Support openid authentication
Whether to thwart spam or to make more private pads add support for very
simple auth mechanism using mod_auth_openid.
Change-Id: Ife0daf670a20afde46516c60f877e1da8026758a
diff --git a/manifests/apache.pp b/manifests/apache.pp
index 52b1548..b3c60f0 100644
--- a/manifests/apache.pp
+++ b/manifests/apache.pp
@@ -10,6 +10,21 @@
$ssl_key_file = '',
$ssl_key_file_contents = '', # If left empty puppet will not create file.
$vhost_name = $::fqdn,
+ # Table containing openid auth details. If undef not enabled
+ # Example dict:
+ # {
+ # banner => "Welcome",
+ # singleIdp => "https://openstackid.org",
+ # trusted => '^https://openstackid.org/.*$',
+ # any_valid_user => false,
+ # users => ['https://openstackid.org/foo',
+ # 'https://openstackid.org/bar'],
+ # }
+ # Note that if you care which users get access set any_valid_user to false
+ # and then provide an explicit list of openids in the users list. Otherwise
+ # set any_valid_user to true and any successfully authenticated user will
+ # get access.
+ $auth_openid = undef,
) {
package { 'ssl-cert':
@@ -40,6 +55,19 @@
ensure => present,
}
}
+ if ($auth_openid != undef) {
+ if !defined(Package['libapache2-mod-auth-openid']) {
+ package { 'libapache2-mod-auth-openid':
+ ensure => present,
+ }
+ }
+ if !defined(Mod['auth_openid']) {
+ httpd::mod { 'auth_openid':
+ ensure => present,
+ require => Package['libapache2-mod-auth-openid'],
+ }
+ }
+ }
file { '/etc/apache2':
ensure => directory,
diff --git a/templates/etherpadlite.vhost.erb b/templates/etherpadlite.vhost.erb
index c579e43..e20fe09 100644
--- a/templates/etherpadlite.vhost.erb
+++ b/templates/etherpadlite.vhost.erb
@@ -38,6 +38,26 @@
# MSIE 7 and newer should be able to use keepalive
BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
+ <% if @auth_openid != nil %>
+ <Location /p/>
+ AuthType OpenID
+ AuthName "<%= @auth_openid['banner'] %>"
+ AuthOpenIDSecureCookie On
+ AuthOpenIDCookieLifespan 3600
+ AuthOpenIDTrustRoot <%= @vhost_name %>
+ AuthOpenIDServerName <%= @vhost_name %>
+ AuthOpenIDSingleIdP <%= @auth_openid['singleIdp'] %>
+ AuthOpenIDTrusted <%= @auth_openid['trusted'] %>
+ <% if @auth_openid['any_valid_user'] %>
+ Require valid-user
+ <% elsif !@auth_openid['users'].empty? %>
+ <% @auth_openid['users'].each do |user| -%>
+ Require user <%= user %>
+ <% end -%>
+ <% end %>
+ </Location>
+ <% end %>
+
<IfModule mod_proxy.c>
# The following redirects "nice" urls such as https://etherpad.example.org/padname
# to https://etherpad.example.org/p/padname. It was problematic directly
