Trac and Mylin per XMLRPC

[Kamin, Volker]

Hi!

 

I just setup a testserver running Trac (trunk) and everything but Mylin works fine. The problem is that Mylin seems to be unable to authenticate properly:

-          I use SSPI for authentication with my Windows Active Directory

-          I can connect to Trac’s webinterface and do anything (create tickets, etc.) because I have TRAC_ADMIN rights

-          When I use Mylin (through XMLRPC) I only get “authenticated” rights

-          Also, tickets I create through the webinterface are created by “kamin" while tickets created through XMLRPC are created by “KAMIN”.

-          I cannot give “KAMIN” any rights because all UPPERCASE names are reserved for permissions.

 

Does anyone know this problem? What can I do?

 

Best regards,

Volker

 

--

Dipl.-Inform. Volker Kamin

 

RWTH Aachen University

Embedded Software Laboratory

Ahornstr. 55

52074 Aachen

 

fon: +49 241 80 21157

fax: +49 241 80 22150

web: http://www.embedded.rwth-aachen.de/

 

[Earl]

Volker,

> I just setup a testserver running Trac (trunk) and everything but Mylin works fine. The problem is that Mylin seems to be unable to authenticate properly:
>
> - I use SSPI for authentication with my Windows Active Directory
>
> - I can connect to Trac's webinterface and do anything (create tickets, etc.) because I have TRAC_ADMIN rights
>
> - When I use Mylin (through XMLRPC) I only get "authenticated" rights
>
> - Also, tickets I create through the webinterface are created by "kamin" while tickets created through XMLRPC are created by "KAMIN".
>
> - I cannot give "KAMIN" any rights because all UPPERCASE names are reserved for permissions.
>
> Does anyone know this problem? What can I do?

If you're using SSPI (Kerberos) authentication, the username you get
is coming from your Active Directory username.
Kerberos is case sensitive, so KAMIN is not the same as kamin.
Windows does something special to make the username case insensitive
in normal use.

You'll have to go in there and change the your User logon name to
lower case. (Account tab in Active Directory Users and Computers, I
think, but you can check the actual ticket using kerbtray.)

Alternatively, you could try granting permissions using trac-admin
instead of the web interface. I did that and it seemed to work, but
eventually I decided not to risk breaking Trac and modified my account
in AD.

Hope this helps,

--
Earl

[Cooke, Mark]

Check out: http://trac.edgewall.org/wiki/TracModWSGI

If you look at the code snippet at the bottom, there is an example of
editing the username _between_ apache and trac. As you are
authenticating against AD you know your usernames are all
case-insensitive, so you can just adjust the case of all usernames using
.lower()

I hope this helps or am I misunderstanding where the problem is? I know
nothing about Mylin...

~ Mark C

[osimons]

Actually, I think you can alternatively try to enable a trac.ini
setting that converts all authnames to lower-case - the docs for this
setting says: "Whether login names should be converted to lower case
(since 0.9).":

[trac]
ignore_auth_case = true

This converts authname using .lower()


:::simon

https://www.coderesort.com
http://www.ohloh.net/accounts/osimons

[Cooke, Mark]

>
> Actually, I think you can alternatively try to enable a trac.ini
> setting that converts all authnames to lower-case - the docs for this
> setting says: "Whether login names should be converted to lower case
> (since 0.9).":
>
> [trac]
> ignore_auth_case = true
>
> This converts authname using .lower()
>
>
> :::simon
>

...cool, I had not noticed that! Thanks.

~ Mark C