994114 - Install mod_authnz_persona on people.mozilla.org

Status: RESOLVED FIXED

(Infrastructure & Operations Graveyard :: WebOps: Other, task)

Description

[Blake Winton (:bwinton) (:☕️)]

Hi!

I've got some things I'ld like to put on my webspace on people.mozilla.org, but they're a little sensitive, and so I'ld like to restrict access to people who work at Mozilla.

If we added the persona apache auth module, then I could add an htaccess file with:
AuthType Persona
Require persona-idp login.mozilla.org
which would be perfect…

Thanks!  :)

Comment 1

[Philippe M. Chiasson (:gozer)]

Attachment: [puppet] Install and configure mod_authnz_persona

It's absolutely possible and should be low impact for folks that don't enable it.

However, since people.mozilla.org is a special snowflake (no staging), I am asking for some review love before even considering making this so.

Comment 2

[Brandon Burton [:solarce]]

I don't see any issues, do a --noop run before applying to be safe

We should probably send this through CAB just to be safe

Comment 3

[Brandon Burton [:solarce]]

Comment on attachment 8404106 [details] [diff] [review]
[puppet] Install and configure mod_authnz_persona

Review of attachment 8404106 [details] [diff] [review]:
-----------------------------------------------------------------

+1

Comment 4

[Jason Crowe [:jd]]

CAB approval for noon PDT Friday (04/18/2014). Requested a MOTD message be put in place for notification.

Comment 5

[Blake Winton (:bwinton) (:☕️)]

So, I added a .htaccess file as described above, but now when I go to https://people.mozilla.org/~bwinton/private/delorian.html it just says "Authorization Required", instead of presenting a Persona login page, as https://github.com/mozilla/mod_authnz_persona suggests it should…

(Perhaps because https://people.mozilla.org/login.shtml returns a 403 Forbidden, which might be because /usr/share/mod_authnz_persona/ doesn't exist?  I'm just guessing here, though.)

Comment 6

[Brandon Burton [:solarce]]

(In reply to Blake Winton (:bwinton) from comment #5)
> So, I added a .htaccess file as described above, but now when I go to
> https://people.mozilla.org/~bwinton/private/delorian.html it just says
> "Authorization Required", instead of presenting a Persona login page, as
> https://github.com/mozilla/mod_authnz_persona suggests it should…
> 
> (Perhaps because https://people.mozilla.org/login.shtml returns a 403
> Forbidden, which might be because /usr/share/mod_authnz_persona/ doesn't
> exist?  I'm just guessing here, though.)

Deploying this was delayed because the folks involved were off Friday, we'll reschedule for later this week

Comment 7

[Philippe M. Chiasson (:gozer)]

Can I just assume we are pushing this one week to noon PDT Friday (04/25/2014) ?

Comment 8

[Brandon Burton [:solarce]]

(In reply to Philippe M. Chiasson (:gozer) from comment #7)
> Can I just assume we are pushing this one week to noon PDT Friday
> (04/25/2014) ?

Yes, please update the MOTD two hours in advance of the work and update the topic in #it before you begin

Comment 9

[Blake Winton (:bwinton) (:☕️)]

Hmm, I'm still getting "Authorization Required" instead of the Persona login page…  Did you run into any difficulties with the deployment?

Comment 10

[Philippe M. Chiasson (:gozer)]

Committed revision 87314.
Committed revision 87315.

Enable and test by dropping in your .htaccess:

 SSLRequireSSL On
 AuthType Persona
 require valid-user

And make sure to access people.mozilla.org via SSL.

See it in action here:

https://people.mozilla.org/~pchiasson/test/