A question about Icinga-web and shibboleth

[Manuel Haim]

Hi,

we are running an Icinga-web 1.7.1 under Debian GNU/Linux and connected
it to Shibboleth as follows:

1. We protect Icinga-web 1.7.1 by a Shibboleth lazy session in Apache:

        <Location /icinga-web>
                AuthType shibboleth
                ShibRequestSetting requireSession 0
                Require shibboleth
        </Location>

... so you can still login with a local account if the Shibboleth IdP fails.

2. We extended Icinga-web's HTTPBasicAuth module
(HTTPBasicAuthenticationModel.class.php) to the attached
Shib2Model.class.php

3. In order to perform a Shibboleth login, you call
https://yourserver.example.org/Shibboleth.sso/Login?target=https://yourserver.example.com/icinga-web/

How to setup:

The global configuration at
/usr/share/icinga-web/app/modules/AppKit/config/auth.xml remains unchanged!

You only change /etc/icinga-web/conf.d/auth.xml as follows:

...
<setting name="provider">
        <!-- added by haimm -->
        <ae:parameter name="http-basic-authentication">
            <ae:parameter name="auth_enable">false</ae:parameter>
        </ae:parameter>
        <ae:parameter name="shibboleth">
            <ae:parameter name="auth_module">AppKit</ae:parameter>
            <ae:parameter
name="auth_provider">Auth.Provider.Shib2</ae:parameter>
            <ae:parameter name="auth_enable">true</ae:parameter>
            <ae:parameter name="auth_authoritative">true</ae:parameter>
            <ae:parameter name="auth_create">true</ae:parameter>
            <ae:parameter name="auth_update">true</ae:parameter>
        </ae:parameter>
...
</setting>
...

Then you customize our Shib2Model.class.php file (see attachment) and
copy it to /usr/share/icinga-web/app/modules/AppKit/models/Auth/Provider/

Finally you clear Icinga-web cache:
# rm -rf /var/cache/icinga-web/config/*.php


-Manuel



Am 20.09.2013 11:46, schrieb Moonlight:
> Hi,
> I want to use Shibboleth as authentication method for the Icinga-web. I have
> configured appache (protected URLs) and I used native basic auth with the
> http auth provider in icinga web (by disabling the internal auth).when i
> call the sp.mydomein.de/icinga-web it redirects me to the Idp and i can
> login with my institute's username/password but after logging, i see the
> default login page of Icinga-web Again! I tried a lot but I didnt find a
> solution how to skip this default login page. 
> I would really appriciate it if someone could give me more hints on changing
> the configurations to bypass the default login page of Icinga-web. 
> Thanks,
> 
> 
> 
> 
> --
> View this message in context: http://shibboleth.1660669.n2.nabble.com/A-question-about-Icinga-web-and-shibboleth-tp7590121.html
> Sent from the Shibboleth - Users mailing list archive at Nabble.com.
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: Shib2Model.class.php
Type: application/x-php
Size: 2810 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20130920/722b0a90/attachment.bin