possible bug found - unable to log out of impersonated user when external authentication enabled
Hi all - We are using a SSO system so that user's authenticate externally from Galaxy.
when I impersonate a user then try to log out as that user, I'm unable to. I get the page " Access to Galaxy user controls is disabled
User controls are disabled when Galaxy is configured for external authentication."
If I close the browser down, and restart, I get my SSO log in page, but when I get to Galaxy, I'm still impersonating the user.
Hey, thanks for this. I've made an issue ( https://github.com/galaxyproject/galaxy/issues/2671) and will check it out today.
On Wed, Jul 27, 2016 at 12:44 PM Ryan G ngsbioinformatics@gmail.com wrote:
Hi all - We are using a SSO system so that user's authenticate externally from Galaxy.
when I impersonate a user then try to log out as that user, I'm unable to. I get the page " Access to Galaxy user controls is disabled
User controls are disabled when Galaxy is configured for external authentication."
If I close the browser down, and restart, I get my SSO log in page, but when I get to Galaxy, I'm still impersonating the user.
Please keep all replies on the list by using "reply all" in your mail client. To manage your subscriptions to this and other Galaxy lists, please use the interface at: https://lists.galaxyproject.org/
To search Galaxy mailing lists use the unified search at: http://galaxyproject.org/search/mailinglists/
Thanks. Clearing out the browser history resolved it but there should be a better way...
On Wed, Jul 27, 2016 at 12:48 PM, Dannon Baker dannon.baker@gmail.com wrote:
Hey, thanks for this. I've made an issue ( https://github.com/galaxyproject/galaxy/issues/2671) and will check it out today.
On Wed, Jul 27, 2016 at 12:44 PM Ryan G ngsbioinformatics@gmail.com wrote:
Hi all - We are using a SSO system so that user's authenticate externally from Galaxy.
when I impersonate a user then try to log out as that user, I'm unable to. I get the page " Access to Galaxy user controls is disabled
User controls are disabled when Galaxy is configured for external authentication."
If I close the browser down, and restart, I get my SSO log in page, but when I get to Galaxy, I'm still impersonating the user.
Please keep all replies on the list by using "reply all" in your mail client. To manage your subscriptions to this and other Galaxy lists, please use the interface at: https://lists.galaxyproject.org/
To search Galaxy mailing lists use the unified search at: http://galaxyproject.org/search/mailinglists/
I did a bit of digging here, and it looks to me like /user/logout should be whitelisted in the middleware, and shouldn't present that "Access to Galaxy user controls is disabled".
I might need a little more information. What revision of Galaxy are you running? Are you serving Galaxy at a subdomain or is any other nonstandard routing in place? As an admin user, if you just directly navigate to http://<your_galaxy_instance>/user/logout, you get the same path-blocked error message?
On Wed, Jul 27, 2016 at 1:15 PM Ryan G ngsbioinformatics@gmail.com wrote:
Thanks. Clearing out the browser history resolved it but there should be a better way...
On Wed, Jul 27, 2016 at 12:48 PM, Dannon Baker dannon.baker@gmail.com wrote:
Hey, thanks for this. I've made an issue ( https://github.com/galaxyproject/galaxy/issues/2671) and will check it out today.
On Wed, Jul 27, 2016 at 12:44 PM Ryan G ngsbioinformatics@gmail.com wrote:
Hi all - We are using a SSO system so that user's authenticate externally from Galaxy.
when I impersonate a user then try to log out as that user, I'm unable to. I get the page " Access to Galaxy user controls is disabled
User controls are disabled when Galaxy is configured for external authentication."
If I close the browser down, and restart, I get my SSO log in page, but when I get to Galaxy, I'm still impersonating the user.
Please keep all replies on the list by using "reply all" in your mail client. To manage your subscriptions to this and other Galaxy lists, please use the interface at: https://lists.galaxyproject.org/
To search Galaxy mailing lists use the unified search at: http://galaxyproject.org/search/mailinglists/
Please keep all replies on the list by using "reply all" in your mail client. To manage your subscriptions to this and other Galaxy lists, please use the interface at: https://lists.galaxyproject.org/
To search Galaxy mailing lists use the unified search at: http://galaxyproject.org/search/mailinglists/
Hi Dannon - We are using 15.10.
We have an Apache Proxy server sitting in front of Galaxy and handling the SSO. There is no non-standard routing in place. Yes, when I navigate to the /user/logout url, I get the "Access to Galaxy user controls is disabled" message.
On Thu, Jul 28, 2016 at 12:16 AM, Dannon Baker dannon.baker@gmail.com wrote:
I did a bit of digging here, and it looks to me like /user/logout should be whitelisted in the middleware, and shouldn't present that "Access to Galaxy user controls is disabled".
