# Config Open Ondemand with NIS auth

**URL:** <https://discourse.openondemand.org/t/config-open-ondemand-with-nis-auth/2656>\
**Category:** Get Help\
**Tags:** question\
**Created:** [April 24, 2023, 3:27am UTC](https://discourse.openondemand.org/t/config-open-ondemand-with-nis-auth/2656 "2023-04-24T03:27:04Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![link89](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/link89/32/1621_2.png) [@link89](https://discourse.openondemand.org/u/link89)\
**Post date:** [April 24, 2023, 3:27am UTC](https://discourse.openondemand.org/t/config-open-ondemand-with-nis-auth/2656/1 "2023-04-24T03:27:04Z")

</div>

I want to deploy OOD on a leagacy cluster which uses NIS (Network Information Service) as the authn servcie, which is not supported by OOD. What I can do to deploy OOD under such condition? Do I have to migrate NIS to LDAP, or there is better solution to work with NIS?

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [April 24, 2023, 3:24pm UTC](https://discourse.openondemand.org/t/config-open-ondemand-with-nis-auth/2656/2 "2023-04-24T15:24:11Z")

</div>

Hi and welcome!

Sorry I’ve never heard of NIS, though I found this apache module - [GitHub - gitpan/Apache-AuthenNIS: Read-only release history for Apache-AuthenNIS](https://github.com/gitpan/Apache-AuthenNIS/tree/master) - it seems to be a bit old and unmaintained.

> [@link89](#):
>
> Do I have to migrate NIS to LDAP

I’m not quite sure if you have to migrate. It seems like you’d still have an LDAP system alongside your NIS systems - at least Oracle NIS docs seem to indicate.

In any case if you do have an LDAP system you can connect to it through Dex (`ondemand-dex` package). That is if your user information is stored in an LDAP system.

---

<div class="post-metadata">

**Author:** ![link89](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/link89/32/1621_2.png) [@link89](https://discourse.openondemand.org/u/link89)\
**Post date:** [April 24, 2023, 4:18pm UTC](https://discourse.openondemand.org/t/config-open-ondemand-with-nis-auth/2656/3 "2023-04-24T16:18:47Z")

</div>

Hi, thanks for your reply.

I guess I have figure out how to use PAM to auth (though it is not recommended, but in our case the connection to OOD portal is forwarded by ssh so I think it should be OK).

But now I have another problem: when I open the portal for the first time, it ask me to input user name and password. After I input a non-root user and password it just redirect me to [http://localhost:8080/pun/sys/dashboard](http://localhost:8080/pun/sys/dashboard) with 403 no permission.

I am new to OOD. What I have done is to follow the document to setup authentication and cluster. I guess I have missed some important steps but I can not figure it out. Is there any suggestion about this?

Here is the error log BTW

```auto
App 19376 output: [2023-04-25 00:26:19 +0800] ERROR "[ActionDispatch::HostAuthorization::DefaultResponseApp] Blocked host: localhost"

```

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [April 24, 2023, 4:35pm UTC](https://discourse.openondemand.org/t/config-open-ondemand-with-nis-auth/2656/4 "2023-04-24T16:35:09Z")

</div>

You need to set the `servername` in `ood_portal.yml`. Looks like you need to set it to `localhost`.

```yaml
servername: localhost

```

---

<div class="post-metadata">

**Author:** ![link89](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/link89/32/1621_2.png) [@link89](https://discourse.openondemand.org/u/link89)\
**Post date:** [April 24, 2023, 4:53pm UTC](https://discourse.openondemand.org/t/config-open-ondemand-with-nis-auth/2656/5 "2023-04-24T16:53:33Z")

</div>

It remains the same error after I set servername to localhost. I do some research myself on the internet and it looks to me like this error is raised by Ruby on Rail, but I don’t know which option could be use to make it right.

