search

netsandbox / docker-rt

Docker image with RT installation
GNU General Public License v2.0
28 stars 24 forks source link

Make use of tokens for REST2 authentication #7

Closed lelutin closed 3 years ago

lelutin commented 3 years ago

RT 5.0 has integrated v2 of the REST API and the Token authentication module into core.

Tokens are used specifically for accessing the API.

Without this directive, the tokens are not permitting access to the API.

ps. I've left out the apache.rt.conf file in RT 4.x and the template since I don't believe the Token authentication plugin is installed in the 4.x images.

lelutin commented 3 years ago

It would be great to also install both the REST2 and Authen::Token plugins in RT 4.x, but I'm not certain yet how to do this and if that would fit the purpose you intended for those images.

netsandbox commented 3 years ago

Sorry for my late reply.

You modified file 5.0/apache.rt.conf which is generated from template apache.rt.conf, so this will not work.

Also as you mention in https://github.com/CZ-NIC/python-rt/pull/54#issuecomment-720316429 it is not possible to create a token for the root user in the Docker image without using the WebUI. So I don't see a need for the change in this PR.

Regarding RT4.x and the two plugins, this Docker image just provides a basic RT installation without plugins. If you need a RT Docker image with plugins, just use my Docker image as a base for your Docker image.

lelutin commented 3 years ago

Sorry for my late reply.

no problems at all, I sure understand how an intersection of time, spare energy and interest is a rare resource to come by (e.g. having very often a shortage of such a thing myself). thanks for your reply!

Regarding RT4.x and the two plugins, this Docker image just provides a basic RT installation without plugins. If you need a RT Docker image with plugins, just use my Docker image as a base for your Docker image.

OK I can see the need to keep the image as close to a base install as possible. I'll make a sub-image to include plugins then.

You modified file 5.0/apache.rt.conf which is generated from template apache.rt.conf, so this will not work.

woops, maybe I should've spent a bit more time to understand how the build was working.

Also as you mention in CZ-NIC/python-rt#54 (comment) it is not possible to create a token for the root user in the Docker image without using the WebUI. So I don't see a need for the change in this PR.

right, the token part is unfortunate. I guess I'll have to figure out a way to insert a pre-created token value with an sql file in an image based on this one.

however, I would posit that it could still be interesting to add the apache configuration line since it makes some basic feature that is now integrated with RT core possible to use: http basic auth and token-based auth. so even though we can't inject a token for the root account, users can create one using the image and it'll then work instantly.

if you think that it would make sense based on my point above, then I can rework this PR. otherwise I guess we can close it.

Cheers!