mahara-contributors team mailing list archive

[Lorenz Ulrich <1939962@xxxxxxxxxxxxxxxxxx>]

Public bug reported:

A session handler other than "file" is required if the SAML plugin is to
be used. When using a single Redis instance, the following configuration
options are available:

$cfg->sessionhandler = 'redis';
$cfg->ssphpsessionhandler = 'redis';
$cfg->redisserver = 'redis:6379';

Nowadays it's quite common to set a password for accessing the Redis
instance. However, Mahara doesn't allow setting one.

The following calls are affected:

auth/lib.php

ini_set('session.save_path', 'tcp://' . $master->ip . ':' .
$master->port . '?prefix=' . get_config('redisprefix'));

could be using a new setting "redispassword" as follows:

ini_set('session.save_path', 'tcp://' . $master->ip . ':' .
$master->port . '?auth=' . get_config('redispassword') . '&prefix=' .
get_config('redisprefix'));

Also, the password should be made available to SimpleSamlPHP which is
compatible to Redis servers with password (see
auth/saml/extlib/simplesamlphp/lib/SimpleSAML/Store/Redis.php).

Tested with Mahara 21.04.01.

** Affects: mahara
     Importance: Undecided
         Status: New


** Tags: redis saml

-- 
You received this bug notification because you are a member of Mahara
Contributors, which is subscribed to Mahara.
Matching subscriptions: mahara-contributors
https://bugs.launchpad.net/bugs/1939962

Title:
  Password for Redis server cannot be configured

Status in Mahara:
  New

Bug description:
  A session handler other than "file" is required if the SAML plugin is
  to be used. When using a single Redis instance, the following
  configuration options are available:

  $cfg->sessionhandler = 'redis';
  $cfg->ssphpsessionhandler = 'redis';
  $cfg->redisserver = 'redis:6379';

  Nowadays it's quite common to set a password for accessing the Redis
  instance. However, Mahara doesn't allow setting one.

  The following calls are affected:

  auth/lib.php

  ini_set('session.save_path', 'tcp://' . $master->ip . ':' .
  $master->port . '?prefix=' . get_config('redisprefix'));

  could be using a new setting "redispassword" as follows:

  ini_set('session.save_path', 'tcp://' . $master->ip . ':' .
  $master->port . '?auth=' . get_config('redispassword') . '&prefix=' .
  get_config('redisprefix'));

  Also, the password should be made available to SimpleSamlPHP which is
  compatible to Redis servers with password (see
  auth/saml/extlib/simplesamlphp/lib/SimpleSAML/Store/Redis.php).

  Tested with Mahara 21.04.01.

To manage notifications about this bug go to:
https://bugs.launchpad.net/mahara/+bug/1939962/+subscriptions