Topic: .htaccess to ibay html folder by SME group?

[dmcguire]

Hi,

I have a project server running on SME 7.4 hosting a project web page at http://smeserver/project with a custom template fragment for "require valid users" which works nicely. (I have https redirection working also).

Now I need to add other projects, each with it's own iBay containing a .htaccess protected hmtl folder hosting the project web page. Since I don't want users for project#1 to see the web site for project#2, I cannot use "require valid user" as this allows access to both project#1 & project#2 with any valid SME username/password.

Using "require smeuser1 smeuser2" in the fragment works OK, but is a bit cumbersome for more than a few users. Also, one user may need access to several projects, so doing this by groups would be better.

So I created the group "testgroup" in SME admin and assigned user "testuser" to the group. Then I used "require group testgroup" in my custom template fragment, expanded the template and restarted httpd etc. no problems. However after I login to http://smeserver/test09/ folder I have protected with this method I get "500 Internal Server Error" and /var/log/httpd/error_log says "configuration error:  couldn't check access.  No groups file?: /test09/"

The other ibays using "require smeuser1 smeuser2... etc." continue to work fine.

So my questions - Is it possible to limit access to ..../ibayname/html/ using SME groups? If so, can anyone demonstrate the custom template fragment required to do this?
 
Thanks in advance,
Declan

[dmcguire]

Bump!

So my questions - Is it possible to limit access to ..../ibayname/html/ using SME groups?

Anyone? I'm really going to struggle with this if it has to be user by user...

[CharlieBrady]

Using "require smeuser1 smeuser2" in the fragment works OK, but is a bit cumbersome for more than a few users. Also, one user may need access to several projects, so doing this by groups would be better.

The way to do this is to expand the group name into a list of users inside the template fragment.

[dmcguire]

Thanks for the prompt response, but I'm still somewhat lost I'm afraid, or more likely my skills in template modification need improving!

I don't know how to expand a group name into a list of users inside the template fragment.
Is the process documented somewhere? If so any pointers would be helpful.

Thanks in advance.

Edit: Typo corrected.

[cactus]

Thanks for the prompt response, but I'm still somewhat lost I'm afraid, or more likely my skills in template modification need improving!

I don't know how to expand a group name into a list of users inside the template fragment.
Is the process documented somewhere? If so any pointers would be helpful.

Thanks in advance.

Edit: Typo corrected.

No this is not documented, but some contribs do the same, for instance the smeserver-subversion contrib, the code is in the 28SubversionContent fragment, the source can be downloaded from CVS, due to limited time I can not provide you more detailed information right now.

[dmcguire]

That's sufficient to get me researching, so thanks for that, much appreciated.

Update: Will try this later today or tomorrow & post result;
http://forums.contribs.org/index.php/topic,38959.msg177967.html#msg177967

[festus]

Hi Declan,

Glad to read that you have successfully configured sme to run https access to i-bay.
I would appreciate if you can update here your notes on the sequence of configuration steps using the template system to provide https access to a specific i-bay. Hopefully you have documented the actual configuration steps you have done to make this to work successfully.

I would like to configure the server with https access to a few i-bays with virtual host domains with ssl certs. With the experience you have gained, I hope you will be able to provide some direction on achieving this. Would this require that I use one public IP address for each i-bay ? If yes, would appreciate if you can provide some instructions on this based on your experience.

Of course, it will be great to hear from others who are able to share such working configuration notes. I have searched the Forum and came across much older postings relating to this topic. I am listing some of those posts below for reference. I am not sure the configurations proposed in these older posts are applicable to ver 7.4 and 8.x. I would like to implement the multiple https - ibays config on the latest versions of SME.

a) SME Server 7.3 - OSCommerce Install Instructions With Chained SSL Certificate
http://forums.contribs.org/index.php/topic,41974.0.html

b)  Ibays and certificates
http://forums.contribs.org/index.php/topic,18495.0.html
« on: September 15, 2003, 01:42:29 PM »

c) SUCCESSFUL group auth solution!!
http://forums.contribs.org/index.php/topic,38959.msg177967.html#msg177967

was: Re: Apache group authentication question
« Reply #7 on: November 05, 2007, 04:36:00 AM »

d) IP Addresses, External interface
http://forums.contribs.org/index.php/topic,10783.0.html

e)  Webmail.domain.com Virtual Host?
« on: March 11, 2006, 03:17:13 PM »

http://forums.contribs.org/index.php/topic,31130.0.html

Best Regards,

Festus Thomas

[dmcguire]

Hi Declan,

Glad to read that you have successfully configured sme to run https access to i-bay.
I would appreciate if you can update here your notes on the sequence of configuration steps using the template system to provide https access to a specific i-bay. Hopefully you have documented the actual configuration steps you have done to make this to work successfully.

Hi Festus. I followed the how-to in the Wiki which links to an older document by Ray Mitchell. Ray's instructions worked for me (Thanks Ray!) & his how-to is here: http://wiki.contribs.org/Https_redirection

Under /etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf/VirtualHosts/ i have a fragment called 60redir-clientibay

My code fragment looks like this;

{
    if ($port ne "443")
    {
    $OUT .= <<'HERE';
        ## Redirect Web Address to Secure Address
 
        RewriteEngine on
        RewriteRule ^/client1   https://%{HTTP_HOST}/client1
   RewriteRule ^/client2   https://%{HTTP_HOST}/client2
 
        ## End Of Redirect

HERE
}
}

Substitute the names of your iBays for client1 & client 2 above then expand the template etc. per Ray Mitchell instructions in the how-to and you're all done.

I would like to configure the server with https access to a few i-bays with virtual host domains with ssl certs. With the experience you have gained, I hope you will be able to provide some direction on achieving this. Would this require that I use one public IP address for each i-bay ? If yes, would appreciate if you can provide some instructions on this based on your experience.

OK, this is a little outside my experience, but I didn't use a different IP per iBay. My needs are fairly simple, so for my requirements I simply registered a pointer with my ISP of "client.mycompany.com" and had them point that at the public IP of my SME box (in server/gateway mode obviously).

Then for each client I tell them your documentation is at https://client.mycompany.com/client_name

For each iBay I use the .htaccess controls to manage user authentication on a per-user basis. See: http://wiki.contribs.org/Htaccess
So in /etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf I have a fragment called 50AddSecureIbayFolder which looks like this;

<Directory /home/e-smith/files/ibays/client1/html>
AuthName "Client 1 Secure Area - Login Required"
AuthType Basic
AuthExternal pwauth
<Limit GET>
order deny,allow
require user bart homer lisa
</Limit>
</Directory>
<Directory /home/e-smith/files/ibays/client2/html>
AuthName "Client 2 Secure Area - Login Required"
AuthType Basic
AuthExternal pwauth
<Limit GET>
order deny,allow
require user marge moe millhouse chiefwigam ralph grampa abu ned seymour patty otto krusty
</Limit>
</Directory>

So each client has a user (or users) on my SME box, and .htaccess prevents client A's users from accessing the documents of client B.
I have a per-group solution to test for this but didn't get time to do it yet. This way you can authenticate against SME user groups rather than individual SME users.

Finally, http://wiki.contribs.org/Certificates_signed_by_own_CA will allow you to use your own certs if you want to. This prevents browser errors which can put off some users.

Hope that helps.

Edit: I use WinSCP to manage/edit files on my SME box over SSH as I find this easier than using Vi or Pico as suggested in some of the Wiki pages. See http://winscp.net