mon Feb 02 12:10:45.734447 2015] [auth_kerb:debug] [pid 27607:tid<br>
> 140437360695040] src/mod_auth_kerb.c(1652): [client xxx.xxx.xxx.xxx:3832]<br>
> kerb_authenticate_user entered with user (NULL) and auth_type Kerberos<br>
> [Mon Feb 02 12:10:45.734513 2015] [auth_kerb:debug] [pid 27607:tid<br>
> 140437360695040] src/mod_auth_kerb.c(1260): [client xxx.xxx.xxx.xxx:3832]<br>
> Acquiring creds for HTTP@rt.server<br>
> [Mon Feb 02 12:10:45.739959 2015] [auth_kerb:debug] [pid 27607:tid<br>
> 140437360695040] src/mod_auth_kerb.c(1406): [client xxx.xxx.xxx.xxx:3832]<br>
> Verifying client data using KRB5 GSS-API<br>
> [Mon Feb 02 12:10:45.740081 2015] [auth_kerb:debug] [pid 27607:tid<br>
> 140437360695040] src/mod_auth_kerb.c(1422): [client xxx.xxx.xxx.xxx:3832]<br>
> Client didn't delegate us their credential<br>
> [Mon Feb 02 12:10:45.740113 2015] [auth_kerb:debug] [pid 27607:tid<br>
> 140437360695040] src/mod_auth_kerb.c(1450): [client xxx.xxx.xxx.xxx:3832]<br>
> Warning: received token seems to be NTLM, which isn't supported by the Kerberos<br>
> module. Check your IE configuration.<br>
> [Mon Feb 02 12:10:45.740139 2015] [auth_kerb:debug] [pid 27607:tid<br>
> 140437360695040] src/mod_auth_kerb.c(1121): [client xxx.xxx.xxx.xxx:3832]<br>
> GSS-API major_status:00010000, minor_status:00000000<br>
> [Mon Feb 02 12:10:45.740178 2015] [auth_kerb:error] [pid 27607:tid<br>
> 140437360695040] [client xxx.xxx.xxx.xxx:3832] gss_accept_sec_context() failed:<br>
> An unsupported mechanism was requested (, Unknown error)<br>
><br>
><br>
> Best Regards,<br>
> Myrat<br>
><br>
> References:<br>
><br>
> [1] <a href="http://127.0.0.1/" target="_blank">http://127.0.0.1/</a><br>
> [2] <a href="http://127.0.0.1/" target="_blank">http://127.0.0.1/</a><br>
</blockquote></div></div>