Good evening. We are a student group here at University of California, Berkeley, and for the past couple of months we have been trying (unsuccessfully) to get Zope to work with Apache properly. (We are Residential Computing, a group which provides connectivity and support to the residence halls at the UC Berkeley.) The situation is as follows: Right now, apache has been configured to pass all requests to zope.cgi except for our personal pages (/about/staff), which a rewrite rule is directing to a static file system location. Our problem lies in an internal section of our site. We call it /internal/. What we are having problems with is getting Apache to authenticate the user BEFORE it redirects to /internal/ in Zope. The other snag: everything under /internal/ is under SSL. One area where we are not certain is if the require user authentication specs should be in LOCATION tags or DIRECTORY tags. In addition to advice, if you have a similar set-up we would really appreciate a snap-shot of your httpd.conf. I have included snippits of out httpd.conf file below. Thanks for your help, Sachin =================BEGIN================== <VirtualHost 169.229.70.158:80> ServerName www.rescomp.berkeley.edu ErrorLog /var/log/apache/error.www.rescomp.berkeley.edu TransferLog /var/log/apache/access.www.rescomp.berkeley.edu # Setup document root DocumentRoot "/servers/www/rescomp/docs" <Directory "/servers/www/rescomp/docs"> Options FollowSymLinks AllowOverride None Order allow,deny Allow from all </Directory> # Added for conversion to Zope <Directory /servers/www/rescomp/cgi-bin> Options +ExecCGI +FollowSymLinks AllowOverride None Order allow,deny Allow from all </Directory> # <Location ~ "*manage"> # AuthUserFile /opt/apache/etc/htpasswd # AuthGroupFile /opt/apache/etc/htgroup # AuthType Basic # AuthName Zope_is_my_friend # SSLRequireSSL # require valid-user # </Location> RewriteEngine on RewriteRule ^/internal(.*) /servers/www/rescomp/docs/internal$1 RewriteRule ^(.*)/manage https://www.rescomp.berkeley.edu$1/manage [L] RewriteRule ^/internal/(.*) https://www.rescomp.berkeley.edu/internal/$1 [L] RewriteRule ^/about/staff/(.*) /servers/www/rescomp/docs/about/staff/$1 [L] RewriteRule ^/~(.*) /servers/www/rescomp/docs/about/staff/$1 [L] RewriteCond %{HTTP:Authorization} ^(.*) RewriteRule ^(.*) /servers/www/rescomp/cgi-bin/Zope$1 [e=HTTP_CGI_AUTHORIZATION:%1,t=application/x-httpd-cgi,l] # End Zope additions ...continues.... <IfModule mod_ssl.c> <VirtualHost 169.229.70.158:443> ServerName www.rescomp.berkeley.edu ErrorLog /var/log/apache/error.www.rescomp.berkeley.edu TransferLog /var/log/apache/access.www.rescomp.berkeley.edu SSLEngine On # Setup document root DocumentRoot "/servers/www/rescomp/docs" <Directory "/servers/www/rescomp/docs"> Options FollowSymLinks AllowOverride None Order allow,deny Allow from all </Directory> # Added for conversion to Zope <Directory /servers/www/rescomp/cgi-bin> Options +ExecCGI +FollowSymLinks AllowOverride None Order allow,deny Allow from all </Directory> # <Location ~ "*manage"> # AuthUserFile /opt/apache/etc/htpasswd # AuthGroupFile /opt/apache/etc/htgroup # AuthType Basic # AuthName Zope_is_my_friend # SSLRequireSSL # require valid-user # </Location> RewriteEngine on RewriteRule ^/internal(.*) https://www.rescomp.berkeley.edu/internal$1 RewriteCond %{HTTP:Authorization} ^(.*) RewriteRule ^(.*) /servers/www/rescomp/cgi-bin/Zope$1 [e=HTTP_CGI_AUTHORIZATION:%1,t=application/x-httpd-cgi,l] # End Zope additions ==============END=================== -- ------------------------------------------------ -= Sachin Shah :: Lead Marketing/Web Design =- -= sachin@rescomp.berkeley.edu =- https://www.rescomp.berkeley.edu/~sachin/ -----------------------------------------------
Sachin Shah wrote:
What we are having problems with is getting Apache to authenticate the user BEFORE it redirects to /internal/ in Zope. The other snag: everything under /internal/ is under SSL. One area where we are not certain is if the require user authentication specs should be in LOCATION tags or DIRECTORY tags.
I can't comment too much on your problem, your report, although detailed, still did not show everything, for example, how is it failing? Does Zope show public pages but never lets you authenticate? One thing I noticed is that you want Apache to authenticate, then you try and pass the Auth headers into Zope. You can't have it both ways, either Apache authenticates you (and you are quite crippled in this sense, using the front end web server to do authentication is not desireable at all, and limits what Zope can do to a great extend) or Zope authenticates you. Perhaps I am not completly understanding what you want to do, but I think you might be tackling too many problems at once and your conf file apears to be very complex. First, take out all the Apache auth and SSL and all the other Rewrites and complexity and just get Zope to work with Apache. _Then_ add something else, and get it to work, and so on. Further, you may want to consult the Apache docs and inspect the environment that Apache sets up for PCGI along each step of this process; Apache, for instance, may not set up all of the CGI 1.1 environment variables in a way that makes Zope happy when you use SSL. Or maybe Apache ixnays the Auth header after it does Auth. I couldn't tell you either way. -Michel
participants (2)
-
Michel Pelletier -
Sachin Shah