Feature - Shibboleth authentication for WeBWorK 2.18

openwebwork / webwork2

Course management front end for WeBWorK

http://webwork.maa.org/wiki/Main_Page

Other

143 stars 165 forks source link

Feature - Shibboleth authentication for WeBWorK 2.18 #2286

Closed jrchamp closed 2 months ago

jrchamp commented 8 months ago

Hi all! We're planning to upgrade to WeBWorK 2.18 in our environment and we are planning to continue using Shibboleth authentication.

Don't worry! We'll figure out how to make it work (for our own documentation) and then share that back with the community. We are confident in our ability to update the existing Shibboleth integration file for WeBWorK 2.18, especially as we already support a few Shibboleth-adjacent login plugins. The goal will be to keep it as simple as possible to minimize any maintenance concerns (for everyone involved, us included).

For now, please assign this issue to me (@jrchamp) and my colleague (@smbader). If someone, such as @jmacdone or @xcompass, get to it before we can, even better. Teamwork! :heart:

xcompass commented 8 months ago

Great! Our timeline for the upgrade is in the summer. So most likely you will get it before us. Let us know if there is any problem and anyway we can help troubleshooting!

drgrice1 commented 8 months ago

That is great. If you need any advice concerning Mojolicious usage, feel free to ask.

jrchamp commented 6 months ago

Thanks @xcompass and @drgrice1!

Our current progress:

Using httpd as a reverse proxy with mod_shib and shibd
It seems like the only way to get per-request information from httpd to Mojolicious is by setting a request header
Modify the Authen::Shibboleth to check the request header information

Does this seem like a reasonable plan? Is there a better way to send information from httpd to Mojolicious?

drgrice1 commented 6 months ago

That seems to be the only way this can be done since the webwork2 app no longer runs inside the apache2 process. That is unless there is a shibboleth library that the app could directly use. I don't think there is one though.

jrchamp commented 6 months ago

Excellent! We'll do some more testing on our side and open a pull request when ready. Plus add some documentation on the httpd configuration.

drgrice1 commented 6 months ago

That would be great. Thanks for your work on this.

juu7nitw23 commented 3 months ago

Any update on this? Our EDU has been using Shibboleth with WW for a while (now looking to upgrade WW) and we might have to look for alternatives to do our Math placement exams if we cannot find a solution. Thanks

jrchamp commented 3 months ago

Yes! It is working for us and I'm hoping to open a pull request very soon.

jrchamp commented 2 months ago

For anyone else who was eagerly awaiting Shibboleth authentication updates to work with the Mojolicious changes, Pull Request #2443 was opened (with an example configuration for how to set the reverse proxy header to pass) and merged into the WeBWorK-2.19 branch.

I'm content with this issue being closed (my apologies if I'm not supposed to close this myself). If anyone encounters issues with the updated code, please tag me in any issues that get opened.