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [April 24, 2023, 5:07pm UTC](https://discourse.openondemand.org/t/config-open-ondemand-with-nis-auth/2656/6 "2023-04-24T17:07:42Z")

</div>

`servername` should resolve the issue. Be sure to bounce apache and stop the PUN. You can stop the PUN by issuing this command. You need to supply your actual username instead of `<username>`.

```auto
 /opt/ood/nginx_stage/sbin/nginx_stage nginx_clean --user <username>

```

---

<div class="post-metadata">

**Author:** ![link89](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/link89/32/1621_2.png) [@link89](https://discourse.openondemand.org/u/link89)\
**Post date:** [April 24, 2023, 5:21pm UTC](https://discourse.openondemand.org/t/config-open-ondemand-with-nis-auth/2656/7 "2023-04-24T17:21:50Z")

</div>

Still the same error, here is the Apache config generated automatically

```auto
  # Per-user Nginx (PUN) configuration
  # NB: Apache will need sudo privs to control the PUNs
  #
  SetEnv OOD_PUN_STAGE_CMD "sudo /opt/ood/nginx_stage/sbin/nginx_stage"

  SetEnv OOD_ALLOWED_HOSTS "localhost,localhost:8080"

  #
  # Below is used for sub-uri's this Open OnDemand portal supports
  #

```

As you can see the env is `OOD_ALLOWED_HOSTS`, but the env in `/apps/dashboard/config/environments/production.rb` is still `ALLOWED_HOSTS`. Is it possbile the reason? I am using OOD 3.0.

---

<div class="post-metadata">

**Author:** ![link89](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/link89/32/1621_2.png) [@link89](https://discourse.openondemand.org/u/link89)\
**Post date:** [April 24, 2023, 5:30pm UTC](https://discourse.openondemand.org/t/config-open-ondemand-with-nis-auth/2656/8 "2023-04-24T17:30:13Z")

</div>

I don’t know how the env works, but I just grep the code and found there are both OOD\_ALLOWED\_HOSTS and ALLOWED\_HOSTS

 ![image](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/3/3cfd82db15de2aff94981557ca553c2ad99303e2.png)

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [April 24, 2023, 5:37pm UTC](https://discourse.openondemand.org/t/config-open-ondemand-with-nis-auth/2656/9 "2023-04-24T17:37:33Z")

</div>

Be sure to stop your PUN, it could still be running with the old configurations. You’ve added `localhost:8080` - I don’t think that’s needed. It doesn’t look like it needs a port configuration.

If you check the environment of a PUN, you’ll see the environment variables set.

Find the PID of your PUN by finding your process named `Passenger RubyApp: /var/www/ood/apps/sys/dashboard (production)` then `cat /proc/<PID>/environ` where is the process ID that you just found.

---

<div class="post-metadata">

**Author:** ![link89](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/link89/32/1621_2.png) [@link89](https://discourse.openondemand.org/u/link89)\
**Post date:** [April 25, 2023, 1:09am UTC](https://discourse.openondemand.org/t/config-open-ondemand-with-nis-auth/2656/10 "2023-04-25T01:09:26Z")

</div>

> [@jeff.ohrstrom](#):
>
> You’ve added `localhost:8080` - I don’t think that’s needed. It doesn’t look like it needs a port configuration.

It is added after setting `proxy_server: localhost:8080` as I need to setup a ssh port forward tunnel to access OOD portal. Without this whenever I access localhost:8080 it will be redirected to loclahost automatically.

Turn out you are right. The problem is gone after I kill the ruby process and run `/opt/ood/nginx_stage/sbin/nginx_stage nginx_clean --user my_user`, just nginx\_clean is not enough in my case.

Really appreiciate your help and now our portal just works like a charm.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/b/bae70bd0ed39a3ae769c2108155f4cb3e9da8385.png) [@system](https://discourse.openondemand.org/u/system)\
**Post date:** [October 22, 2023, 1:09am UTC](https://discourse.openondemand.org/t/config-open-ondemand-with-nis-auth/2656/11 "2023-10-22T01:09:59Z")

</div>

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.