Feature - Shibboleth authentication for WeBWorK 2.18

[jrchamp]

Hi all! We're planning to upgrade to WeBWorK 2.18 in our environment and we are planning to continue using Shibboleth authentication.

Don't worry! We'll figure out how to make it work (for our own documentation) and then share that back with the community. We are confident in our ability to update the existing Shibboleth integration file for WeBWorK 2.18, especially as we already support a few Shibboleth-adjacent login plugins. The goal will be to keep it as simple as possible to minimize any maintenance concerns (for everyone involved, us included).

For now, please assign this issue to me (@jrchamp) and my colleague (@smbader). If someone, such as @jmacdone or @xcompass, get to it before we can, even better. Teamwork! ❤️

[xcompass]

Great! Our timeline for the upgrade is in the summer. So most likely you will get it before us. Let us know if there is any problem and anyway we can help troubleshooting!

[drgrice1]

That is great. If you need any advice concerning Mojolicious usage, feel free to ask.

[jrchamp]

Thanks @xcompass and @drgrice1!

Our current progress:

• Using httpd as a reverse proxy with mod_shib and shibd
• It seems like the only way to get per-request information from httpd to Mojolicious is by setting a request header
• Modify the Authen::Shibboleth to check the request header information

Does this seem like a reasonable plan? Is there a better way to send information from httpd to Mojolicious?

[drgrice1]

That seems to be the only way this can be done since the webwork2 app no longer runs inside the apache2 process. That is unless there is a shibboleth library that the app could directly use. I don't think there is one though.

[jrchamp]

Excellent! We'll do some more testing on our side and open a pull request when ready. Plus add some documentation on the httpd configuration.

[drgrice1]

That would be great. Thanks for your work on this.

[juu7nitw23]

Any update on this? Our EDU has been using Shibboleth with WW for a while (now looking to upgrade WW) and we might have to look for alternatives to do our Math placement exams if we cannot find a solution. Thanks

[jrchamp]

Yes! It is working for us and I'm hoping to open a pull request very soon.

[jrchamp]

For anyone else who was eagerly awaiting Shibboleth authentication updates to work with the Mojolicious changes, Pull Request #2443 was opened (with an example configuration for how to set the reverse proxy header to pass) and merged into the WeBWorK-2.19 branch.

I'm content with this issue being closed (my apologies if I'm not supposed to close this myself). If anyone encounters issues with the updated code, please tag me in any issues that get opened.