Merge lp:~ce-infrastructure/capomastro/charm-sso into lp:~ubuntuone-hackers/capomastro/charm

[Caio Begotti]

I have worked out a few changes to the original OpenID charm available via jujucharms.com and this merge request uses it to have finally SSO support when deploying Capomastro. No need to manually log into the Apache box to create the store directory and authorization lists. When this is more mature (i.e. reviewed by IS) perhaps we could keep the OpenID charm inside Capomastro's repository to reduce bus factor even further.

[Daniel Manrique (roadmr)]

Ohh, I see now the "don't proxypass /openid" to avoid the loop.

Other than that this looks very close to the template we've been using so +1 from me. Thanks!

review: Approve

=== modified file 'templates/http_virtualhost.tmpl'
--- templates/http_virtualhost.tmpl	2014-11-06 16:24:52 +0000
+++ templates/http_virtualhost.tmpl	2014-11-18 18:36:20 +0000
@@ -25,7 +25,25 @@
     # 
     # RequestHeader set X-FORWARDED-SSL "on"
     # RequestHeader set X-FORWARDED_PROTO "https"
-    
+ 
+    <Location "/">
+        PythonAccessHandler apache_openid::protect
+        PythonOption handler openidteams
+        PythonOption authorized-teams-list-url "file:///etc/apache2/openid/teams.txt"
+        PythonOption action-path "/openid/"
+    </Location>
+
+    <Location "/openid/">
+        Allow from All
+        SetHandler mod_python
+        PythonOption handler openidteams
+        PythonOption store-type file
+        PythonOption store-directory /etc/apache2/openid
+        PythonOption allowed-op-list-url "file:///etc/apache2/openid/providers.txt"
+        PythonOption authorized-teams-list-url "file:///etc/apache2/openid/teams.txt"
+        PythonOption action-path "/openid/"
+    </Location>
+   
     ProxyRequests off
     ProxyPreserveHost on
 
@@ -34,6 +52,7 @@
         Allow from All
     </Proxy>
 
+    ProxyPass /openid !
     ProxyPass / http://{{ capomastro }}/
     ProxyPassReverse / http://{{ capomastro }}/
 </VirtualHost>