Bug 719411

Summary: Backport patch to mod_wsgi to make ssl functionals available in wsgi access scripts.
Product: [Fedora] Fedora EPEL Reporter: James Slagle <jslagle>
Component: mod_wsgiAssignee: Bryan Kearney <bkearney>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: el5CC: bkearney, jokajak, jorton, prc
Target Milestone: ---   
Target Release: 5.7   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: mod_wsgi-3.2-2.el5 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 719409
: 741889 (view as bug list) Environment:
Last Closed: 2011-12-02 20:47:02 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 719409    
Bug Blocks: 741889    
Attachments:
Description Flags
mod_wsgi patch none

Description James Slagle 2011-07-06 18:13:07 UTC 
Created attachment 511549 [details]
mod_wsgi patch

+++ This bug was initially created as a clone of Bug #719409 +++

For the Pulp project (https://fedorahosted.org/pulp/), we need to be able to
access the http client's ssl certificate from within mod_wsgi.  We use the
client certificate to verify access to the various yum repos hosted by Pulp.

We've been using mod_python with a custom authentication handler that we set
with the PythonAuthenHandler apache config.  However, we want to move fully to
mod_wsgi since mod_python and mod_wsgi don't play nice together.

We can run an authentication script using the WSGIAuthUserScript configuration
for mod_wsgi.  However we need an additional patch from mod_wsgi upstream that
provides access to the client certificate in the implementing script that you
set with WSGIAuthUserScript.

The patch is changeset  1095:e1c09b0c8a2a in the mod_wsgi hg repository.  It's
only been applied for mod_wsgi 4.0, which hasn't been released yet.  I've
tested it, and the patch applies cleanly against version 3.2.  I've also attached the patch to this bugzilla.

More info about the patch on the mod_wsgi mailing list is here:
http://groups.google.com/group/modwsgi/browse_thread/thread/60314471e9d9e907

--- Additional comment from jslagle on 2011-07-06 14:10:50 EDT ---

Created attachment 511548 [details]
mod_wsgi patch
Comment 1 Fedora Update System 2011-11-07 12:28:18 UTC 
mod_wsgi-3.2-2.el5 has been submitted as an update for Fedora EPEL 5.
https://admin.fedoraproject.org/updates/mod_wsgi-3.2-2.el5
Comment 2 Fedora Update System 2011-11-10 07:33:09 UTC 
Package mod_wsgi-3.2-2.el5:
* should fix your issue,
* was pushed to the Fedora EPEL 5 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=epel-testing mod_wsgi-3.2-2.el5'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2011-4937
then log in and leave karma (feedback).
Comment 3 Fedora Update System 2011-12-28 19:54:27 UTC 
mod_wsgi-3.2-2.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.