Autentication integration between Trac and MediaWiki

Question

Hello and thanks for your time!

Scenario: - one apache 2.2,

• one mediawiki 1.7.1 with his mysql database,

• many different trac installation(70+), every with version 0.11.4,

• user autenticate on my company website using apache but later need to autenticate on mediawiki and trac with different login

Constraints:

• I can't change apache, mediawiki or trac version

• I cant' change trac or move or merge projects: 70+ I have

Problem:

• What is best strategy to put mediawiki and trac user autentication using apache only user/psw?

Idea 1

I've found on net CoSign (http://cosign.sourceforge.net/) with plugin for trac and mediawiki:

• trac plugin for CoSign: http://trac-hacks.org/wiki/TracCoSignPlugin

• mediawiki guide for CoSign: http://prowiki.isc.upenn.edu/wiki/CoSigningWebApplications#MediaWiki

Thanks for your time!

Answer 1

I had to resolve similar problem recently but I have done auth integration with my own web application. Your idea to use Trac plugin is correct because you don't need to do anything with your multiple Trac instances, just enable plugin.

CoSign seems to be good solution, it works like my in house plugin. The main idea is very simple.

• Once you are authorized with MediaWiki you get some session cookie (like PHPSESSID).

• Then you go to Trac with your browser (under the same domain name) and this cookie is sent to server

• Trac plugin get this cookie and use to send request to MediaWiki in background asking "Who is it?"

• MediaWiki use passed cookie and built in authorization logic to find username and other user data

• User data returned to Trac plugin

Hope this helps!

Answer 2

HTTP Basic Auth is an option? If so, you can unify all passwords in one htpasswd file and with an .htaccess file you can restrict access to authenticated users.

In trac admin you can set permissions for every user on every project in such way that only members of that project can browse its Trac.

You can use this MediaWiki's extension in order to authenticate via HTTP auth using a pwd file.

Hope it helps.