# Testing OnDemand with SAML and mod\_auth\_mellon

**URL:** <https://discourse.openondemand.org/t/testing-ondemand-with-saml-and-mod-auth-mellon/2120>\
**Category:** Get Help\
**Tags:** ondemand2, question\
**Created:** [June 15, 2022, 5:47pm UTC](https://discourse.openondemand.org/t/testing-ondemand-with-saml-and-mod-auth-mellon/2120 "2022-06-15T17:47:06Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![ssofya](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/ssofya/32/1145_2.png) [@ssofya](https://discourse.openondemand.org/u/ssofya)\
**Post date:** [June 15, 2022, 5:47pm UTC](https://discourse.openondemand.org/t/testing-ondemand-with-saml-and-mod-auth-mellon/2120/1 "2022-06-15T17:47:07Z")

</div>

Hello all!

We are starting testing OnDemand and I’m running into issue.

When I launch the dashboard after a fresh install with  
auth:

- ‘AuthType Mellon’
- ‘Require valid-user’

in my ood\_portal.yml

After pass SAML auth I see the following error:

Error – invalid user name syntax: DOMAIN\username  
Run ‘nginx\_stage --help’ to see a full list of available command line options.

In my http log file I see the following:

[Tue Jun 14 15:48:07.310730 2022] [lua:info] [pid 16499] [client 10.32.120.146:41530] req\_protocol=“HTTP/1.1” req\_handler="" req\_method=“GET” req\_accept=“text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,_/_;q=0.8,application/signed-exchange;v=b3;q=0.9” req\_user\_agent=“Mozilla/5.0 (X11; Linux x86\_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36” res\_content\_length=“134” req\_content\_type="" res\_content\_encoding="" req\_status=“404” req\_origin="" time\_user\_map=“0.004” local\_user=“DOMAIN\username” req\_referer="" res\_content\_language="" req\_port=“443” log\_time=“2022-06-14T22:48:07.309772Z” req\_server\_name=“ht-hpc-ondemand” log\_hook=“ood” req\_accept\_charset="" req\_hostname=“ondemand” res\_content\_location="" res\_content\_disp="" req\_is\_websocket=“false” remote\_user=“DOMAIN\username” res\_location="" req\_user\_ip=“XX.XX.XXX.XXX” req\_is\_https=“true” req\_filename="/opt/rh/httpd24/root/var/www/html/pun" req\_uri="/pun/sys/dashboard" time\_proxy=“0” res\_content\_type="" req\_accept\_language=“en-us,en;q=0.9” req\_cache\_control="" req\_accept\_encoding=“gzip, deflate, br”

Any word of advise?

Best,  
Sofya

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [June 15, 2022, 7:33pm UTC](https://discourse.openondemand.org/t/testing-ondemand-with-saml-and-mod-auth-mellon/2120/2 "2022-06-15T19:33:05Z")

</div>

Hi and welcome! Sorry we didn’t respond on the mailing list yet.

You need to setup user mapping. That is given `DOMAIN\username` you need to map it to `username`.

[https://osc.github.io/ood-documentation/latest/authentication/overview/map-user.html#setup-user-mapping](https://osc.github.io/ood-documentation/latest/authentication/overview/map-user.html#setup-user-mapping)

---

<div class="post-metadata">

**Author:** ![ssofya](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/ssofya/32/1145_2.png) [@ssofya](https://discourse.openondemand.org/u/ssofya)\
**Post date:** [June 15, 2022, 9:23pm UTC](https://discourse.openondemand.org/t/testing-ondemand-with-saml-and-mod-auth-mellon/2120/3 "2022-06-15T21:23:15Z")

</div>

Thank you, it worked! Only 1 thing I noticed. I have to upgrade my apache conf manually

Placing changes into /etc/ood/config/ood\_portal.yml and run /opt/ood/ood-portal-generator/sbin/update\_ood\_portal doesn’t update apache conf file.

Is that expected?

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [June 16, 2022, 1:13pm UTC](https://discourse.openondemand.org/t/testing-ondemand-with-saml-and-mod-auth-mellon/2120/4 "2022-06-16T13:13:35Z")

</div>

Very good. That is not expected. I don’t know if you manually edited it before - but once you start to manually edit we’ll notice those manual edits and stop overwriting it.

You can try the force option `-f/--force` then from that point forward it should start to work.

