Changes between Version 6 and Version 7 of TracModWSGI
- Timestamp:
- Jul 25, 2015, 7:08:55 PM (9 years ago)
Legend:
- Unmodified
- Added
- Removed
- Modified
-
TracModWSGI
v6 v7 1 = Trac and mod_wsgi 2 3 [http s://github.com/GrahamDumpleton/mod_wsgimod_wsgi] is an Apache module for running WSGI-compatible Python applications directly on top of the Apache webserver. The mod_wsgi adapter is written completely in C and provides very good performance.1 = Trac and mod_wsgi = 2 3 [http://code.google.com/p/modwsgi/ mod_wsgi] is an Apache module for running WSGI-compatible Python applications directly on top of the Apache webserver. The mod_wsgi adapter is written completely in C and provides very good performance. 4 4 5 5 [[PageOutline(2-3,Overview,inline)]] … … 7 7 == The `trac.wsgi` script 8 8 9 Trac can be run on top of mod_wsgi with the help of an application script, which is just a Python file saved with a `.wsgi` extension. 10 11 A robust and generic version of this file can be created using the `trac-admin <env> deploy <dir>` command which automatically substitutes the required paths, see TracInstall#cgi-bin. The script should be sufficient for most installations and users not wanting more information can proceed to [#Mappingrequeststothescript configuring Apache]. 12 13 If you are using Trac with multiple projects, you can specify their common parent directory using the `TRAC_ENV_PARENT_DIR` in trac.wsgi: 14 {{{#!python 15 def application(environ, start_request): 16 # Add this to config when you have multiple projects 17 environ.setdefault('trac.env_parent_dir', '/usr/share/trac/projects') 18 .. 19 }}} 9 Trac can be run on top of mod_wsgi with the help of the following application script, which is just a Python file, though usually saved with a `.wsgi` extension. 20 10 21 11 === A very basic script … … 71 61 Change it according to the path you installed the Trac libs at. 72 62 63 === Recommended `trac.wsgi` script 64 65 A somewhat robust and generic version of this file can be created using the `trac-admin <env> deploy <dir>` command which automatically substitutes the required paths, see TracInstall#cgi-bin. 66 67 If you are using Trac with multiple projects, you can specify their common parent directory using the `TRAC_ENV_PARENT_DIR` in the trac.wsgi in trac.wsgi: '' 68 69 {{{#!python 70 def application(environ, start_request): 71 Add this to config when you have multiple projects 72 environ.setdefault('trac.env_parent_dir', '/usr/share/trac/projects') 73 .. 74 .. 75 }}} 76 73 77 == Mapping requests to the script 74 78 75 79 After preparing your .wsgi script, add the following to your Apache configuration file, typically `httpd.conf`: 76 80 77 {{{ #!apache81 {{{ 78 82 WSGIScriptAlias /trac /usr/local/trac/mysite/apache/mysite.wsgi 79 83 … … 89 93 If you followed the directions [TracInstall#cgi-bin Generating the Trac cgi-bin directory], your Apache configuration file should look like following: 90 94 91 {{{ #!apache95 {{{ 92 96 WSGIScriptAlias /trac /usr/share/trac/cgi-bin/trac.wsgi 93 97 … … 115 119 The following sections describe different methods for setting up authentication. See also [http://httpd.apache.org/docs/2.2/howto/auth.html Authentication, Authorization and Access Control] in the Apache guide. 