I might need a little more information. What revision of Galaxy are you running? Are you serving Galaxy at a subdomain or is any other nonstandard routing in place? As an admin user, if you just directly navigate to http://<your_galaxy_instance>/user/logout, you get the same path-blocked error message?
On Wed, Jul 27, 2016 at 1:15 PM Ryan G ngsbioinformatics@gmail.com wrote:
Thanks. Clearing out the browser history resolved it but there should be a better way...
On Wed, Jul 27, 2016 at 12:48 PM, Dannon Baker dannon.baker@gmail.com wrote:
Hey, thanks for this. I've made an issue ( https://github.com/galaxyproject/galaxy/issues/2671) and will check it out today.
On Wed, Jul 27, 2016 at 12:44 PM Ryan G ngsbioinformatics@gmail.com wrote:
Hi all - We are using a SSO system so that user's authenticate externally from Galaxy.
when I impersonate a user then try to log out as that user, I'm unable to. I get the page " Access to Galaxy user controls is disabled
User controls are disabled when Galaxy is configured for external authentication."
If I close the browser down, and restart, I get my SSO log in page, but when I get to Galaxy, I'm still impersonating the user.
Please keep all replies on the list by using "reply all" in your mail client. To manage your subscriptions to this and other Galaxy lists, please use the interface at: https://lists.galaxyproject.org/
To search Galaxy mailing lists use the unified search at: http://galaxyproject.org/search/mailinglists/
Please keep all replies on the list by using "reply all" in your mail client. To manage your subscriptions to this and other Galaxy lists, please use the interface at: https://lists.galaxyproject.org/
To search Galaxy mailing lists use the unified search at: http://galaxyproject.org/search/mailinglists/
The good news is that I found out why this sounds familiar. The bad news is that I committed a fix for this way back in 14.08, here: https://github.com/galaxyproject/galaxy/commit/5769ea88fa90f3f7c22505cd06aa6..., which is still not working for you (though it does work for my basic external auth configuration even back on 15.10).
The only thing that comes to mind is that somehow your remote_user_email isn't matching up with the admin_users list that's generated here. Are you using remote_user_maildomain (this actually does not work correctly for me in 15.10, so I was unable to test that configuration, though I could see why it might prevent admin_user from matching)? Any chance you want to add a debugging statement or two there and look in the logs to see why that URL isn't being whitelisted for your user?
On Thu, Jul 28, 2016 at 10:50 AM Ryan G ngsbioinformatics@gmail.com wrote:
Hi Dannon - We are using 15.10.
We have an Apache Proxy server sitting in front of Galaxy and handling the SSO. There is no non-standard routing in place. Yes, when I navigate to the /user/logout url, I get the "Access to Galaxy user controls is disabled" message.
On Thu, Jul 28, 2016 at 12:16 AM, Dannon Baker dannon.baker@gmail.com wrote:
I did a bit of digging here, and it looks to me like /user/logout should be whitelisted in the middleware, and shouldn't present that "Access to Galaxy user controls is disabled".
I might need a little more information. What revision of Galaxy are you running? Are you serving Galaxy at a subdomain or is any other nonstandard routing in place? As an admin user, if you just directly navigate to http://<your_galaxy_instance>/user/logout, you get the same path-blocked error message?
On Wed, Jul 27, 2016 at 1:15 PM Ryan G ngsbioinformatics@gmail.com wrote:
Thanks. Clearing out the browser history resolved it but there should be a better way...
On Wed, Jul 27, 2016 at 12:48 PM, Dannon Baker dannon.baker@gmail.com wrote:
Hey, thanks for this. I've made an issue ( https://github.com/galaxyproject/galaxy/issues/2671) and will check it out today.
On Wed, Jul 27, 2016 at 12:44 PM Ryan G ngsbioinformatics@gmail.com wrote:
Hi all - We are using a SSO system so that user's authenticate externally from Galaxy.
when I impersonate a user then try to log out as that user, I'm unable to. I get the page " Access to Galaxy user controls is disabled
User controls are disabled when Galaxy is configured for external authentication."
If I close the browser down, and restart, I get my SSO log in page, but when I get to Galaxy, I'm still impersonating the user.
Please keep all replies on the list by using "reply all" in your mail client. To manage your subscriptions to this and other Galaxy lists, please use the interface at: https://lists.galaxyproject.org/
To search Galaxy mailing lists use the unified search at: http://galaxyproject.org/search/mailinglists/
Please keep all replies on the list by using "reply all" in your mail client. To manage your subscriptions to this and other Galaxy lists, please use the interface at: https://lists.galaxyproject.org/
To search Galaxy mailing lists use the unified search at: http://galaxyproject.org/search/mailinglists/
galaxy-dev@lists.galaxyproject.org
-
Dannon Baker -
Ryan G