-
Notifications
You must be signed in to change notification settings - Fork 13
Plugin does not get Username Header #17
Comments
X-Forwarded-User must be set for all REST requests. The easiest way is to host graylog WEB and REST on same address (see docs) |
Ok, I changed set-external-ip to be http://myserver/api, and I even tried setting up graylog on localhost 80 and using squid with the equivalent config (using basic_ncsa_auth instead of kerberos) provided on another bug comment (#16 (comment)), but I still can't make it work. Only way has been using a browser addon to always send a X-Remote-Username, change the SSO config to use that header (disabling the trusted proxies), and then it creates the user and it "works". But I can't make it work with standard auth header, and X-Remote-User header with the squid config in that comment, when javascript overrides the auth header with the bogus session auth header (the one with "password" session) everything breaks and I got the login dialog. |
I use Apache 2.4 with Shibboleth 2.6 and SAML2 and it works ok. Just have to change from default using environment variables to using http headers and configure your attribute-map.xml and the user header in Graylog SSO. This is graylog 2.1.2 though. |
@martinrm77 can you provide some feedback on your configuration of your shibboleth.xml and your attribute-map.xml We are really struggling to get NameID to map to the Graylog user we would like to login as |
@jnerin did you ever get this working? |
I actually didnt change that much, let me summarize: shibboleth2.xml
attribute-map.xml
We get our SAML2 from Microsoft ADFS 3.0 - and these are some values from drop-downs, that should be pretty standard. We use Apache for SSL and SSO auth, so here is the relevant apache config stuff inside the virtual server:
|
Awesome! I will review our configs and see what we are missing. |
Problem description
Steps to reproduce the problem
Environment
Pluging config is:
Graylog package from https://packages.graylog2.org/releases/graylog-omnibus/ubuntu/graylog_2.1.1-1_amd64.deb, this AWS instance is an update of a pre 2.x version following instructions on http://docs.graylog.org/en/2.1/pages/configuration/graylog_ctl.html#migrate-manually-from-1-x-to-2-1-x , that might be relevant.
For us I think the main error is those lines we get on the output when running graylog with debug:
But I can see in tcpdump that the traffic going to graylog has this header:
tcpdump "host 127.0.0.1 and port 9000" -A -i lo
I know that we sent multiple headers, we have been beating this for a while.
Graylog is not automatically creating the users and users receive a login box, even when creating the user manually the user is not granted access.
Relevant parts of graylog debug messages:
The text was updated successfully, but these errors were encountered: