Deploying esup-helpdesk with CAS, Shibboleth and application users

This page shows how the esup-helpdesk application can be deployed with CAS, Shibboleth and application authentications.

The Shibboleth authentication is performed by a frontal Apache proxy server with mod_shib (e.g. frontal.domain.edu).

The frontal server proxies all the requests to an application server, served by Tomcat (e.g. application.domain.edu).

<VirtualHost frontal.domain.edu:80>
ServerName ori-oai-webdav-shib.univ-rennes1.fr
VirtualDocumentRoot /data/webapps/ori-oai-webdav-shib.univ-rennes1.fr
#OG le 06/04/2009 les 3 lignes ci-dessous sont pour mettre en oeuvre shib dans esup-commons
ProxyPass /paubry-fixe ajp://81.56.142.118:8080/paubry-fixe min=0 max=100 smax=50 ttl=10 timeout=60
ProxyPass /paubry-ifsic ajp://paubry.ifsic.univ-rennes1.fr:8080/paubry-ifsic min=0 max=100 smax=50 ttl=10 timeout=60

1. ProxyPass /germes http://frontalhttp.univ-rennes1.fr/cgi-bin/printenv.pl

#directive ci-dessous necessaire, sinon /shibboleth est envoye vers ginkgo
Proxypass /shibboleth !

ProxyPass / ajp://ginkgo.univ-rennes1.fr:9597/ min=0 max=100 smax=50 ttl=10 timeout=60 route=ori-oai-webdav-shib
ProxyErrorOverride On
ErrorDocument 403 "Vous n'êtes pas autorisé à accéder à la ressource."

1. Authentification shibboleth (on ne protege pas la racine, mais on protege tous les sous repertoires de ori-oai-webdav)
   <Location ~ "/(actions|files|history|roles|users|workingresource|workspace|paubry-ifsic/stylesheets/shibboleth.faces|
   paubry-fixe/stylesheets/shibboleth.faces)">
   AuthType shibboleth
   ShibRequireSession On
   require valid-user
   </Location>
   </VirtualHost>