From 46fc20056c5a63ad308bcaf7d87e43e54bc28afb Mon Sep 17 00:00:00 2001 From: Danny Glin Date: Tue, 15 Sep 2026 12:22:12 -0600 Subject: [PATCH] Move all authen module config to localOverrides.conf --- conf/authen_LTI.conf.dist | 26 ++------- conf/authen_ldap.conf.dist | 15 ++--- conf/authen_saml2.conf.dist | 20 ++----- conf/authen_shibboleth.conf.dist | 21 ++----- conf/localOverrides.conf.dist | 96 ++++++++++++++++++-------------- 5 files changed, 72 insertions(+), 106 deletions(-) diff --git a/conf/authen_LTI.conf.dist b/conf/authen_LTI.conf.dist index 6878998405..ff135bd7e7 100644 --- a/conf/authen_LTI.conf.dist +++ b/conf/authen_LTI.conf.dist @@ -35,26 +35,12 @@ $debug_lti_grade_passback = 0; # Authentication settings ################################################################################################ -# This section enables LTI authentication. If a course uses LTI 1.1 (see $LTIVersion below), -# then the LTIAdvanced module will be used. If a course uses LTI 1.3 (see $LTIVersion below), -# the LTIAdvantage will be used. If you know a site will not use one or the other, it can be -# commented out. Failover to Basic_TheLastOption is necessary to authenticate with cookie keys. -$authen{user_module} = [ - 'WeBWorK::Authen::LTIAdvantage', # first try LTI 1.3 - 'WeBWorK::Authen::LTIAdvanced', # next try LTI 1.1 - 'WeBWorK::Authen::Basic_TheLastOption' # fallback authorization method -]; - -# List of authentication modules that may be used to enter the admin course. -# This is used instead of $authen{user_module} when logging into the admin course. -# Since the admin course provides overall power to add/delete courses, access -# to this course should be protected by the best possible authentication you -# have available to you. -$authen{admin_module} = [ - #'WeBWorK::Authen::LTIAdvantage', - #'WeBWorK::Authen::LTIAdvanced', - 'WeBWorK::Authen::Basic_TheLastOption' -]; +# After customizing this file for your LTI configuration, make sure to uncomment +# 'WeBWorK::Authen::LTIAdvantage' # for LTI 1.3 +# and/or +# 'WeBWorK::Authen::LTIAdvanced' # for LTI 1.1 +# in the $authen{user_module} and/or $authen{admin_module} arrays in localOverrides.conf +# in order to enable LTI authentication. # Include configurations. You must uncomment at least one of the following. You may uncomment # both if the site may be using both LTI 1.1 and 1.3 in different courses. After uncommenting diff --git a/conf/authen_ldap.conf.dist b/conf/authen_ldap.conf.dist index 45cc46179a..34ddae0d6b 100644 --- a/conf/authen_ldap.conf.dist +++ b/conf/authen_ldap.conf.dist @@ -7,17 +7,10 @@ # include("conf/authen_ldap.conf") ######################################################################################## -# Set LDAP as the authentication module to use. -$authen{user_module} = 'WeBWorK::Authen::LDAP'; - -# List of authentication modules that may be used to enter the admin course. -# This is used instead of $authen{user_module} when logging into the admin course. -# Since the admin course provides overall power to add/delete courses, access -# to this course should be protected by the best possible authentication you -# have available to you. -$authen{admin_module} = [ - 'WeBWorK::Authen::LDAP' -]; +# After customizing this file for your LDAP server, make sure to uncomment +# "WeBWorK::Authen::LDAP" +# in the $authen{user_module} and/or $authen{admin_module} arrays in localOverrides.conf +# in order to enable LDAP authentication. $authen{ldap_options} = { # hosts to attempt to connect to, in order. For example: diff --git a/conf/authen_saml2.conf.dist b/conf/authen_saml2.conf.dist index d11495f0d3..2c64e9051f 100644 --- a/conf/authen_saml2.conf.dist +++ b/conf/authen_saml2.conf.dist @@ -7,22 +7,10 @@ # compatible with a wide range of SAML2 implementations, including Shibboleth. ################################################################################ -# Set Saml2 as the authentication module to use. -# Comment out 'WeBWorK::Authen::Basic_TheLastOption' if bypassing Saml2 -# authentication is not allowed (see $saml2{bypass_query} below). -$authen{user_module} = [ - 'WeBWorK::Authen::Saml2', - 'WeBWorK::Authen::Basic_TheLastOption' -]; - -# List of authentication modules that may be used to enter the admin course. -# This is used instead of $authen{user_module} when logging into the admin -# course. Since the admin course provides