set up gerrit with http authentication
Okay. Actually I was creating a virtual host on port 8081
and my Jetty (that comes along with gerrit) was also listening to the same port,my configuration remained almost the same but these are the additional steps :-
- Add a new port to your selinux (which has some basic ports defined initially) or you can disable it if security is not an issue.
- tell httpd to listen to this port(in my case i added
8082
) ,so add the linelisten <port-no>
in yourhttp conf
file Change the virtual host to your port number now your virtualhost is set on port 8082
<VirtualHost *:8082> ServerName localhost ProxyRequests Off ProxyVia Off ProxyPreserveHost On <Proxy *> Order deny,allow Allow from all </Proxy> <Location "/login/"> AuthType Basic AuthName "Gerrit Code Review" AuthBasicProvider file AuthUserFile /usr/local/apache/passwd/passwords Require valid-user </Location> ProxyPass / http://localhost:8081/ </VirtualHost>
change the canonical url to port
8082
(so that it redirects it to same port)- finally restart the apache and Gerrit (access your-host:8082).
Gerrit it expecting the authentication to be provided. It does not allow anonymous access when you use HTTP authentication.
For this to work you need to authenticate at the root and your Location block should look like this:
<Location "/">
AuthType Basic
AuthName "Gerrit Code Review"
AuthBasicProvider file
AuthUserFile /usr/local/apache/passwd/passwords
Require valid-user
</Location>
There are a few issues with your configuration:
- Apache and try to listen on the same port 8081, this is not possible
- You ProxyPass is not the best, it will create some small issues. These issues are:
- Unable to to create projects names with a slash in it like: main/sub
- When reviewing files the check mark will not appear next to the file to show it as reviewed, again this is related to the forward slash not being properly processed
- It is most common to use a subfolder and not the root, I guess that works better with the reverse proxy
This is my recommended configuration for you:
<VirtualHost *:80>
ServerName localhost
ProxyRequests Off
ProxyVia Off
ProxyPreserveHost On
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
<Location "/">
AuthType Basic
AuthName "Gerrit Code Review"
AuthBasicProvider file
AuthUserFile /usr/local/apache/passwd/passwords
Require valid-user
</Location>
AllowEncodedSlashes On
ProxyPass /r http://localhost:8081/r nocanon
</VirtualHost>
Ofcourse don't forget to amend the gerrit.config, the canonicalWebUrl is what you type in the address bar, not what apache uses to find gerrit.
[gerrit]
basePath = git
canonicalWebUrl = http://localhost:8082/r
To prevent the apache default page from showing add a index.php in your root folder that will redirect your browser to the sub path:
<?php
header('Location: http://localhost:8082/r/');
?>