Is anyone able to provide guidance on editing ood_portal.yml to support CAS authentication? I tried a few ideas that did not work, based on our implementation test outlined below – which provided a successful test.
We have implemented CAS through a download and build of mod_auth_cas from this repo: https://github.com/apereo/mod_auth_cas. The service was configured in the system, and then we made ad-hoc edits to the existing ood configuration in /opt/rh/httpd24/root/etc/httpd/conf.d to verify that the service would recognize OoD.
This was realized through direct edit of the ood-portal.conf, and by creating a cas.conf file in /opt/rh/httpd24/root/etc/httpd/conf.d
In reviewing the differences between ood-portal.conf in the successful test case, and the ‘standard’ configuration, the meaningful differences are few:
Only setting the VIrtualHost through ood_config.yml is unclear – the other two values are somewhat documented in the code. I tried to set the public IP using the ‘servername’ keyword, and then also ‘virtualhost’, and in both cases the result was ‘VIrtualHost *:80’
Having VirtualHost *:80 should be fine as long as ServerName matches the name that is being used to access OOD. For our systems we set “servername” in ood_portal.yml to the DNS name of our instance that is used to access the web interface, not the IP. We don’t define virtualhost.
Those three should be enough to require a valid CAS user if you have properly configured mod_auth_cas. I don’t think AuthName will get used because that typically is what populates basic auth dialogue box. Every time I’ve used CAS the request redirects to CAS login form so you won’t get the basic auth dialogue box.
Here is how we set up CAS (RHEL7, OOD 1.3). In addition to httpd24-httpd-devel, you will probably need autoconf, automake, and libtools installed. The following is run as root, though not everything need be.
# CAS
git clone -b v1.1 https://github.com/apereo/mod_auth_cas.git && cd mod_auth_cas
scl enable httpd24 -- autoreconf -f -i
scl enable httpd24 -- ./configure --prefix=/opt/rh/httpd24/root/etc/httpd/modules
scl enable httpd24 -- make install
echo "LoadModule auth_cas_module modules/mod_auth_cas.so" > /opt/rh/httpd24/root/etc/httpd/conf.modules.d/yalehpc-cas.conf
# make CAS cookie dir
mkdir /opt/rh/httpd24/root/var/cache/httpd/mod_auth_cas
chown apache:apache /opt/rh/httpd24/root/var/cache/httpd/mod_auth_cas
chmod 700 /opt/rh/httpd24/root/var/cache/httpd/mod_auth_cas
# configure CAS
cat << EOF > /opt/rh/httpd24/root/etc/httpd/conf.d/auth-config.conf
CASCookiePath /opt/rh/httpd24/root/var/cache/httpd/mod_auth_cas/
CASLoginURL https://secure.its.yale.edu/cas/login
CASValidateURL https://secure.its.yale.edu/cas/serviceValidate
EOF
We copy the ssl certs on this host directly for now. Here is an excerpt from our /etc/ood/config/ood_portal.yml:
We’re having issues getting CAS working. When we following all the examples given for CAS, the server starts up fine and does not appear to have any configuration issues but when we try and log in we get the following:
Unauthorized
This server could not verify that you are authorized to access the document requested. Either you supplied the wrong credentials (e.g., bad password), or your browser doesn’t understand how to supply the credentials required.
In the log files we see:
[Tue Nov 13 10:34:46.242536 2018] [:error] [pid 26837] [client 134.114.32.3:56106] MOD_AUTH_CAS: error parsing CASv2 response:
XML parser error code: syntax error (2)
[Tue Nov 13 10:36:44.219649 2018] [:error] [pid 26836] [client 134.114.32.3:56148] MOD_AUTH_CAS: error parsing CASv2 response:
XML parser error code: syntax error (2), referer: https://cas.nau.edu/cas/login?service=https%3A%2F%2Fondemand.hpc.nau.edu%2F
pun%2fsys%2fdashboard
[Tue Nov 13 10:54:24.426463 2018] [:error] [pid 26943] [client 134.114.32.3:56388] MOD_AUTH_CAS: error parsing CASv2 response:
XML parser error code: syntax error (2)
[Tue Nov 13 10:55:18.729512 2018] [:error] [pid 26944] [client 134.114.32.3:56411] MOD_AUTH_CAS: error parsing CASv2 response:
XML parser error code: syntax error (2), referer: https://cas.nau.edu/cas/login?service=https%3A%2F%2Fondemand.hpc.nau.edu%2F
pun%2fsys%2fdashboard
We checked the CAS server and we are getting tickets and valid logins from that side but ondemand gives us the Unauthorised page. Any ideas where to look to fix this on the ondemand side?
Just going to leave this here in case anyone else is interested: We’re deploying OOD 2.0 on RHEL 8.4 with CAS authentication. The solution from @b.evans is still valid, except that OOD 2.0 is no longer using software collections, so the httpd paths are standard system paths.
To get an idea of the differences, this article worked for us, up through the “Settings for httpd” section (with the exception that we did not need the CASCertificatePath line).