hc4
commented
8 years ago X-Forwarded-User must be set for all REST requests. I've spent several hours, before notced this :)
The easiest way is to host graylog WEB and REST on same address (see docs)
Open jnerin opened 8 years ago
hc4
commented
8 years ago X-Forwarded-User must be set for all REST requests. I've spent several hours, before notced this :)
The easiest way is to host graylog WEB and REST on same address (see docs)
jnerin
commented
8 years ago Ok, I changed set-external-ip to be http://myserver/api, and I even tried setting up graylog on localhost 80 and using squid with the equivalent config (using basic_ncsa_auth instead of kerberos) provided on another bug comment (https://github.com/Graylog2/graylog-plugin-auth-sso/issues/16#issuecomment-247988429), but I still can't make it work.
Only way has been using a browser addon to always send a X-Remote-Username, change the SSO config to use that header (disabling the trusted proxies), and then it creates the user and it "works".
But I can't make it work with standard auth header, and X-Remote-User header with the squid config in that comment, when javascript overrides the auth header with the bogus session auth header (the one with "password" session) everything breaks and I got the login dialog.
martinrm77
commented
7 years ago I use Apache 2.4 with Shibboleth 2.6 and SAML2 and it works ok. Just have to change from default using environment variables to using http headers and configure your attribute-map.xml and the user header in Graylog SSO.
This is graylog 2.1.2 though.
kitsushadow
commented
7 years ago @martinrm77 can you provide some feedback on your configuration of your shibboleth.xml and your attribute-map.xml
We are really struggling to get NameID to map to the Graylog user we would like to login as
kitsushadow
commented
7 years ago @jnerin did you ever get this working?
martinrm77
commented
7 years ago I actually didnt change that much, let me summarize:
shibboleth2.xml
<ApplicationDefaults entityID="https://graylog.example.com/shibboleth"
homeURL="https://graylog.example.com/"
REMOTE_USER="User">
attribute-map.xml
<!-- Custom attributes from ADFS -->
<Attribute name="fullName" id="fullName"/>
<Attribute name="email" id="email"/>
<Attribute name="http://schemas.xmlsoap.org/claims/Group" id="Group"/>
<Attribute name="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" id="User"/>
We get our SAML2 from Microsoft ADFS 3.0 - and these are some values from drop-downs, that should be pretty standard. I had to create our own ID's, because the built-in filters for EPPN and the like dropped all our usual data, because it had to be in a specific format. Instead of fixing all the filters, its easier to just use another ID, like "User".
We use Apache for SSL and SSO auth, so here is the relevant apache config stuff inside the virtual server:
<Location />
RequestHeader set X-Graylog-Server-URL "https://graylog.example.com/api"
RequestHeader unset Cookie
ProxyPass http://graylog-server1:9000/
ProxyPassReverse http://graylog-server1:9000/
AuthType shibboleth
ShibRequestSetting requireSession 1
ShibUseEnvironment Off
ShibUseHeaders On
# To enable when graylog sso module supports url-encoded header values
#ShibRequestSetting encoding URL
# Only allow persons in security group
require shib-attr Group ~ OUR-SECURITY-GROUP-NAME
</Location>
<Location /api>
AuthType shibboleth
ShibRequestSetting requireSession 1
require shib-attr Group ~ OUR-SECURITY-GROUP-NAME
</Location>
Awesome! I will review our configs and see what we are missing.
Problem description
Steps to reproduce the problem
Environment
Pluging config is:
Graylog package from https://packages.graylog2.org/releases/graylog-omnibus/ubuntu/graylog_2.1.1-1_amd64.deb, this AWS instance is an update of a pre 2.x version following instructions on http://docs.graylog.org/en/2.1/pages/configuration/graylog_ctl.html#migrate-manually-from-1-x-to-2-1-x , that might be relevant.
For us I think the main error is those lines we get on the output when running graylog with debug:
But I can see in tcpdump that the traffic going to graylog has this header:
tcpdump "host 127.0.0.1 and port 9000" -A -i loI know that we sent multiple headers, we have been beating this for a while.
Graylog is not automatically creating the users and users receive a login box, even when creating the user manually the user is not granted access.
Relevant parts of graylog debug messages: