Zarafa webaccess with Shibboleth SSO (saml2) authentication - Revision history

Andres: /* Setup */

2010-11-03T08:23:24Z

Setup

← Older revision		Revision as of 08:23, 3 November 2010
Line 18:		Line 18:
	Order allow,deny		Order allow,deny
	Allow from all		Allow from all
-	'' AuthType shibboleth	+
		+	AuthType shibboleth
	ShibRequireSession On		ShibRequireSession On
	ShibExportAssertion On		ShibExportAssertion On
-	require valid-user''	+	require valid-user
	</Directory></pre>		</Directory></pre>

Andres: /* Setup */

2010-11-03T08:23:05Z

Setup

← Older revision		Revision as of 08:23, 3 November 2010
Line 18:		Line 18:
	Order allow,deny		Order allow,deny
	Allow from all		Allow from all
-	AuthType shibboleth	+	'' AuthType shibboleth
	ShibRequireSession On		ShibRequireSession On
	ShibExportAssertion On		ShibExportAssertion On
-	require valid-user	+	require valid-user''
	</Directory></pre>		</Directory></pre>

Andres: /* Prerequisites */

2010-11-03T08:22:52Z

Prerequisites

← Older revision		Revision as of 08:22, 3 November 2010
Line 2:		Line 2:

	A working installation of:		A working installation of:
-	* Zarafa (tested with 6.40.2 on RHEL5)	+	* Zarafa (tested with 6.40.3 on RHEL5)
	* Apache		* Apache
	* Shibboleth IDP & SP (tested with IDP 2.2 and SP 2.3.1)		* Shibboleth IDP & SP (tested with IDP 2.2 and SP 2.3.1)

Andres: /* Prerequisites */

2010-11-03T08:22:42Z

Prerequisites

← Older revision		Revision as of 08:22, 3 November 2010
Line 4:		Line 4:
	* Zarafa (tested with 6.40.2 on RHEL5)		* Zarafa (tested with 6.40.2 on RHEL5)
	* Apache		* Apache
-	* Shibboleth IDP & SP (tested with IDP 2.1 and SP 2.3.1)	+	* Shibboleth IDP & SP (tested with IDP 2.2 and SP 2.3.1)

	== Setup ==		== Setup ==

Andres: /* Setup */

2010-11-03T08:22:24Z

Setup

← Older revision		Revision as of 08:22, 3 November 2010
Line 7:		Line 7:

	== Setup ==		== Setup ==
-	* This setup assumes that you release the REMOTE_USER attribute after a successful login, if not sure test it with phpinfo();	+	* This setup assumes that you release the ''REMOTE_USER'' attribute after a successful login, if not sure test it with phpinfo();
	* Add the needed shibboleth lines to the zarafa webacces config in ''/etc/httpd/conf.d/zarafa-webaccess.conf''		* Add the needed shibboleth lines to the zarafa webacces config in ''/etc/httpd/conf.d/zarafa-webaccess.conf''
	This is an example of the configuration within Apache. There are other places where you can shibboleth your application		This is an example of the configuration within Apache. There are other places where you can shibboleth your application
Line 25:		Line 25:

	* Alter the zarafa ''server.cfg'' and add the apache user to the ''local_admin_users''. Example: ''local_admin_users'' = root vmail apache		* Alter the zarafa ''server.cfg'' and add the apache user to the ''local_admin_users''. Example: ''local_admin_users'' = root vmail apache
		+
		+	* Alter the file config.php in /usr/share/zarafa-webaccess and change ''LOGINNAME_STRIP_DOMAIN'' to 'true' (single company assumed)

Andres: /* Setup */

2010-11-03T08:20:32Z

Setup

← Older revision		Revision as of 08:20, 3 November 2010
Line 7:		Line 7:

	== Setup ==		== Setup ==
-	* This setup assumes that you release the ~~uid~~ attribute after a successful login	+	* This setup assumes that you release the REMOTE_USER attribute after a successful login, if not sure test it with phpinfo();
	* Add the needed shibboleth lines to the zarafa webacces config in ''/etc/httpd/conf.d/zarafa-webaccess.conf''		* Add the needed shibboleth lines to the zarafa webacces config in ''/etc/httpd/conf.d/zarafa-webaccess.conf''
	This is an example of the configuration within Apache. There are other places where you can shibboleth your application		This is an example of the configuration within Apache. There are other places where you can shibboleth your application
Line 25:		Line 25:

	* Alter the zarafa ''server.cfg'' and add the apache user to the ''local_admin_users''. Example: ''local_admin_users'' = root vmail apache		* Alter the zarafa ''server.cfg'' and add the apache user to the ''local_admin_users''. Example: ''local_admin_users'' = root vmail apache
-
-	* Replace the ''REMOTE_USER'' variable in ''/usr/share/zarafa-webaccess/index.php'' with the uid attribute released by shibboleth.
-
-	~~Change:~~
-	~~<pre>if( ! $_POST && $_SERVER && array_key_exists("REMOTE_USER", $_SERVER)) {~~
-	~~$_SESSION["username"] = utf8_to_windows1252($_SERVER['REMOTE_USER']);</pre>~~
-
-	~~To:~~
-	~~<pre>if( ! $_POST && $_SERVER && array_key_exists("uid", $_SERVER)) {~~
-	~~$_SESSION["username"] = utf8_to_windows1252($_SERVER['uid']);</pre>~~

Ddebyttere: New page: == Prerequisites == A working installation of: * Zarafa (tested with 6.40.2 on RHEL5) * Apache * Shibboleth IDP & SP (tested with IDP 2.1 and SP 2.3.1) == Setup == * This setup assumes t...

2010-10-27T11:13:04Z

New page: == Prerequisites == A working installation of: * Zarafa (tested with 6.40.2 on RHEL5) * Apache * Shibboleth IDP & SP (tested with IDP 2.1 and SP 2.3.1) == Setup == * This setup assumes t...

New page

== Prerequisites ==

A working installation of:
* Zarafa (tested with 6.40.2 on RHEL5)
* Apache
* Shibboleth IDP & SP (tested with IDP 2.1 and SP 2.3.1)

== Setup ==
* This setup assumes that you release the uid attribute after a successful login
* Add the needed shibboleth lines to the zarafa webacces config in ''/etc/httpd/conf.d/zarafa-webaccess.conf''
This is an example of the configuration within Apache. There are other places where you can shibboleth your application

<pre>Alias /webaccess /usr/share/zarafa-webaccess
<Directory /usr/share/zarafa-webaccess/>
DirectoryIndex index.php
Options -Indexes +FollowSymLinks
AllowOverride Options
Order allow,deny
Allow from all
AuthType shibboleth
ShibRequireSession On
ShibExportAssertion On
require valid-user
</Directory></pre>

* Alter the zarafa ''server.cfg'' and add the apache user to the ''local_admin_users''. Example: ''local_admin_users'' = root vmail apache

* Replace the ''REMOTE_USER'' variable in ''/usr/share/zarafa-webaccess/index.php'' with the uid attribute released by shibboleth.

Change:
<pre>if( ! $_POST && $_SERVER && array_key_exists("REMOTE_USER", $_SERVER)) {
$_SESSION["username"] = utf8_to_windows1252($_SERVER['REMOTE_USER']);</pre>

To:
<pre>if( ! $_POST && $_SERVER && array_key_exists("uid", $_SERVER)) {
$_SESSION["username"] = utf8_to_windows1252($_SERVER['uid']);</pre>