[rt-users] RT with https (external authentication)

Mon Mar 20 14:08:39 EST 2006

Sounds like your running into a Virtual Hosts discrimination problem. Are you running any other VHOSTS on that box?

I'm running that exact config with external auth and https and I learned the hardway about SSL sessions and their dependancy to an Identifier like a port or IP Address.

One other comment: I run both the SSL and the Standard config in the same .conf file for ease of use. I've included a sanitized version below:

#
# rt3prod.conf
# Request Tracker 3.4 Production Server
# Apache Configuration File
#
# $Author: merana $
# $Revision: 16 $
# $HeadURL: file:///var/svn/anon-prod/trunk/etc/rt3prod.conf $
# $Id: rt3prod.conf 16 2006-03-15 12:09:44Z merana $

FastCgiServer /usr/share/request-tracker3.4/libexec/mason_handler.fcgi

NameVirtualHost 192.168.1.49:80
<VirtualHost 192.168.1.49:80>
  ServerName rt.mydomain.com
  ServerAlias rt2.mydomain.com
  DocumentRoot /usr/share/request-tracker3.4/html
  AddDefaultCharset UTF-8
  ScriptAlias / /usr/share/request-tracker3.4/libexec/mason_handler.fcgi/
  AddHandler fastcgi-script fcgi
  CustomLog /var/log/apache2/rt.access.log combined env=!dontlog
  ErrorLog /var/log/apache2/rt.error.log

  RewriteEngine on

  #RewriteRule ^/rt$ /
  #RewriteRule ^/rt/(.*)$ /$1
  #RewriteRule ^/rt$ /rt/
  #RewriteCond %{REQUEST_FILENAME} -d
  #RewriteRule ^(/usr/share/request-tracker3.4/html.*)/$ $1/index.html

  <Location />
    SetHandler fastcgi-script
  </Location>

  <Directory /usr/share/request-tracker3.4/html>
    SetHandler fastcgi-script
  </Directory>

  <Directory /usr/share/request-tracker3.4/html/NoAuth>
    SetHandler default-handler
  </Directory>

</VirtualHost>

NameVirtualHost 192.168.1.49:443
<VirtualHost 192.168.1.49:443>
  ServerName rt.mydomain.com
  ServerAlias rt2.mydomain.com
  DocumentRoot /usr/share/request-tracker3.4/html
  AddDefaultCharset UTF-8
  ScriptAlias / /usr/share/request-tracker3.4/libexec/mason_handler.fcgi/
  AddHandler fastcgi-script fcgi
  CustomLog /var/log/apache2/rt.access.log combined env=!dontlog
  ErrorLog /var/log/apache2/rt.error.log

#   SSL Engine Switch:
#   Enable/Disable SSL for this virtual host.
SSLEngine on

#   SSL Cipher Suite:
#   List the ciphers that the client is permitted to negotiate.
#   See the mod_ssl documentation for a complete list.
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL

#   Server Certificate & Key Files
SSLCertificateFile /etc/apache2/ssl/rt-cert.cer
SSLCertificateKeyFile /etc/apache2/ssl/rt-cert.key

#   SSL Protocol Adjustments:
#   The safe and default but still SSL/TLS standard compliant shutdown
#   approach is that mod_ssl sends the close notify alert but doesn't wait for
#   the close notify alert from client. When you need a different shutdown
#   approach you can use one of the following variables:
SetEnvIf User-Agent ".*MSIE.*" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0
  RewriteEngine on

  #RewriteRule ^/rt$ /
  #RewriteRule ^/rt/(.*)$ /$1
  #RewriteRule ^/rt$ /rt/
  #RewriteCond %{REQUEST_FILENAME} -d
  #RewriteRule ^(/usr/share/request-tracker3.4/html.*)/$ $1/index.html

  <Location />
    SetHandler fastcgi-script
  </Location>

  <Directory /usr/share/request-tracker3.4/html>
    SetHandler fastcgi-script
  </Directory>

  <Directory /usr/share/request-tracker3.4/html/NoAuth>
    SetHandler default-handler
  </Directory>

</VirtualHost>

Michael Eraña, CISSP
CTO
PC Network, Inc.          
eranam at lanusa.com   