Details
-
Bug
-
Resolution: Fixed
-
Major
-
3.0, 4.1.3
-
None
-
mod_auth_kerb Apache 2.2, Internet Explorer, Tomcat 5
-
AppServerTrustedKerberosAuthServiceImpl kerberos rest
-
Unknown
-
N/A
-
N/A
-
Description
Using mod_auth_kerb with Apache 2.2, Internet Explorer 7 and 8, and the AppServerTrustedKerberosAuthServiceImpl class.
Normally, users aren't required to enter in their passwords, it's all done through mod_auth_kerb.
When doing anything that uses the REST interface, like modifying a parent page, or listing all the wiki pages when creating a link with the WYSIWYG editor to a wiki page, a dialog comes up asking for username/password.
On the apache logs file, I get the following access recorded:
10.10.26.45 - JDoe@DOMAIN.COM [06/May/2011:15:47:08 -0700] "GET /xwiki/rest/wikis/windows7/spaces?r=415914 HTTP/1.1" 401 312
Where DOMAIN.COM is my actual domain.
I tried not requiring a valid user through apache, adding this:
<Location /xwiki/rest>
allow from all
Satisfy Any
</Location>
That doesn't work for me, I still get asked for log in credentials.
10.10.26.45 - - [06/May/2011:16:31:02 -0700] "GET /xwiki/rest/wikis/windows7/search?scope=name&number=10&media=json&q=H HTTP/1.1" 401 312
The user is null (- -).
Attachments
Issue Links
- depends on
-
XWIKI-7093 REST service authentication doesn't check cookies if Authorization header is present
- Closed