root/fixupsspi.py

"""FixupHandlers for SSPI.

mod_auth_sspi has a couple of broken behaviors:

1. If you specify "Require group <groupname>", you cannot also specify
    SSPIOmitDomain (if you do, no SSPI call will be made, and Apache will
    then go looking for a groups file which probably doesn't exist).

You can fix this problem by adding the following line to your .conf:
    
   PythonFixupHandler fixupsspi::strip_domain

2. "SSPIUsernameCase lower" causes my Apache to fail to start.

You can fix this problem by adding the following line to your .conf:
    
   PythonFixupHandler fixupsspi::lcase_user


Put them together, and you get:

<Location /incidents>
   SetHandler mod_python
   PythonHandler trac.web.modpython_frontend
   PythonOption TracUriRoot "/incidents"
   PythonOption TracEnv "C:/projects/incidents/trac"
   
   #NT Domain auth config
   AuthType SSPI
   AuthName "Amor Ministries"
   
   SSPIAuth On
   SSPIAuthoritative On
   SSPIDomain HQAMOR
   PythonFixupHandler fixupsspi::strip_domain fixupsspi::lcase_user
   
   Require group "HQAMOR\Amor Staff"
</Location>

"""

from mod_python import apache

def strip_domain(req):
    if req.user:
        if "\\" in req.user:
            req.user = req.user.split("\\", 1)[1]
        return apache.OK
    else:
        return apache.DECLINED

def lcase_user(req):
    if req.user:
        req.user = req.user.lower()
        return apache.OK
    else:
        return apache.DECLINED