CoSign - Historique des versions

imported>SylvainBeucler : article publié sur le wiki CoSign

2007-06-13T09:27:31Z

article publié sur le wiki CoSign

2007-06-12T17:19:07Z

Hosts specification

2007-06-12T17:08:29Z

2007-06-12T17:06:41Z

typo logout.cgi -> logout

2007-06-12T16:47:42Z

Apache2 configuration

2007-06-12T16:46:17Z

Apache2 configuration

2007-06-12T16:44:11Z

CoSign configuration

2007-06-12T16:42:55Z

Test

2007-06-12T16:31:41Z

CoSign configuration

2007-06-12T16:31:25Z

Certificates generation : note that testing the connection requires cosignd up

← Version précédente		Version du 13 juin 2007 à 09:27
Ligne 1 :		Ligne 1 :
		+	Article publié sur http://webapps.itcs.umich.edu/cosign/index.php/Cosign_Wiki:Test_install_HOWTO
		+
		+	-----
		+
	HOWTO: I found it difficult to install CoSign 2.0.2a because the documentation contains inaccuracies (TODO: submit a patch), and because it can be hard to debug configuration errors. Here's a working test configuration:		HOWTO: I found it difficult to install CoSign 2.0.2a because the documentation contains inaccuracies (TODO: submit a patch), and because it can be hard to debug configuration errors. Here's a working test configuration:

@@ Ligne 67 : / Ligne 67 : @@
 To clearly distinguish the independent parts of CoSign, we'll add a couple aliases to <code>/etc/hosts</code>:
 .0.0.1 cosignd.local weblogin.local portal.local groupware.local
 == Apache2 configuration ==

@@ Ligne 574 : / Ligne 574 : @@
 * Create <code>/var/www/groupware/index.php</code> for testing:
   <?php
-echo "Hello " . $_SERVER['REMOTE_USER'] . "!";
+ echo "Hello " . $_SERVER['REMOTE_USER'] . "!";
 * You should see "Hello admin!" :)
 * If you get endless redirections, be sure you enabled cookies.

@@ Ligne 3 : / Ligne 3 : @@
 CoSign is composed of 3 main parts:
 * filter: this is mod_cosign, allowing Apache to automatically check the user's CoSign cookie
-* cgi: cosign.cgi and logout.cgi, for initial login and full logout
+* cgi: cosign.cgi and logout, for initial login and full logout
 * cosignd: the daemon that centralises authentication sessions, can be called from different computers where filter and cgi are installed

@@ Ligne 79 : / Ligne 79 : @@
 /etc/apache2/sites-available/default:
   NameVirtualHost *:80
   NameVirtualHost *:443

@@ Ligne 79 : / Ligne 79 : @@
 /etc/apache2/sites-available/default:
   NameVirtualHost *:80
   NameVirtualHost *:443
@@ Ligne 88 : / Ligne 85 : @@
   <VirtualHost *:443>
     # TLS VirtualHost 'cause CoSign requires https login
     SSLEngine		On
     SSLCertificateFile	/etc/apache2/ssl/cert.pem
@@ Ligne 97 : / Ligne 96 : @@
-    # Publish cosign directly at the root (/) of the server:
+    RedirectMatch ^/$ /cosign-bin/cosign.cgi
-    DocumentRoot "/var/lib/cosign/cgi-ssl"
+    ScriptAlias /cosign-bin/ "/var/lib/cosign/cgi-ssl/"
     # CoSign images and CSS
     Alias /cosign/ "/var/lib/cosign/html-local/"
-    # (If the above sounded to complicated, you can publish cosign in a
+    # Variant: publish cosign directly at the root (/) of the server
-    # /cosign-bin subdirectory:)
+   # (you need to modify the templates accordingly):
-    # ScriptAlias /cosign-bin/ "/var/lib/cosign/cgi-ssl/"
+    #DocumentRoot "/var/lib/cosign/cgi-ssl"
@@ Ligne 122 : / Ligne 121 : @@
     # somewhere else)
   </VirtualHost>
   # Redirect people to https if they type the URL directly:
   <VirtualHost *:80>
@@ Ligne 134 : / Ligne 134 : @@
     Include sites-available/cosign-config.inc
     DocumentRoot "/var/lib/cosign/services-local"
@@ Ligne 166 : / Ligne 169 : @@
     </Directory>
   </VirtualHost>
 If you're using Debian, you can easily enable SSL through:

@@ Ligne 259 : / Ligne 259 : @@
 * The <code>cgi</code> doesn't take more than 1 parameter - only service does.
 * <code>set cosignhost</code> is used by cgi, not cosignd. It specifies the host where cosignd runs, and is not related to replication.
 * TODO: fix documentation

@@ Ligne 561 : / Ligne 561 : @@
 == Test ==
-Now hit https://weblogin.local/
+* Now hit http://portal.local/
 == Beyond ==

@@ Ligne 290 : / Ligne 290 : @@
   # - factor names can be used by mod_cosign (CosignRequireFactor)
   # - "-2" means this secondary script is started only if another one was successful
-  #factor /usr/lib/cosign/factor/test login password # test factor
+  #factor /usr/lib/cosign/factor/test login password
   factor /usr/lib/cosign/factor/ldap login password
   factor /usr/lib/cosign/factor/admin -2 login

@@ Ligne 245 : / Ligne 245 : @@
   openssl verify -CApath CA/ -purpose sslserver cosignd.crt
   openssl verify -CApath CA/ -purpose sslclient cgi.crt mod_cosign.crt
-  openssl s_client -connect localhost:6663 -cert cgi.crt -key cgi.key -CApath CA/ \
+ # Once you've got your cosignd running, you can test the connection:
     -showcerts -state -debug -crlf -starttls smtp
   # DO CHECK THAT YOU GET "Verify return code: 0 (ok)"!!!