[SOLVED] Single Sign On with IIS

[HervE]

Hello,

I'm currently about to deploy OTRS to a new customer.
A prerequisite of this customer is, the user mustn't have to log in since he is already logged in Windows.
This means I have to set Single Sign On (SSO) for both OTRS portals (agent and customer interfaces).

Through SysConfig I modified Customer::AuthModule to "HTTPBasicAuth" (not LDAP).
And naturally I modified the settings in IIS thanks to this. (Basically, I enabled Windows authentication and disabled anonymous authentication.)

But I'm getting this error:
[Thu Jul 24 10:42:07 2014][Notice][Kernel::System::CustomerAuth::HTTPBasicAuth::Auth] User: No $ENV{REMOTE_USER} or $ENV{HTTP_REMOTE_USER} !(REMOTE_ADDR: 127.0.0.1).

I've read carefully the OTRS forum here and there, but most of you seem to use SSO with Apache or LDAP. I don't.
I've read many other pages on the web, tried several things, but REMOTE_USER is still missing.

To see the environment variables, I've added this code in HTTPBasicAuth.pm:

Code: Select all

foreach my $var (sort keys %ENV) {
$Self->{LogObject}->Log(
	Priority => 'notice',
	Message =>	$var . "=" . $ENV{$var},
);
}

As a result, I've got a list of all the known environment variables, but neither REMOTE_USER nor HTTP_REMOTE_USER are here.

What did I do wrong?
Am I missing anything in OTRS or in IIS?

Regards,
HervE

[crythias]

Some have used Shibboleth to handle this.

https://www.google.com/search?q=site:fo ... rg+iis+sso

[HervE]

Thanks for your answer.

https://www.google.com/search?q=site:fo ... rg+iis+sso

I already had a look at many of these. No help, since most of them use SSO with LDAP, whereas I'd like Windows (i.e. HTTPBasicAuth, if I understand correctly).

Some have used Shibboleth to handle this.

So I decided to give Shibboleth a try.
I installed it, and managed (I think) to configure IIS for it, thanks to https://wiki.shibboleth.net/confluence/ ... 7Installer
But now?
I have to configure it for OTRS, so that OTRS both portals are 'protected' by Shibboleth - if I still understand correctly.
Unfortunately, Peggy's blog doesn't explain it. Its "Configuring Shibboleth service provider daemon" section seems to be directed to people who already know Shibboleth. Which is obviously not my case.
Can anybody help?

Other question: Do all users (agents and customers) need to have Shibboleth installed on their computer too?

Found this also, which puzzled me. Doesn't Shibboleth fill the REMOTE_USER environment variable? Does it fill another variable? Which one?

Regards,
HervE

[crythias]

Do all users (agents and customers) need to have Shibboleth installed on their computer too?

No. This is a handler for the client browser to announce to (Shibboleth web site) the current user, at which point, Shibboleth talks to IIS and says, "the browser says the user is x and I believe him".

Doesn't Shibboleth fill the REMOTE_USER environment variable? Does it fill another variable? Which one?

Why not create a page that shows the environment variables.
https://it.uoregon.edu/idm/services/shi ... on-windows shows an asp page to do that.

[crythias]

note also that ldap is probably preferred unless you don't have a domain.

[HervE]

Hello,

I'm back from holidays.

I reinstalled all OTRS and tried again SSO with HTTPBasicAuth.
With the same result: User: No $ENV{REMOTE_USER} or $ENV{HTTP_REMOTE_USER} !(REMOTE_ADDR: 127.0.0.1).

Like I said in my first message, I added Perl code to list environment variables, and as a result it appears that neither REMOTE_USER nor HTTP_REMOTE_USER are here. I still don't know why.

However, if I add the following in sub Auth of HTTPBasicAuth.pm, to enforce the variable, just for testing purpose,

Code: Select all

$ENV{REMOTE_USER} = "<my Windows login>";

it works fine!

What should I do?

Best regards,
HervE

[dnmvisser]

I have seen similar stuff in the past with Perl apps, whereby the web server setting REMOTE_USER would not work.
The variable that I needed was available though, so I fixed worked around it by changing the code to use that variable name instead.
In the OTRS case it meant changing Kernel/System/Auth/HTTPBasicAuth.pm and Kernel/System/CustomerAuth/HTTPBasicAuth.pm

Code: Select all

sub Auth {
    my ( $Self, %Param ) = @_;

    # get params
    # my $User       = $ENV{REMOTE_USER} || $ENV{HTTP_REMOTE_USER};
    my $User       = $ENV{MELLON_CONF_USER};

[HervE]

Hello,

Thanks for your answer.
Indeed I've got a problem prior to SSO: my IIS configuration is wrong, probably due to wrong version of Perl (?)
Hope solving the issue with IIS configuration will solve the SSO issue too...

Regards,
HervE

[HervE]

Since I solved my IIS configuration issues (see this topic and this topic), Single Sign On naturally followed (provided of course that Windows Authentication is enabled in IIS).

At least with Internet Explorer.
With Firefox I still have an authentication popup for some reason, but never mind since my customer uses IE.

Regards,
HervE