RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1691894 - [RFE] Config option to change mod_auth_mellon prefix
Summary: [RFE] Config option to change mod_auth_mellon prefix
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: mod_auth_mellon
Version: 8.1
Hardware: Unspecified
OS: Linux
unspecified
low
Target Milestone: rc
: 8.2
Assignee: Jakub Hrozek
QA Contact: Scott Poore
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-03-22 18:55 UTC by David Mulford
Modified: 2020-11-14 12:16 UTC (History)
1 user (show)

Fixed In Version: mod_auth_mellon-0.14.0-8.el8
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-11-05 21:09:17 UTC
Type: Bug
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:3421 0 None None None 2019-11-05 21:09:27 UTC

Description David Mulford 2019-03-22 18:55:18 UTC 
mod_auth_mellon-0.14.0-2.el7 forces a prefix of 'MELLON_' for all environment variables.  It would be nice to change the prefix in the config file from 'MELLON_' to something else to make migrating from another Service Provider easier.

Using MellonSetEnvNoPrefix is a workaround, but with a few dozen environment variables set by the identity provider this is a very tedious process.
Comment 3 Jakub Hrozek 2019-04-10 11:03:48 UTC 
Proposed a PR: https://github.com/Uninett/mod_auth_mellon/pull/200
Comment 4 Jakub Hrozek 2019-04-30 09:30:31 UTC 
Fixed with https://github.com/Uninett/mod_auth_mellon/commit/8949b0e3d9b5df29f43f6ee32efb504f557ff5d3
Comment 8 Scott Poore 2019-06-11 18:48:33 UTC 
Verified.

Version ::

mod_auth_mellon-0.14.0-8.el8.x86_64

Results ::

[root@sp2 ~]# cat /etc/httpd/conf.d/example_app_mellon_keycloak_master.conf
<Location /example_app>
    MellonEnable info
    MellonEndpointPath /example_app/mellon/
    MellonSPMetadataFile /etc/httpd/saml2/example_app_sp_metadata.xml
    MellonSPPrivateKeyFile /etc/httpd/saml2/example_app.key
    MellonSPCertFile /etc/httpd/saml2/example_app.cert
    MellonIdPMetadataFile /etc/httpd/saml2/example_app_keycloak_master_idp_metadata.xml
    MellonIdP IDP
</Location>

<Location /example_app/private>
    AuthType Mellon
    MellonEnable auth
    MellonPostReplay On
    Require valid-user
    MellonEnvPrefix "NOLLEM_"
</Location>

MellonPostDirectory /var/cache/example_app_post_directory


[root@sp2 ~]# cat /var/www/html/example_app/private/index.html 
<html><title>Secure</title>Hello there...from SP ...<br>
<a href="https://sp2.keycloak.test:8443/example_app/mellon/logout?ReturnTo=https://sp2.keycloak.test:8443/example_app/logged_out.html">Log out</a>
<hr>
<pre><!--#printenv --></pre>


[root@sp2 conf.d]# echo Secret123 |keycloak-httpd-client-install --client-originate-method registration --keycloak-server-url https://idp.keycloak.test:8443 --keycloak-admin-username admin --keycloak-admin-password-file -  --app-name example_app --keycloak-realm master --mellon-root example_app --mellon-https-port 8443 --mellon-protected-locations "/example_app/private" --force
[Step  1] Connect to Keycloak Server
[Step  2] Create Directories
[Step  3] Set up template environment
[Step  4] Set up Service Provider X509 Certificiates
[Step  5] Build Mellon httpd config file
[Step  6] Build Mellon SP metadata file
[Step  7] Query realms from Keycloak server
[Step  8] Use existing realm on Keycloak server
[Step  9] Query realm clients from Keycloak server
[Step 10] Get new initial access token
[Step 11] Creating new client using registration service
[Step 12] Enable saml.force.post.binding
[Step 13] Add group attribute mapper to client
[Step 14] Add Redirect URIs to client
[Step 15] Retrieve IdP metadata from Keycloak server
[Step 16] Completed Successfully


Then accessed https://sp2.keycloak.test:8443/example_app/private as ipauser1 and see this:

...
NOLLEM_NAME_ID=G-7a28d52b-deae-4e29-a78f-d6c3168b2b19
NOLLEM_NAME_ID_0=G-7a28d52b-deae-4e29-a78f-d6c3168b2b19
NOLLEM_groups=ipausers
NOLLEM_groups_0=ipausers
NOLLEM_Role=offline_access
NOLLEM_Role_0=offline_access
NOLLEM_Role_1=manage-account
NOLLEM_Role_2=uma_authorization
NOLLEM_Role_3=manage-account-links
NOLLEM_Role_4=view-profile
NOLLEM_IDP=https://idp.keycloak.test:8443/auth/realms/master
NOLLEM_IDP_0=https://idp.keycloak.test:8443/auth/realms/master
...
Comment 10 errata-xmlrpc 2019-11-05 21:09:17 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2019:3421
Note You need to log in before you can comment on or make changes to this bug.