Logout redirect in ood_portal.yml not updating ood-portal.conf

[btsherid]

Hi,

I'm having an issue where the update_ood_portal script is not updating the logout_redirect directive in the Apache configuration.

This is how I expect things to work:

1. Edit logout_redirect in /etc/ood/config/ood_portal.yml
2. /opt/ood/ood-portal-generator/sbin/update_ood_portal runs without errors
3. The Redirect "/logout" line in /etc/httpd/conf.d/ood-portal.conf should update to match what is configured for logout_redirect in /etc/httpd/conf.d/ood-portal.conf

What I'm actually seeing:

1. Edit logout_redirect in /etc/ood/config/ood_portal.yml
2. /opt/ood/ood-portal-generator/sbin/update_ood_portal runs without errors
3. The Redirect "/logout" line in /etc/httpd/conf.d/ood-portal.conf is always Redirect "/logout" "/oidc?logout=https%3A%2F%2F<<server FQDN>>"

The end result is that the logout button does not work until I manually edit the Redirect "/logout" line in /etc/httpd/conf.d/ood-portal.conf and restart httpd. So my logout button is currently working using the manual edit workaround, but I know that is not the recommended way to update this.

I do not seem to have this issue with any other directive in /etc/ood/config/ood_portal.yml

[johrstrom]

I'll have to look into it. It sounds like a bug. I take it that you're not using OIDC?

[btsherid]

Correct. We have historically been using LDAP but just switched to Shibboleth this morning.

[johrstrom]

I'll take a look. My guess is it's meant to be an OIDC thing so it takes some liberties. How can you logout with Shibboleth? I mean did you have to create a /logout Location or similar?

[btsherid]

When we install Shibboleth, it creates the necessary Apache Locations. So when it comes to OnDemand, I just have to specify /logout to redirect to /Shibboleth.sso/Logout

[johrstrom]

OK - if you already have the route - I wonder if you need the ood_portal.yml config at all. I mean, if it's on your menu as /Shibboleth.sso/Logout do you need the redirect?

[btsherid]

I think that would be fine, but I don't know how to configure that. The logout button on the dashboard currently points to /logout. If I could change that to /Shibboleth.sso/Logout, then yes, I wouldn't need to worry about the redirect.

[johrstrom]

🤦‍♂️ yes you appear to be right. It looks to be hard coded.

ondemand/apps/dashboard/app/views/layouts/nav/_log_out.html.erb

Line 2 in 4d47b5d

<a class="nav-link" href="/logout" title="<%= t('dashboard.nav_logout') %>" role="menuitem">

Here's what you can do in the interim that will survive upgrades (i.e., you're not modifying the source code that'll get overwritten when you update, you're supplying a config that won't be touched when you upgrade).

Take this file that I've linked (or copy the file you have on your system) and follow this documentation here. The documentation's example is about supplying a new footer, but the message is the same - you want to supply a new partial for this navigation bar entry and change the href to /Shibboleth.sso/Logout.

https://osc.github.io/ood-documentation/latest/customizations.html#overriding-pages

[btsherid]

OK, so the URL is hard coded which makes that option more difficult.

The other option is to get /opt/ood/ood-portal-generator/sbin/update_ood_portal to correctly update the redirect. Any ideas on that? I tested and logout_uri correctly updates the Apache file, but logout_redirect does not.

Thanks,
Brendan

[johrstrom]

OK, so the URL is hard coded which makes that option more difficult.

It's hard coded in the partial we ship. You can override the partial we ship to correct it. I think this is your best route because it's upgrade safe.

You've likely found a bug which means any updates you make are going to get wiped out when you upgrade, or worse create new bugs.

[btsherid]

Got it. I was able to override the partial and set the login button to the correct URL.

[johrstrom]

Somehow we've hit a spot where it believes dex is enabled and is reconfiguring it as such.

Can you provide your ood_portal.yml redacting anything you need to? I need it as test data to write tests against, because I'm not 100% sure how we got into this state. Do you have ondemand-dex installed?

[btsherid]

Sure. We do still have the ondemand-dex RPM installed, but are no longer using it because we have moved to Shibboleth auth.

Should I get rid of the dex: section in ood_portal.yml now that we are using Shibboleth?

# cat /etc/ood/config/ood_portal.yml | grep -v '#'
---


servername: ondemand.bioinf.unc.edu



ssl:
  - 'SSLCertificateFile "/path/to/cert/file"'
  - 'SSLCertificateKeyFile "/path/to/key/file"'
  - 'SSLCertificateChainFile "/path/to/interm/file"'












auth:
  - "AuthType shibboleth"
  - "ShibRequestSetting requireSession 1"
  - "RequestHeader edit* Cookie \"(^_shibsession_[^;]*(;\\s*)?|;\\s*_shibsession_[^;]*)\" \"\""
  - "RequestHeader unset Cookie \"expr=-z %{req:Cookie}\""
  - 'Require shib-user  '


user_map_cmd: "/opt/ood/ood_auth_map/bin/ood_auth_map.regex --regex='^(\\w+)@unc.edu'"




































dex:
  frontend:
    issuer: "LBG OnDemand (DEV)"
    extra:
      loginTitle: "Log in with your ONYEN and password"
      loginButtonText: "Log in to LBG Cluster OnDemand (DEV)"
      usernamePlaceholder: "ONYEN"
      passwordPlaceholder: "ONYEN password"
  connectors:
    - type: ldap
      id: ldap
      name: LDAP
      config:
        host: ldap.unc.edu
        insecureSkipVerify: false
        bindDN: cn=unc:app:med:ccc:lbg,ou=Applications,dc=unc,dc=edu
        bindPW: HvMgWElDg1Wz%dg@YQIF&w
        userSearch:
          baseDN: ou=people,dc=unc,dc=edu
          filter: "(objectClass=posixAccount)"
          username: uid
          idAttr: uid
          emailAttr: mail
          nameAttr: cn
          preferredUsernameAttr: uid
        groupSearch:
          baseDN: ou=group,dc=unc,dc=edu
          filter: "(objectClass=posixGroup)"
          userMatchers:
            - userAttr: DN
              groupAttr: member
          nameAttr: cn
  expiry:
    signingKeys: "12h"
    idTokens: "24h"
host_regex: '[\w.-]+\.local'
node_uri: '/node'
rnode_uri: '/rnode'
[root@ondemand9 btsherid]#

[johrstrom]

Should I get rid of the dex: section in ood_portal.yml now that we are using Shibboleth?

Yes and remove the RPM. I think with those two actions you can successfully use logout_redirect in ood_portal.yml. We're setting the value for you because you have dex installed and enabled. Surprisingly, that's the only value that being forced, I would have thought there'd be a lot more trouble here.

[johrstrom]

I'm going to close this as I think we solved it. You do infact have dex configured and it installed and this is expected behavior when those two are enabled.