Chapter 30. Authentication Proxy


Home Prev	Part IV. System Configuration and Customization	Next

To support integration of Evergreen with organizational authentication systems, and to reduce the proliferation of user names and passwords, Evergreen offers a service called open-ils.auth_proxy. If you enable the service, open-ils.auth_proxy supports different authentication mechanisms that implement the authenticate method. You can define a chain of these authentication mechanisms to be tried in order within the <authenticators> element of the opensrf.xml configuration file, with the option of falling back to the native mode that uses Evergreen’s internal method of password authentication.

This service only provides authentication. There is no support for automatic provisioning of accounts. To authenticate using any authentication system, the user account must first be defined in the Evergreen database. The user will be authenticated based on the Evergreen username and must match the user’s ID on the authentication system.

In order to activate Authentication Proxy, the Evergreen system administrator will need to complete the following steps:

Edit opensrf.xml.
1. Set the open-ils.auth_proxy app settings enabled tag to true
2. Add the authenticator to the list of authenticators or edit the existing example authenticator:
```
<authenticator>
        <name>ldap</name>
        <module>OpenILS::Application::AuthProxy::LDAP_Auth</module>
        <hostname>name.domain.com</hostname>
        <basedn>ou=people,dc=domain,dc=com</basedn>
        <authid>cn=username,ou=specials,dc=domain,dc=com</authid>
        <id_attr>uid</id_attr>
        <password>my_ldap_password_for_authid_user</password>
        <login_types>
                <type>staff</type>
                <type>opac</type>
        </login_types>
        <org_units>
                <unit>103</unit>
                <unit>104</unit>
        </org_units>
</authenticator>
```
  - name : Used to identify each authenticator.
  - module : References to the perl module used by Evergreen to process the request.
  - hostname : Hostname of the authentication server.
  - basedn : Location of the data on your authentication server used to authenticate users.
  - authid : Administrator ID information used to connect to the Authentication server.
  - id_attr : Field name in the authenticator matching the username in the Evergreen database.
  - password : Administrator password used to connect to the authentication server. Password for the authid.
  - login_types : Specifies which types of logins will use this authenticator. This might be useful if staff use a different LDAP directory than general users.
  - org_units : Specifies which org units will use the authenticator. This is useful in a consortium environment where libraries will use separate authentication systems.
Restart Evergreen and Apache to activate configuration changes.

Tip

If using proxy authentication with library employees that will use the Admin > Change Operator: New feature in the client software, then add "temp" as a login_types.

Prev	Up	Next
Using this Feature	Home	Chapter 31. Kid’s OPAC Configuration