116 120 117 === Using Basic Authentication 121 === Using Basic Authentication === 118 122 119 123 The simplest way to enable authentication with Apache is to create a password file. Use the `htpasswd` program as follows: 120 {{{ #!sh124 {{{ 121 125 $ htpasswd -c /somewhere/trac.htpasswd admin 122 126 New password: <type password> … … 126 130 127 131 After the first user, you don't need the "-c" option anymore: 128 {{{ #!sh132 {{{ 129 133 $ htpasswd /somewhere/trac.htpasswd john 130 134 New password: <type password> … … 138 142 139 143 Now, you need to enable authentication against the password file in the Apache configuration: 140 {{{ #!apache144 {{{ 141 145 <Location "/trac/login"> 142 146 AuthType Basic … … 148 152 149 153 If you are hosting multiple projects, you can use the same password file for all of them: 150 {{{ #!apache154 {{{ 151 155 <LocationMatch "/trac/[^/]+/login"> 152 156 AuthType Basic … … 159 163 See also the [http://httpd.apache.org/docs/2.2/mod/mod_auth_basic.html mod_auth_basic] documentation. 160 164 161 === Using Digest Authentication 165 === Using Digest Authentication === 162 166 163 167 For better security, it is recommended that you either enable SSL or at least use the “digest” authentication scheme instead of “Basic”. 164 168 165 169 You have to create your `.htpasswd` file with the `htdigest` command instead of `htpasswd`, as follows: 166 {{{ #!sh167 $htdigest -c /somewhere/trac.htpasswd trac admin170 {{{ 171 # htdigest -c /somewhere/trac.htpasswd trac admin 168 172 }}} 169 173 170 174 The "trac" parameter above is the "realm", and will have to be reused in the Apache configuration in the !AuthName directive: 171 175 172 {{{ #!apache176 {{{ 173 177 <Location "/trac/login"> 174 AuthType Digest 175 AuthName "trac" 176 AuthDigestDomain /trac 177 AuthUserFile /somewhere/trac.htpasswd 178 Require valid-user 178 179 AuthType Digest 180 AuthName "trac" 181 AuthDigestDomain /trac 182 AuthUserFile /somewhere/trac.htpasswd 183 Require valid-user 179 184 </Location> 180 185 }}} … … 185 190 186 191 Don't forget to activate the mod_auth_digest. For example, on a Debian 4.0r1 (etch) system: 187 {{{ #!apache188 LoadModule auth_digest_module /usr/lib/apache2/modules/mod_auth_digest.so192 {{{ 193 LoadModule auth_digest_module /usr/lib/apache2/modules/mod_auth_digest.so 189 194 }}} 190 195 … … 196 201 197 202 1. You need to load the following modules in Apache httpd.conf: 198 {{{#!apache 199 LoadModule ldap_module modules/mod_ldap.so 200 LoadModule authnz_ldap_module modules/mod_authnz_ldap.so 201 }}} 202 1. Your httpd.conf also needs to look something like: 203 {{{#!apache 203 {{{ 204 LoadModule ldap_module modules/mod_ldap.so 205 LoadModule authnz_ldap_module modules/mod_authnz_ldap.so 206 }}} 207 208 2. Your httpd.conf also needs to look something like: 209 210 {{{ 204 211 <Location /trac/> 205 212 # (if you're using it, mod_python specific settings go here) … … 215 222 </Location> 216 223 }}} 217 1. You can use the LDAP interface as a way to authenticate to a Microsoft Active Directory. Use the following as your LDAP URL: 218 {{{#!apache 219 AuthLDAPURL "ldap://directory.example.com:3268/DC=example,DC=com?sAMAccountName?sub?(objectClass=user)" 220 }}} 221 You will also need to provide an account for Apache to use when checking credentials. As this password will be listed in plaintext in the config, you need to use an account specifically for this task: 222 {{{#!apache 223 AuthLDAPBindDN ldap-auth-user@example.com 224 AuthLDAPBindPassword "password" 225 }}} 226 The whole section looks like: 227 {{{#!apache 224 225 3. You can use the LDAP interface as a way to authenticate to a Microsoft Active Directory: 226 227 Use the following as your LDAP URL: 228 {{{ 229 AuthLDAPURL "ldap://directory.example.com:3268/DC=example,DC=com?sAMAccountName?sub?