Skip to content

Auth by Remote-User-Email HTTP header (with apache conf can allow auth ssl certificates)

Notifications You must be signed in to change notification settings

vitstradal/redmine_remote_user_auth

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

13 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Redmine Remote User auth plugin

With reverse proxy it can be used to use SSL certificate to login. Plugin checks HTTP header Remote-User-Email. If user with such email exists he/she will be logged in.

Require

Redmine 2.x

Installation

Before installing make sure to stop redmine.

cd [redmine-install-dir]/plugins
export RAILS_ENV=production
git clone git://XXXX
cd ..
rake redmine:plugins:migrate
bundle install --without development test

After this steps you can switch back on redmine. Existing users will gain Remote User auth method (Look at Administration > Users).

Configuration

Reverse proxy must:

  • check certificate

  • unset Remote-User_email

  • header an set it to DN_Email from certificate

Apache example:

SSLEngine on
SSLProtocol all 
SSLCipherSuite HIGH:MEDIUM

SSLCertificateFile /etc/apache2/ssl/server.crt
SSLCertificateKeyFile /etc/apache2/ssl/server.key
SSLCACertificateFile /etc/apache2/ssl/ca.crt

SetEnvIf User-Agent ".*MSIE.*" \
        nokeepalive ssl-unclean-shutdown \
        downgrade-1.0 force-response-1.0

SSLVerifyClient optional
SSLVerifyDepth 1
SSLOptions +StdEnvVars

RequestHeader unset Remote-User-Email RequestHeader set Remote-User-Email “%{SSL_CLIENT_S_DN_Email}e”

SSLVerifyClient require

Nginx example:

server {
       #....
       proxy_pass http://127.0.0.1:3000/$1...;
       proxy_set_header Remote-User-Email $ssl_client_s_dn;
}

With valid certificate you can still log-in as users with normal Auth Method.

Uninstall

Before installing make sure to stop redmine and before that to disable Remote User auth method for all users (Look at Administration > Users)

cd [redmine-install-dir]
export RAILS_ENV=production
rake redmine:plugins:migrate NAME=redmine_remote_user_auth VERSION=0
rm -Rf plugins/redmine_cert_auth

After this steps you can switch back on redmine.

About

Auth by Remote-User-Email HTTP header (with apache conf can allow auth ssl certificates)

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published