[Bug 17776] New: Shibboleth Authentication is broken in plack
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Bug ID: 17776 Summary: Shibboleth Authentication is broken in plack Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Authentication Assignee: gmcharlt@gmail.com Reporter: martin.renvoize@ptfs-europe.com QA Contact: testopia@bugs.koha-community.org CC: dpavlin@rot13.org Shibboleth authentication relies heavily on per request environment variable, which doesn't play nicely with persistent apps (plack). We need to convert to using request headers in this case and update the documentation to reflect this alteration. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |katrin.fischer@bsz-bw.de --- Comment #1 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Should this be enh or more a bug? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Mirko Tietgen <mirko@abunchofthings.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|enhancement |normal CC| |mirko@abunchofthings.net --- Comment #2 from Mirko Tietgen <mirko@abunchofthings.net> --- If it's broken it's a bug. ;) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 --- Comment #3 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 60800 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=60800&action=edit Enable Shibboleth for Plack -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 --- Comment #4 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- To test: 1) Enable plack 2) Alter the apache config block to ensure shibboleth is passing attributes via headers instead of environment. (when running under plack, apache act's merely as a Proxy and so cannot pass environment to the separate plack process). 3) Checkin shibboleth logins are now working using the plack instance. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Zeno Tajoli <z.tajoli@cineca.it> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |z.tajoli@cineca.it -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 --- Comment #5 from Zeno Tajoli <z.tajoli@cineca.it> --- Do you think we can use http://www.ssocircle.com/en/portfolio/publicidp/ for testing ? Or is better to use https://www.testshib.org/ ? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #60800|0 |1 is obsolete| | --- Comment #6 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 60847 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=60847&action=edit Enable Shibboleth for Plack -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 --- Comment #7 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- So after more local testing, i found that the plack environment could be a little more complex than my initial tests. This patch obsoletes the original and calls 'get_shib_login' later in the runtime (i.e. outside of the begin block) so we have a valid environment by the time the routine run. In short, it should all work now so long as you've updated your Apache configs as per the inline perldoc documentation. I believe the UseHeaders and UseEnvironment variables for the shibboleth service provider software are mutually exclusive (they appeared to be in my brief testing), so I don't believe it is possible to run in a half and half setup (unless you have two entirely separate vhosts.. one for plack and one for non-plack running). -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 --- Comment #8 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- (In reply to Zeno Tajoli from comment #5)
Do you think we can use http://www.ssocircle.com/en/portfolio/publicidp/ for testing ?
Or is better to use https://www.testshib.org/ ?
Either IdP should work perfectly happily. I've tested here against teshshib, openfiede and some customer systems using simplesamlphp and ms active directory services. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |nick@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 --- Comment #9 from Mirko Tietgen <mirko@abunchofthings.net> --- There are two instances of get_shib_login in Auth.pm that probably should be get_login_shib instead? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 --- Comment #10 from Mirko Tietgen <mirko@abunchofthings.net> --- I get redirected to a login page when I add ShibUseEnvironment Off ShibUseHeaders On to my Apache config. There is an additional Require valid-user in the config of the test system, just removing that leads to the same result, so I wonder if it is connected and how I can test around that? <Location /> AuthType shibboleth ShibRequireSession On ShibUseEnvironment Off ShibUseHeaders On Require valid-user </Location> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #60847|0 |1 is obsolete| | --- Comment #11 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 61426 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=61426&action=edit Enable Shibboleth for Plack -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 --- Comment #12 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Fixed the get_login_shib.. thanks for spotting that.. seems I'd already corrected it locally.. Oops. As for the apache config.. It's the `ShibRequireSession On` line that means you are enforcing a shibboleth login for all users I believe.. I don't think that's required if you want optional login. I'm not sure where that line came from on your test system? To help, I've included a copy of my exact config from the demo server where I've been testing: # Optional Shibboleth Configuration - Plack Alternative <Location /> #ShibRequestSetting applicationId demo.koha-ptfs.co.uk AuthType shibboleth ShibUseEnvironment Off ShibUseHeaders On ShibRequireSession Off Require shibboleth #Require valid-user </Location> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 --- Comment #13 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApacheConfig is very helpful for understanding what the different apache directives do ;) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 --- Comment #14 from Mirko Tietgen <mirko@abunchofthings.net> --- Very helpful link, thanks! We are enforcing Shib login on purpose, there is not supposed to be any other way to log in. So that does not work with the config needed for Plack? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 --- Comment #15 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Hmm, slightly confused by the comment then.. I thought you were finding that it was always redirecting but that wasn't the behaviour you wanted. I'll quiz you on IRC tomorrow to clarify the question. Thanks for testing, Martin -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Mason James <mtj@kohaaloha.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mtj@kohaaloha.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |tomascohen@gmail.com Assignee|gmcharlt@gmail.com |martin.renvoize@ptfs-europe | |.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 --- Comment #16 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- What's missing here to get it moving again? I think the Plack - Shibboleth incompatibility is going to be a real problem for users as Koha without Plack is no fun... -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Matthias Meusburger <matthias.meusburger@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |matthias.meusburger@biblibr | |e.com --- Comment #17 from Matthias Meusburger <matthias.meusburger@biblibre.com> --- Mirko, if you'd like to enforce Shib login, you should have a look at Bug 18506. Without enforcing Shib login, we use this patch successfully in production with this configuration: AuthType shibboleth ShibUseEnvironment Off ShibUseHeaders On ShibRequireSession Off Require shibboleth I'm signing this off. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Matthias Meusburger <matthias.meusburger@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Matthias Meusburger <matthias.meusburger@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #61426|0 |1 is obsolete| | --- Comment #18 from Matthias Meusburger <matthias.meusburger@biblibre.com> --- Created attachment 68216 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=68216&action=edit Enable Shibboleth for Plack https://bugs.koha-community.org/show_bug.cgi?id=17776 Signed-off-by: Matthias Meusburger <matthias.meusburger@biblibre.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Barry Cannon <bc@interleaf.ie> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |bc@interleaf.ie --- Comment #19 from Barry Cannon <bc@interleaf.ie> --- I am not sure about this patch. I managed to get it working on 16.11.10 but not on 16.11.13. apply patch, enable plack - shibboleth auth doesn't work. Disable plack and shib works again. Shib log seems to to be comparable during both login attempts. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 --- Comment #20 from Matthias Meusburger <matthias.meusburger@biblibre.com> --- For information, we are currently using it successfully on 16.11.12 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 --- Comment #21 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Patch doesn't apply cleanly to 16.11.13 - could you help resolve? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 --- Comment #22 from Barry Cannon <bc@interleaf.ie> --- I didn't have any problems applying to 16.11.13. However, I tested again and on 16.11.10 it works fine but as soon as I upgrade to 16.11.13 and re-apply the patch the shib error returns. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 --- Comment #23 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- I had a really small conflict, but don't understand the code well enough to risk it. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Matthias Meusburger <matthias.meusburger@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=19625 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |m.de.rooy@rijksmuseum.nl Status|Signed Off |Failed QA --- Comment #24 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- ShibUseHeaders On|Off Defaults to "Off", this turns on the use of request headers to publish attributes to applications. Use of this option should be avoided. Be sure to review the topic on spoof checking if you enable it. You are suggesting to disable ShibUseEnvironment and enable ShibUseHeaders. Please explain. It is not recommended.. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 --- Comment #25 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Can someone explain how to reproduce the problem? It seems to me that if we need to inject ENV variables on a per-request basis we can write a Plack middleware to take care of that. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 --- Comment #26 from Barry Cannon <bc@interleaf.ie> --- To reproduce the problem. - create a koha instance with plack not enabled. - configure shibboleth as normal and confirm login works and maps correctly to a borrower in koha. - enable and start plack for the same instance - observe shib login no longer works (after successful login at idp redirect to koha does not map to correct borrower and login option still available on koha) Oddly, this patch has worked right up to 17.11.01 but since 17.11.02 it has stopped. Applied fine but functionality is no longer there - still trying to figure out why -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Marvin Addison <serac@vt.edu> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |serac@vt.edu --- Comment #27 from Marvin Addison <serac@vt.edu> --- CAUTION. The proposed fix for this issue, enabling request headers to convey Shibboelth attributes, opens a gaping security hole unless other compensating controls are applied. From https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAttributeAccess: ---------- Unfortunately, not all web servers currently expose a mechanism to create custom variables from within server extensions. This is a bug; all web servers should support this in some way, but IIS and Sun/iPlanet do not. On these platforms, the SP is forced to substitute the use of custom HTTP request headers. This is convenient, in that the CGI requires custom headers to be passed along to applications, but is also dangerous and difficult to secure. The SP has had at least two separate major security patches resulting from this mechanism. This is because the header mechanism is really about passing information from the client to the application; any browser can be manipulated to supply arbitrary headers quite easily with little skill. To defend against this, the SP has a number of protections designed to clear out any data supplied by the client that might overlap with the headers it creates. But this is very difficult to get right in practice, and recent versions include a much-enhanced NativeSPSpoofChecking mechanism for actually detecting and blocking requests that carry such headers. When using headers, the main difference is that instead of using the names defined via the mapping process, the application must prefix them with "HTTP_", and in most tools upcase the rest of the name as well. The specifics vary by tool, and in the case of IIS and ASP.NET are even more bizarre because of serious flaws in IIS' CGI implementation. A fair amount of detail on this can be found in the secadv_20090615 topic. The most particular point about ASP.NET is that it provides access to both the transformed headers (all caps, with the HTTP_ prefix) via the ServerVariables collection, and the untransformed input headers via the Headers collection. The latter is much safer to use. ---------- Thus enabling ShibUseHeaders without any other controls allows clients to spoof shibboleth attributes, thereby allowing them to completely bypass authentication and defeat any authorization controls in the worst case. One adequate compensating control is the header spoof prevention facility described at https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSpoofChecking. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=20879 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |19625 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=19625 [Bug 19625] Shibboleth auto-provisioning is broken in plack -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 --- Comment #28 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- (In reply to Marcel de Rooy from comment #24)
ShibUseHeaders On|Off Defaults to "Off", this turns on the use of request headers to publish attributes to applications. Use of this option should be avoided. Be sure to review the topic on spoof checking if you enable it.
You are suggesting to disable ShibUseEnvironment and enable ShibUseHeaders. Please explain. It is not recommended..
The issue is IPC (Inter Process Communication). Koha relies upon a third party software to handle most of the complexities of Shibboleth/SAML.. The 'native service provider' package.. an apache plugin exists, mod_shibboleth, which we have been using to communicate between the native service provider code, Apache and finally koha. In CGI world, Koha runs a process per request under a forked Apache, and as such Apache and Koha share the same process environment. In the Plack world, Koha runs in a persistent process and requests are proxied from Apache to Plack (Koha); As such, no environment is shared and we have to utilize an alternative means of communicating between Koha and Apache (and therefore the native shibboleth service provider). The only other supported means of transporting that information is Headers (in mod_shibboleth). So.. to do better than this patch we either need to get rid of Apache and the native shibboleth service provider package and write our own native shibboleth handling code.. or write a plack middleware that interfaces directly with the native service provider software.. that's a pretty long way outside of my own scope for this. Personally, this isn't the 100% best fix, but it's the best we can do without basically re-writing Koha in my opinion.. With the NativeSPSpoofChecking guidance followed it's not as big an issue as many are making out in my opinion. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 --- Comment #29 from Matthias Meusburger <matthias.meusburger@biblibre.com> --- I completely agree with Martin's comment: this is the best we can come up with right now. However, I'm not a system administrator, and this is a system issue. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 --- Comment #30 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- (In reply to Martin Renvoize from comment #28)
Personally, this isn't the 100% best fix, but it's the best we can do without basically re-writing Koha in my opinion.. With the NativeSPSpoofChecking guidance followed it's not as big an issue as many are making out in my opinion.