overall power to add/delete courses, -# access to this course should be protected by the best possible authentication -# you have available to you. -$authen{admin_module} = [ - 'WeBWorK::Authen::Saml2' -]; +# After customizing this file for your SAML setup, make sure to uncomment +# 'WeBWorK::Authen::Saml2' +# in the $authen{user_module} and/or $authen{admin_module} arrays in localOverrides.conf +# in order to enable Saml2 authentication. # This URL query parameter can be added to the end of a course url to skip the # saml2 authentication module and go to the next one, for example, diff --git a/conf/authen_shibboleth.conf.dist b/conf/authen_shibboleth.conf.dist index 7453144c89..88332539ef 100644 --- a/conf/authen_shibboleth.conf.dist +++ b/conf/authen_shibboleth.conf.dist @@ -92,23 +92,10 @@ ################################################################################ -# Set Shibboleth as the authentication module to use. -# Comment out 'WeBWorK::Authen::Basic_TheLastOption' if bypassing Saml2 -# authentication via the bypass query option (see $shibboleth{bypass_query} -# below) or the $shiboff option are both not allowed . -$authen{user_module} = [ - 'WeBWorK::Authen::Shibboleth', - 'WeBWorK::Authen::Basic_TheLastOption' -]; - -# List of authentication modules that may be used to enter the admin course. -# This is used instead of $authen{user_module} when logging into the admin -# course. Since the admin course provides overall power to add/delete courses, -# access to this course should be protected by the best possible authentication -# you have available to you. -$authen{admin_module} = [ - 'WeBWorK::Authen::Shibboleth' -]; +# After customizing this file for your Shibboleth setup, make sure to uncomment +# "WeBWorK::Authen::Shibboleth" +# in the $authen{user_module} and/or $authen{admin_module} arrays in localOverrides.conf +# in order to enable Shibboleth authentication. # Set $shiboff to 1 to disable Shibboleth authentication. Usually this is not # set here, but in the course.conf file for a course for which Shibboleth diff --git a/conf/localOverrides.conf.dist b/conf/localOverrides.conf.dist index f54527eb03..6cb716cad0 100644 --- a/conf/localOverrides.conf.dist +++ b/conf/localOverrides.conf.dist @@ -460,44 +460,9 @@ $mail{feedbackRecipients} = [ # Extra modules have been created to allow WeBWorK to use certain external # methods of authentication. - -# Select the authentication module to use for normal logins. -# If this value is a string, then that authentication module will be used. If -# this value is a reference to an array of strings, then each string in the -# array will be successively tested to see if it provides a module that can -# handle the authentication request (by calling that module's -# request_has_data_for_this_verification_module method). The first module that -# responds affirmatively will be used. -#$authen{user_module} = [ -# "WeBWorK::Authen::LDAP", -# "WeBWorK::Authen::Basic_TheLastOption" -#]; - -# Select the authentication module to use for proctor logins. -# A string or a hash is accepted, as above. -#$authen{proctor_module} = "WeBWorK::Authen::Proctor"; - -# List of authentication modules that may be used to enter the admin course. -# This is used instead of $authen{user_module} when logging into the admin course. -# Since the admin course provides overall power to add/delete courses, access -# to this course should be protected by the best possible authentication you -# have available to you. The current default is -# WeBWorK::Authen::Basic_TheLastOption which is simple password based -# authentication for a password locally stored in your WeBWorK server's -# database. On one hand, this is necessary as the initial setting, as it is the -# only option available when a new server is being installed, on the other hand, -# this option does not provide any capabilities to prevent dictionary attacks, etc. -# At the very least you should use a very strong password with two factor authentication. -# If you have the option to use a more secure authentication approach to the admin course -# (one which you are confident cannot be spoofed) that is preferable. -# -# Note that if you include authentication module config files further down, -# those may override the setting of $authen{admin_module} here. - -#$authen{admin_module} = [ -# 'WeBWorK::Authen::LDAP', -# 