(objectClass=user)" 230 }}} 231 232 You will also need to provide an account for Apache to use when checking credentials. As this password will be listed in plaintext in the config, you need to use an account specifically for this task: 233 {{{ 234 AuthLDAPBindDN ldap-auth-user@example.com 235 AuthLDAPBindPassword "password" 236 }}} 237 238 The whole section looks like: 239 {{{ 228 240 <Location /trac/> 229 241 # (if you're using it, mod_python specific settings go here) … … 239 251 authzldapauthoritative Off 240 252 # require valid-user 241 Require ldap-group CN=Trac Users,CN=Users,DC=company,DC=com253 require ldap-group CN=Trac Users,CN=Users,DC=company,DC=com 242 254 </Location> 243 255 }}} … … 246 258 247 259 Note 2: You can also require the user be a member of a certain LDAP group, instead of just having a valid login: 248 {{{ #!apache249 Require ldap-group CN=Trac Users,CN=Users,DC=example,DC=com260 {{{ 261 Require ldap-group CN=Trac Users,CN=Users,DC=example,DC=com 250 262 }}} 251 263 … … 258 270 259 271 If you are using Apache on Windows, you can use mod_auth_sspi to provide single-sign-on. Download the module from the !SourceForge [http://sourceforge.net/projects/mod-auth-sspi/ mod-auth-sspi project] and then add the following to your !VirtualHost: 260 {{{ #!apache261 <Location /trac/login>262 AuthType SSPI263 AuthName "Trac Login"264 SSPIAuth On265 SSPIAuthoritative On266 SSPIDomain MyLocalDomain267 SSPIOfferBasic On268 SSPIOmitDomain Off269 SSPIBasicPreferred On270 Require valid-user271 </Location>272 {{{ 273 <Location /trac/login> 274 AuthType SSPI 275 AuthName "Trac Login" 276 SSPIAuth On 277 SSPIAuthoritative On 278 SSPIDomain MyLocalDomain 279 SSPIOfferBasic On 280 SSPIOmitDomain Off 281 SSPIBasicPreferred On 282 Require valid-user 283 </Location> 272 284 }}} 273 285 … … 285 297 286 298 Here is an example (from the !HttpAuthStore link) using acct_mgr-0.4 for hosting a single project: 287 {{{ #!ini299 {{{ 288 300 [components] 289 301 ; be sure to enable the component … … 296 308 }}} 297 309 This will generally be matched with an Apache config like: 298 {{{ #!apache310 {{{ 299 311 <Location /authFile> 300 312 …HTTP authentication configuration… … … 313 325 314 326 Create the htpasswd file: 315 {{{ #!sh327 {{{ 316 328 cd /home/trac-for-my-proj/the-env 317 329 htpasswd -c htpasswd firstuser … … 323 335 Create this file e.g. (ubuntu) `/etc/apache2/sites-enabled/trac.my-proj.my-site.org.conf` with the following content: 324 336 325 {{{ #!apache337 {{{ 326 338 <Directory /home/trac-for-my-proj/the-deploy/cgi-bin/trac.wsgi> 327 339 WSGIApplicationGroup %{GLOBAL} … … 356 368 If you plan to use `mod_wsgi` in embedded mode on Windows or with the MPM worker on Linux, then you will need version 0.3.4 or greater. See [trac:#10675] for details. 357 369 358 === Getting Trac to work nicely with SSPI and 'Require Group' 370 === Getting Trac to work nicely with SSPI and 'Require Group' === 359 371 360 372 If you have set Trac up on Apache, Win32 and configured SSPI, but added a 'Require group' option to your apache configuration, then the SSPIOmitDomain option is probably not working. If it is not working, your usernames in Trac probably look like 'DOMAIN\user' rather than 'user'. … … 374 386 }}} 375 387 376 === Trac with PostgreSQL 388 === Trac with PostgreSQL === 377 389 378 390 When using the mod_wsgi adapter with multiple Trac instances and PostgreSQL (or MySQL?) as the database, the server ''may'' create a lot of open database connections and thus PostgreSQL processes.
