diff --git a/auth_from_http_remote_user/README.rst b/auth_from_http_remote_user/README.rst new file mode 100644 index 000000000..635802129 --- /dev/null +++ b/auth_from_http_remote_user/README.rst @@ -0,0 +1,125 @@ +Allow users to be automatically logged in +========================================= + +This module initialize the session by looking for the field HTTP_REMOTE_USER in +the HEADER of the HTTP request and trying to bind the given value to a user. +To be active, the module must be installed in the expected databases and loaded +at startup; Add the *--load* parameter to the startup command: :: + + --load=web,web_kanban,auth_from_http_remote_user, ... + +If the field is found in the header and no user matches the given one, the +system issue a login error page. (*401* `Unauthorized`) + +Use case. +--------- + +The module allows integration with external security systems [#]_ that can pass +along authentication of a user via Remote_User HTTP header field. In many +cases, this is achieved via server like Apache HTTPD or nginx proxying Odoo. + +.. important:: When proxying your Odoo server with Apache or nginx, It's + important to filter out the Remote_User HTTP header field before your + request is processed by the proxy to avoid security issues. In apache you + can do it by using the RequestHeader directive in your VirtualHost + section :: + + + ServerName MY_VHOST.com + ProxyRequests Off + ... + + RequestHeader unset Remote-User early + ProxyPass / http://127.0.0.1:8069/ retry=10 + ProxyPassReverse / http://127.0.0.1:8069/ + ProxyPreserveHost On + + + +How to test the module with Apache [#]_ +---------------------------------------- + +Apache can be used as a reverse proxy providing the authentication and adding +the required field in the Http headers. + +Install apache: :: + + $ sudo apt-get install apache2 + + +Define a new vhost to Apache by putting a new file in +/etc/apache2/sites-available: :: + + $ sudo vi /etc/apache2/sites-available/MY_VHOST.com + +with the following content: :: + + + ServerName MY_VHOST.com + ProxyRequests Off + + AuthType Basic + AuthName "Test Odoo auth_from_http_remote_user" + AuthBasicProvider file + AuthUserFile /etc/apache2/MY_VHOST.htpasswd + Require valid-user + + RewriteEngine On + RewriteCond %{LA-U:REMOTE_USER} (.+) + RewriteRule . - [E=RU:%1] + RequestHeader set Remote-User "%{RU}e" env=RU + + + RequestHeader unset Remote-User early + ProxyPass / http://127.0.0.1:8069/ retry=10 + ProxyPassReverse / http://127.0.0.1:8069/ + ProxyPreserveHost On + + +.. important:: The *RequestHeader* directive is used to add the *Remote-User* + field in the http headers. By default an *'Http-'* prefix is added to the + field name. + In Odoo, header's fields name are normalized. As result of this + normalization, the 'Http-Remote-User' is available as 'HTTP_REMOTE_USER'. + If you don't know how your specified field is seen by Odoo, run your + server in debug mode once the module is activated and look for an entry + like: :: + + DEBUG openerp1 openerp.addons.auth_from_http_remote_user.controllers. + session: + Field 'HTTP_MY_REMOTE_USER' not found in http headers + {'HTTP_AUTHORIZATION': 'Basic YWRtaW46YWRtaW4=', ..., + 'HTTP_REMOTE_USER': 'demo') + +Enable the required apache modules: :: + + $ sudo a2enmod headers + $ sudo a2enmod proxy + $ sudo a2enmod rewrite + $ sudo a2enmod proxy_http + +Enable your new vhost: :: + + $ sudo a2ensite MY_VHOST.com + +Create the *htpassword* file used by the configured basic authentication: :: + + $ sudo htpasswd -cb /etc/apache2/MY_VHOST.htpasswd admin admin + $ sudo htpasswd -b /etc/apache2/MY_VHOST.htpasswd demo demo + +For local test, add the *MY_VHOST.com* in your /etc/vhosts file. + +Finally reload the configuration: :: + + $ sudo service apache2 reload + +Open your browser and go to MY_VHOST.com. If everything is well configured, you +are prompted for a login and password outside Odoo and are automatically +logged in the system. + +.. [#] Shibolleth, Tivoli access manager, .. +.. [#] Based on a ubuntu 12.04 env + +Contributors +------------ +* Laurent Mignon diff --git a/auth_from_http_remote_user/__openerp__.py b/auth_from_http_remote_user/__openerp__.py index d4e9731c2..fcd51e800 100644 --- a/auth_from_http_remote_user/__openerp__.py +++ b/auth_from_http_remote_user/__openerp__.py @@ -22,130 +22,6 @@ 'name': 'Authenticate via HTTP Remote User', 'version': '1.0', 'category': 'Tools', - 'description': """ -Allow users to be automatically logged in. -========================================== - -This module initialize the session by looking for the field HTTP_REMOTE_USER in -the HEADER of the HTTP request and trying to bind the given value to a user. -To be active, the module must be installed in the expected databases and loaded -at startup; Add the *--load* parameter to the startup command: :: - - --load=web,web_kanban,auth_from_http_remote_user, ... - -If the field is found in the header and no user matches the given one, the -system issue a login error page. (*401* `Unauthorized`) - -Use case. ---------- - -The module allows integration with external security systems [#]_ that can pass -along authentication of a user via Remote_User HTTP header field. In many -cases, this is achieved via server like Apache HTTPD or nginx proxying Odoo. - -.. important:: When proxying your Odoo server with Apache or nginx, It's - important to filter out the Remote_User HTTP header field before your - request is processed by the proxy to avoid security issues. In apache you - can do it by using the RequestHeader directive in your VirtualHost - section :: - - - ServerName MY_VHOST.com - ProxyRequests Off - ... - - RequestHeader unset Remote-User early - ProxyPass / http://127.0.0.1:8069/ retry=10 - ProxyPassReverse / http://127.0.0.1:8069/ - ProxyPreserveHost On - - - -How to test the module with Apache [#]_ ----------------------------------------- - -Apache can be used as a reverse proxy providing the authentication and adding -the required field in the Http headers. - -Install apache: :: - - $ sudo apt-get install apache2 - - -Define a new vhost to Apache by putting a new file in -/etc/apache2/sites-available: :: - - $ sudo vi /etc/apache2/sites-available/MY_VHOST.com - -with the following content: :: - - - ServerName MY_VHOST.com - ProxyRequests Off - - AuthType Basic - AuthName "Test Odoo auth_from_http_remote_user" - AuthBasicProvider file - AuthUserFile /etc/apache2/MY_VHOST.htpasswd - Require valid-user - - RewriteEngine On - RewriteCond %{LA-U:REMOTE_USER} (.+) - RewriteRule . - [E=RU:%1] - RequestHeader set Remote-User "%{RU}e" env=RU - - - RequestHeader unset Remote-User early - ProxyPass / http://127.0.0.1:8069/ retry=10 - ProxyPassReverse / http://127.0.0.1:8069/ - ProxyPreserveHost On - - -.. important:: The *RequestHeader* directive is used to add the *Remote-User* - field in the http headers. By default an *'Http-'* prefix is added to the - field name. - In Odoo, header's fields name are normalized. As result of this - normalization, the 'Http-Remote-User' is available as 'HTTP_REMOTE_USER'. - If you don't know how your specified field is seen by Odoo, run your - server in debug mode once the module is activated and look for an entry - like: :: - - DEBUG openerp1 openerp.addons.auth_from_http_remote_user.controllers. - session: - Field 'HTTP_MY_REMOTE_USER' not found in http headers - {'HTTP_AUTHORIZATION': 'Basic YWRtaW46YWRtaW4=', ..., - 'HTTP_REMOTE_USER': 'demo') - -Enable the required apache modules: :: - - $ sudo a2enmod headers - $ sudo a2enmod proxy - $ sudo a2enmod rewrite - $ sudo a2enmod proxy_http - -Enable your new vhost: :: - - $ sudo a2ensite MY_VHOST.com - -Create the *htpassword* file used by the configured basic authentication: :: - - $ sudo htpasswd -cb /etc/apache2/MY_VHOST.htpasswd admin admin - $ sudo htpasswd -b /etc/apache2/MY_VHOST.htpasswd demo demo - -For local test, add the *MY_VHOST.com* in your /etc/vhosts file. - -Finally reload the configuration: :: - - $ sudo service apache2 reload - -Open your browser and go to MY_VHOST.com. If everything is well configured, you -are prompted for a login and password outside Odoo and are automatically -logged in the system. - -.. [#] Shibolleth, Tivoli access manager, .. -.. [#] Based on a ubuntu 12.04 env - -""", 'author': 'Acsone SA/NV', 'maintainer': 'ACSONE SA/NV', 'website': 'http://www.acsone.eu',