---

<div class="post-metadata">

**Author:** ![ssofya](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/ssofya/32/1145_2.png) [@ssofya](https://discourse.openondemand.org/u/ssofya)\
**Post date:** [June 21, 2022, 9:20pm UTC](https://discourse.openondemand.org/t/testing-ondemand-with-saml-and-mod-auth-mellon/2120/5 "2022-06-21T21:20:25Z")

</div>

Hi Jeff,

Thank you for letting me know. I tried with --force flag and it indeed overridden the http conf file, but with the wrong options.

In my ood\_portal.yml I have:  
auth:

- ‘AuthType Mellon’
- ‘Require valid-user’

( I used to have openid-connect)

But my http conf file gets created with

\<Location “/pun”\>  
AuthType openid-connect  
Require valid-user

\<Location “/nginx”\>  
AuthType openid-connect  
Require valid-user

And my user march line gets ignored as well.

Can you please advise?

Best,  
Sofya

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [June 21, 2022, 9:33pm UTC](https://discourse.openondemand.org/t/testing-ondemand-with-saml-and-mod-auth-mellon/2120/6 "2022-06-21T21:33:12Z")

</div>

Do you have `ondemand-dex` installed? We have logic to recognize it and auto-populate OIDC fields. Remove that rpm if so.

---

<div class="post-metadata">

**Author:** ![ssofya](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/ssofya/32/1145_2.png) [@ssofya](https://discourse.openondemand.org/u/ssofya)\
**Post date:** [June 21, 2022, 10:01pm UTC](https://discourse.openondemand.org/t/testing-ondemand-with-saml-and-mod-auth-mellon/2120/7 "2022-06-21T22:01:47Z")

</div>

I used to have it installed, but I installed it a while ago. Is it possible if some config files or libs still there?

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [June 21, 2022, 10:09pm UTC](https://discourse.openondemand.org/t/testing-ondemand-with-saml-and-mod-auth-mellon/2120/8 "2022-06-21T22:09:05Z")

</div>

Before we think there’s a bug with this - can you upload and/or show your `ood_portal.yml`. OIDC is the default even without dex installed so we should also check to see if that is properly formatted YAML or if there’s something else that we’re just overlooking in the config.

If it is finding `ondemand-dex` with or without it installed, it’s looking for the config directory `/etc/ood/dex` and the file `/usr/sbin/ondemand-dex`. Note that it’s an AND operation - so that would seem odd if the RPM did not remove `/usr/sbin/ondemand-dex`.

> <https://github.com/OSC/ondemand/blob/21bf7bd77dbb16221a43b134aecb90d3ace5ee29/ood-portal-generator/lib/ood_portal_generator/dex.rb#L64-L66>

---

<div class="post-metadata">

**Author:** ![ssofya](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/ssofya/32/1145_2.png) [@ssofya](https://discourse.openondemand.org/u/ssofya)\
**Post date:** [June 21, 2022, 10:34pm UTC](https://discourse.openondemand.org/t/testing-ondemand-with-saml-and-mod-auth-mellon/2120/9 "2022-06-21T22:34:23Z")

</div>

I don’t have /usr/sbin/ondemand-dex, but I do have /etc/ood/dex. I renamed it ( didn’t remove) and re-run /opt/ood/ood-portal-generator/sbin/update\_ood\_portal --force but it didn’t help.

Is it safe to remove and try again?

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [June 22, 2022, 2:38am UTC](https://discourse.openondemand.org/t/testing-ondemand-with-saml-and-mod-auth-mellon/2120/10 "2022-06-22T02:38:19Z")

</div>

Can you upload or format your `ood_portal.yml`?

---

<div class="post-metadata">

**Author:** ![ssofya](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/ssofya/32/1145_2.png) [@ssofya](https://discourse.openondemand.org/u/ssofya)\
**Post date:** [June 23, 2022, 7:51pm UTC](https://discourse.openondemand.org/t/testing-ondemand-with-saml-and-mod-auth-mellon/2120/11 "2022-06-23T19:51:08Z")

</div>

I finally found it. I didn’t comment one line in my ood\_portal.yml I commented it and we are good now.

Thank you so much for all your help

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/b/bae70bd0ed39a3ae769c2108155f4cb3e9da8385.png) [@system](https://discourse.openondemand.org/u/system)\
**Post date:** [December 20, 2022, 7:51pm UTC](https://discourse.openondemand.org/t/testing-ondemand-with-saml-and-mod-auth-mellon/2120/12 "2022-12-20T19:51:53Z")

</div>

Closed on December 20, 2022, 7:51pm UTC

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.