'WeBWorK::Authen::Basic_TheLastOption' -#]; +# To use any of these modules uncomment the relevant "include" line below, +# and also the relevant lines in the $authen{user_module} (for regular +# courses) and/or $authen{admin_module} (for the admin course) farther below. ################################################################################ # IMS LTI Authentication @@ -510,7 +475,7 @@ $mail{feedbackRecipients} = [ # authen_LTI_1_1.conf, or authen_LTI_1_3.conf.dist to authen_LTI_1_3.conf # depending on which is enabled in authen_LTI.conf (both can be enabled). -#include("conf/authen_LTI.conf"); +#include('conf/authen_LTI.conf'); ################################################################################ # LDAP Authentication @@ -519,7 +484,7 @@ $mail{feedbackRecipients} = [ # You will have to copy the file authen_ldap.conf.dist to authen_ldap.conf, # and then edit that file to fill in the settings for your installation. -#include("conf/authen_ldap.conf"); +#include('conf/authen_ldap.conf'); ################################################################################ # Shibboleth Authentication @@ -529,7 +494,7 @@ $mail{feedbackRecipients} = [ # also need to copy the file authen_shibboleth.conf.dist to authen_shibboleth.conf, # and then edit that file to fill in the settings for your installation. -#include("conf/authen_shibboleth.conf"); +#include('conf/authen_shibboleth.conf'); ################################################################################ # Saml2 Authentication @@ -539,7 +504,54 @@ $mail{feedbackRecipients} = [ # authen_saml2.conf, and then edit that file to fill in the settings for your # installation. -#include("conf/authen_saml2.conf"); +#include('conf/authen_saml2.conf'); + +# Select the authentication module(s) to use for normal logins. +# If this value is a string, then that authentication module will be used. If +# this value is a reference to an array of strings, then each string in the +# array will be successively tested to see if it provides a module that can +# handle the authentication request (by calling that module's +# request_has_data_for_this_verification_module method). The first module that +# responds affirmatively will be used. +# Note that both the LDAP and Basic_TheLastOption modules are 'terminal' in that +# they do not have the capability to continue to another authentication module, +# so if either of these are uncommented, then any addition modules listed after +# them will never be reached. +#$authen{user_module} = [ +# 'WeBWorK::Authen::LTIAdvantage', # first try LTI 1.3 +# 'WeBWorK::Authen::LTIAdvanced', # next try LTI 1.1 +# 'WeBWorK::Authen::Saml2', +# 'WeBWorK::Authen::Shibboleth', +# 'WeBWorK::Authen::LDAP', +# 'WeBWorK::Authen::Basic_TheLastOption'. # WeBWorK internal authentication +#]; + +# Select the authentication module to use for proctor logins. +# A string or a hash is accepted, as above. +#$authen{proctor_module} = "WeBWorK::Authen::Proctor"; + +# List of authentication modules that may be used to enter the admin course. +# This is used instead of $authen{user_module} when logging into the admin course. +# Since the admin course provides overall power to add/delete courses, access +# to this course should be protected by the best possible authentication you +# have available to you. The current default is +# WeBWorK::Authen::Basic_TheLastOption which is simple password based +# authentication for a password locally stored in your WeBWorK server's +# database. On one hand, this is necessary as the initial setting, as it is the +# only option available when a new server is being installed, on the other hand, +# this option does not provide any capabilities to prevent dictionary attacks, etc. +# At the very least you should use a very strong password with two factor authentication. +# If you have the option to use a more secure authentication approach to the admin course +# (one which you are confident cannot be spoofed) that is preferable. +# +#$authen{admin_module} = [ +# 'WeBWorK::Authen::LTIAdvantage', # first try LTI 1.3 +# 'WeBWorK::Authen::LTIAdvanced', # next try LTI 1.1 +# 'WeBWorK::Authen::Saml2', +# 'WeBWorK::Authen::Shibboleth', +# 'WeBWorK::Authen::LDAP', +# 'WeBWorK::Authen::Basic_TheLastOption'. # WeBWorK internal authentication +#]; ################################################################################ # Session Management