AdamLantos/redmine_http_auth — Issue #10: Auto Registration with Lazy Authentication
Author: mcbulba
Created: 2011-12-21 15:30:25+00:00
State: open

Hi

First of all: thanks for this plugin.

But I have an issue with lazy authentication and auto registration. I want the redmine site be available without bothering "external" people (that can not authenticate via HTTP-auth). On the other hand, people who can do HTTP authentication should be asked for their credentials using mod_auth_basic when visiting /httpauth-login.

So i setup two location directives in apache2:

# No auth needed

# Basic authentication needed

By doing so I can activate lazy authentication and after being redirected from /httpauth-login to /login people are still logged into redmine.

However, if someone does not have a redmine account yet, he will not be logged in but sent to /httpauth-selfregister which is still OK due to the wildcard in my Location directive. REMOTE_USER is still set at this point. But after clicking on "Submit" he will find himself on / with an error saying "Username is not provided".

Did I do something too complicated and is there another way to achieve the wanted behavior with apache and mod_auth_basic? Otherwise I would suggest to not redirect to / until the session really started and lazy authentication can be applied. Either by starting the session right after creating the new account and then redirecting to home_url like it is done now, or by inserting a redirect to httpauth-login after creating the account.

The latter way would as far as I understood things retry to login using HTTP authentication (REMOTE_USER is still set) and succeed because now the account exists.