Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Hi I have been trying to find a way to get x509 certs for authentication for Trac but I could not find any plugins on TracHacks or tutorials on this.

The closest I've seen so far is this post on google groups

http://groups.google.com/group/trac-users/browse_thread/thread/0ea6cb82058eb9a9?pli=1

Does anyone have any idea where I can find relevant information or know how I can go about doing this?

Thanks

share|improve this question

1 Answer 1

Trac (vainilla) delegates its authentication to the apache (or other server software) and the authorization to trac. So the best way to do what are you trying to, is to issue some certificates to server and users, and setup apache for using it using FakeBasicAuth apache mod_ssl directive.

and configure a VirtualHost:

<VirtualHost 127.0.0.1:443>
    SSLEngine on
    SSLProtocol all
    SSLCipherSuite HIGH:MEDIUM

    SSLCertificateFile /path/to/server.crt
    SSLCertificateKeyFile /path/to/server.key
    SSLCACertificateFile /path/to/ca.crt
    SSLCARevocationPath /path/to/crl

    SetEnvIf User-Agent ".*MSIE.*" \
           nokeepalive ssl-unclean-shutdown \
           downgrade-1.0 force-response-1.0

    SSLVerifyClient optional
    SSLVerifyDepth 1

    <Directory /path/to/project/>
        SetHandler mod_python
        PythonHandler trac.web.modpython_frontend
        PythonOption TracEnvParentDir /path/to/
        PythonOption TracUriRoot /
        SetEnv PYTHON_EGG_CACHE /var/cache/python-eggs
        SSLOptions +StdEnvVars
        SSLOptions +FakeBasicAuth
        AuthName trac
        AuthType Basic
        AuthUserFile /path/to/passwd
        Require valid-user
    </Directory>
</VirtualHost>

Then you will need a htpasswd file containing the DN of the certificate as user and the hash xxj31ZMTZzkVA as password.

You can share the authentication Scheme with Subversion over https and then the user names will match with the commiters

There's also a problem with user names. I solved it patching the trac code itself using something similar to this patch

I'm also using the users mail as "CN" so without configuring, trac knows where to send ticket mails.

All of this for trac 0.11 and 0.10 I haven't upgraded trac yet.

share|improve this answer
    
I will try this out. Thanks! –  sasker Mar 2 '11 at 21:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.