Request Tracker (RT) 4 with Shibboleth?

[Paul Riddle]

On 07/12/2012 10:44 AM, Todd Piket wrote:
> If all you want is authentication then you should be able to just use REMOTE_USER.  Enable WebExternalAuth in RT (http://wiki-archive.bestpractical.com/view/WebExternalAuth) and then put RT behind an SP that talks to an appropriate IDP.  The SP/mod_shib will handle all the redirection and set REMOTE_USER upon successful authentication and, voila, your RT is shibbolized.
>
> Note I have not actually done this, but I did set up an RT instance to use an external SSO system when I was at Michigan Tech which has the same basic concept as Shib.  User accesses resource, resource redirects to central login page, user authenticates at central login page, central login page redirects user back to resource, resource sees REMOTE_USER is set and lets user in.  Resource specific authorization kicks in from there.
>
> Regards,
>
> Todd Piket, Information Technology Services
> Minnesota State Colleges and Universities
> todd.piket at so.mnscu.edu  651-728-3198
>
> "By failing to prepare, you are preparing to fail."  -- Benjamin Franklin

This is exactly what we've done here.  We run RT 4.0.6 behind a 
Shibboleth SP.  We use WebExternalAuth and map the RT username onto 
REMOTE_USER.  We've been running this way for about 3 years without issue.

> On Jul 12, 2012, at 9:27 AM, Andy Fleming wrote:
>
>> Has anyone on this listed tried to shibboleth with RT4?  There is some information on a couple of different ways to integrate RT 3 with Federated logins and even a very old CPAN module, RT-Authen-Federation, but I haven't been able to find any info about anyone having done it with RT4.
>>
>> I realize it might be a long shot, but wanted to post in-case someone on this list had setup RT with Shib.
>>
>> -- Thanks  Andy
>>
>> --
>> Andy Fleming - RHCE
>> Sr Systems Administrator
>> Kansas Research and Education Network

I believe the RT-Authen-Federation module tries to take this a step 
further, using attributes to populate fields in RT's user database.  But 
it's been awhile since I looked at that, and we're not doing anything 
like that here.

Paul