What about the concerns listed in comment27 ? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 --- Comment #31 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- (In reply to Marcel de Rooy from comment #30)
What about the concerns listed in comment27 ?
Well, we could document that if using plack we strongly recommend you read the documentation around NativeSPSpoofChecking and add a spoofKey as suggested there. I believe that's all handled in the configuration of the Native Service Provider package, so again somewhat outside of the scope of Koha code.. but I agree to adding a doc patch pointing people there.. Would that allay your concerns at all? I do wish they would document what they mean by 'There are no known scenarios in which environment variables can't be used' on that NativeSPSpoofChecking page.. I certainly know of no way to get around our scenario. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 --- Comment #32 from Matthias Meusburger <matthias.meusburger@biblibre.com> --- About comment#27, I tried to spoof HTTP headers with firefox's "Modify Header Value (HTTP Headers)" extension ( https://addons.mozilla.org/fr/firefox/addon/modify-header-value ) and got the following message: "opensaml::SecurityPolicyException The system encountered an error at Fri Sep 28 08:33:58 2018 To report this problem, please contact the site administrator at root@localhost. Please include the following message in any email: opensaml::SecurityPolicyException at (https://catalogue.koha-shib/cgi-bin/koha/opac-user.pl) Attempt to spoof header (AJP_Login) was detected." So basic spoofing doesn't work. However, I'm no security expert, so if anyone thinks that we should add more control mechanisms to the stack we recommand (Apache / mod_shib / plack), please say so. For all the other stacks (IIS, Sun/iPlanet, etc.), we should clearly mention in the documentation that control mechanisms are needed. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |8446 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8446 [Bug 8446] Shibboleth authentication -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 --- Comment #33 from Nick Clemens <nick@bywatersolutions.com> --- This patchset leaves the decision open to the user/IT staff outside of Koha. We can either enable shib with plack, or disable plack and use environment variables depending on their unique security needs. Additional spoof protection would be on the maintainer of the Koha server (via apache or other configuration) so is again outside of Koha. We should document that anyone enabling headers should read up on spoof protection. Finding a middleware solution might be a great future enhancement (or just make everyone use CAS :-) ), but I think this is a workable interim solution No blocker for me. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 --- Comment #34 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 79572 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=79572&action=edit Bug 17776: Enable Shibboleth for Plack https://bugs.koha-community.org/show_bug.cgi?id=17776 Signed-off-by: Matthias Meusburger <matthias.meusburger@biblibre.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 --- Comment #35 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 79573 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=79573&action=edit Bug 17776: (followup) Add note about NativeSPSpoofChecking -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #68216|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 --- Comment #36 from Marvin Addison <serac@vt.edu> --- Is the intention to update the documentation to discuss security implications before closing this issue? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 --- Comment #37 from Nick Clemens <nick@bywatersolutions.com> --- (In reply to Marvin Addison from comment #36)
Is the intention to update the documentation to discuss security implications before closing this issue?
Yes, we are going to add the option to use headers, and add a warning for anyone who chooses to do so and leave the final decision to the Koha admin/end user -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 --- Comment #38 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Should we also update the wiki + the manual? At least the wiki has a page for Shibboleth already: https://wiki.koha-community.org/wiki/Shibboleth_Configuration Also we should add "Text to go in the release notes" here in bugzille. Really glad to see this moving. Are we ready to move this from FQA to Signed off yet? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the| |This enhancement adds release notes| |support for using | |Shibboleth in a Plack | |environment. Caution | |should, however, be taken | |before enabling it as there | |are security implications | |to be aware of regarding | |header spoofing attacks | |that can be mitigated with | |additional care whilst | |configuring the native | |service provider and | |apache. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|normal |enhancement -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the|This enhancement adds |This enhancement adds release notes|support for using |support for using |Shibboleth in a Plack |Shibboleth in a Plack |environment. Caution |environment. Caution |should, however, be taken |should, however, be taken |before enabling it as there |before enabling it as there |are security implications |are security implications |to be aware of regarding |to be aware of regarding |header spoofing attacks |header spoofing attacks |that can be mitigated with |that can be mitigated with |additional care whilst |additional care whilst |configuring the native |configuring the native |service provider and |service provider and |apache. |apache: Please see the POD | |of Auth_with_shib.pm for | |details. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the|This enhancement adds |This enhancement adds release notes|support for using |support for using |Shibboleth in a Plack |Shibboleth in a Plack |environment. Caution |environment. Caution |should, however, be taken |should, however, be taken |before enabling it as there |before enabling it as there |are security implications |are security implications |to be aware of regarding |to be aware of regarding |header spoofing attacks |header spoofing attacks |that can be mitigated with |that can be mitigated with |additional care whilst |additional care whilst |configuring the native |configuring the native |service provider and |service provider and |apache: Please see the POD |Apache: Please see the POD |of Auth_with_shib.pm for |of Auth_with_shib.pm for |details. |details. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the|This enhancement adds |This enhancement adds release notes|support for using |support for using |Shibboleth in a Plack |Shibboleth in a Plack |environment. Caution |environment. Caution |should, however, be taken |should, however, be taken |before enabling it as there |before enabling it as there |are security implications |are security implications |to be aware of regarding |to be aware of regarding |header spoofing attacks |header spoofing attacks |that can be mitigated with |that can be mitigated with |additional care whilst |additional care whilst |configuring the native |configuring the native |service provider and |service provider and |Apache: Please see the POD |Apache: Please see |of Auth_with_shib.pm for |https://wiki.shibboleth.net |details. |/confluence/display/SHIB2/N | |ativeSPSpoofChecking for | |further details. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 --- Comment #39 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- or even PQA perhaps? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 --- Comment #40 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- QA: Having another look now -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |BLOCKED -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #79572|0 |1 is obsolete| | --- Comment #41 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 80000 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=80000&action=edit Bug 17776: Enable Shibboleth for Plack https://bugs.koha-community.org/show_bug.cgi?id=17776 Signed-off-by: Matthias Meusburger <matthias.meusburger@biblibre.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 --- Comment #42 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 80001 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=80001&action=edit Bug 17776: (follow-up) Add note about NativeSPSpoofChecking Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Amended the text a bit: Hopefully, an uppercase important attracts slightly more attention :) Added the bug number too. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 --- Comment #43 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 80002 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=80002&action=edit Bug 17776: (QA follow-up) Consistent regex for Plack detection Synchronizing: C4/Auth_with_shibboleth.pm: if ( any { /(^psgi|^plack)/i } keys %ENV ) { Koha/AuthUtils.pm: if ( ( any { /(^psgi\.|^plack\.)/i } keys %ENV ) && $ENV{SCRIPT_NAME} =~ m,^/(intranet|opac)(.*), ) { about.pl:if ( any { /(^psgi\.|^plack\.)/i } keys %ENV ) { Actually we should move it to a subroutine. New report please. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 --- Comment #44 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 80003 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=80003&action=edit Bug 17776: (QA follow-up) Remove shibboleth package variables This is about $shib and $shib_login. We move in the right direction by calling get_login_shib in get_template_and_user and checkauth. In the same line we can do the shib_ok check at that time (just checking cached values). This paves the way for the third subroutine using the two package vars: checkpw. Note that checkpw is also called outside Auth.pm. So I would be more comfortable if we do the same calls like in checkauth and remove both variables from the package level (especially under Plack of course). The former changes actually justify a 'use C4::Auth_with_shibboleth' instead of the current require and import. Note: When calling checkpw from checkauth, we are calling get_login_shib twice now. But the time involved for doing so is around zero (cache), so not really an argument for extra parameters and complexer code. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 --- Comment #45 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Waiting for a confirm from Martin -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #79573|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |m.de.rooy@rijksmuseum.nl |y.org | Patch complexity|--- |Small patch -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #80000|0 |1 is obsolete| | --- Comment #46 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 80023 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=80023&action=edit Bug 17776: Enable Shibboleth for Plack https://bugs.koha-community.org/show_bug.cgi?id=17776 Signed-off-by: Matthias Meusburger <matthias.meusburger@biblibre.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #80001|0 |1 is obsolete| | --- Comment #47 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 80024 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=80024&action=edit Bug 17776: (follow-up) Add note about NativeSPSpoofChecking Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Amended the text a bit: Hopefully, an uppercase important attracts slightly more attention :) Added the bug number too. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #80002|0 |1 is obsolete| | --- Comment #48 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 80025 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=80025&action=edit Bug 17776: (QA follow-up) Consistent regex for Plack detection Synchronizing: C4/Auth_with_shibboleth.pm: if ( any { /(^psgi|^plack)/i } keys %ENV ) { Koha/AuthUtils.pm: if ( ( any { /(^psgi\.|^plack\.)/i } keys %ENV ) && $ENV{SCRIPT_NAME} =~ m,^/(intranet|opac)(.*), ) { about.pl:if ( any { /(^psgi\.|^plack\.)/i } keys %ENV ) { Actually we should move it to a subroutine. New report please. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #80003|0 |1 is obsolete| | --- Comment #49 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 80026 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=80026&action=edit Bug 17776: (QA follow-up) Remove shibboleth package variables This is about $shib and $shib_login. We move in the right direction by calling get_login_shib in get_template_and_user and checkauth. In the same line we can do the shib_ok check at that time (just checking cached values). This paves the way for the third subroutine using the two package vars: checkpw. Note that checkpw is also called outside Auth.pm. So I would be more comfortable if we do the same calls like in checkauth and remove both variables from the package level (especially under Plack of course). The former changes actually justify a 'use C4::Auth_with_shibboleth' instead of the current require and import. Note: When calling checkpw from checkauth, we are calling get_login_shib twice now. But the time involved for doing so is around zero (cache), so not really an argument for extra parameters and complexer code. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|BLOCKED |Signed Off --- Comment #50 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- As requested I've tested the followups and confirmed them working from here. Nice little bit of code golf there, thanks Marcel. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to Master --- Comment #51 from Nick Clemens <nick@bywatersolutions.com> --- Awesome work all! Pushed to master for 18.11 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|Pushed to Master |RESOLVED --- Comment #52 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Enhancement, will not be backported to 18.05.x series. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |21711 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21711 [Bug 21711] Remove $shib in Auth.t (17776 folllow-up) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the|This enhancement adds |Sponsored by PTFS Europe release notes|support for using | |Shibboleth in a Plack |This enhancement adds |environment. Caution |support for using |should, however, be taken |Shibboleth in a Plack |before enabling it as there |environment. Caution |are security implications |should, however, be taken |to be aware of regarding |before enabling it as there |header spoofing attacks |are security implications |that can be mitigated with |to be aware of regarding |additional care whilst |header spoofing attacks |configuring the native |that can be mitigated with |service provider and |additional care whilst |Apache: Please see |configuring the native |https://wiki.shibboleth.net |service provider and |/confluence/display/SHIB2/N |Apache: Please see |ativeSPSpoofChecking for |https://wiki.shibboleth.net |further details. |/confluence/display/SHIB2/N | |ativeSPSpoofChecking for | |further details. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17776 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org