XHTML in Mantis 1.3 development trunk

I just wanted to upgrade my current installation of Mantis to the current 1.3.0 trunk. But this wasn’t as easy as in previous development releases of mantis. Obviously the content-encoding switched to more strict xhtml+xml. In previous versions the HTTP content-type was still text/html, which worked just fine. Using Firefox is no problem, but Internet Explorer doesn’t like the content-type application/xhtml+xml and always tries to download the page instead of displaying the page.

To resolve this problem I added a test prior to sending the content type, to which content type is actually supported by the client. The content-type is set in thehttp_api.php, so the modified function http_content_headers() looks like this:

/**
 * Set content-type headers.
 */
function http_content_headers() {
    if ( !headers_sent() ) {
        if (stristr($_SERVER[HTTP_ACCEPT], "application/xhtml+xml")) {
            header( 'Content-Type: application/xhtml+xml; charset=UTF-8' );
        } else {
            header( 'Content-Type: text/html; charset=UTF-8' );
        }
        // Disallow Internet Explorer from attempting to second guess the Content-Type
        // header as per http://blogs.msdn.com/ie/archive/2008/07/02/ie8-security-part-v-comprehensive-pro
        header( 'X-Content-Type-Options: nosniff' );
    }
}

On another quick side-note: I had some custom HTML to include my own header to mantis, which caused an XML parse error – this was because I didn’t close the img tag for an embedded image.

Integrated Windows Authentication in Mantis (Updated to Mantis 1.2.1)

In a previous post I described the necessary steps, to enable integrated windows authentication when working with Mantis on a linux box. These modifications where targeted against the 1.1.0a2 release of Mantis. In the meantime a lot of development has been done on Mantis, so that my original post isn’t quite accurate anymore. This post will enable you to use integrated security with the current 1.2.1 release of Mantis.

While the basic setup is somewhat unchanged, only the file core/authentication_api.php needs to be changed. The login.php doesn’t need to be changed anymore, since the functionallity moved to the authentication_api.php.

I added an updated patchfile to apply the necessary changes to the file.

Updating Mantis Categories

I just stumbled across this error: I have a project in Mantis with a project-manager assigned. While this manager can add new categories alright, whenever he tries to update an existing category he gets an ACCESS_DENIED error (see issue 9728).

I figured, that in the manage_proj_cat_edit_page.php the project_id field is missing, so the:

access_ensure_project_level( config_get( 'manage_project_threshold' ), $f_project_id );

always tests for the permission on ALL_PROJECTS (because of:

$f_project_id = gpc_get_int( 'project_id', ALL_PROJECTS );

However, by adding:

<input type="hidden" name="project_id" value="<?php echo $f_project_id ?>" />

to the manage_proj_cat_edit_page.php the problem could be resolved 🙂

Integrated Windows Authentication in Mantis

Update: a new post is availbe, with an updates patchfile for Mantis 1.2.1!

The more tools are being used in an enterprise environment, the more logins and passwords need to be memorized. A first step is to use LDAP based authenticatin. In MS Windows based networks this offers to ability to manage all users in the Active Directory, so the users only have to use on username/password. But the user will still have to enter this into a login-screen in order to access the application.

Using SSO the user is always identified by already existind credentials. In the best case, the logon credetials of the operating system are being used. Since Active Directory is based on the Kereberos authentication protocoll, this offers the ability to use kerberos based authentication in other applications, and thus re-using the existing windows authentication.

The Internet Explorer is capable of using the windws logon-credentials to authenticate users on certain webservers. But with a slight modification this can also be used on an Apache running on a linux box. How to setup Apache to allow kerberos authentication is explained in another article. Once Apache is setup correct, Mantis needs to be slightly modified to use the information supplied by the kerberos authentication. My modifications are all based on the current development-release of mantis 1.1.0a2.

Modifing Mantis

Basically three files need to be modified: core\authentication_api.php, login.php and config.inc.php.

  1. In config.inc.php I switch from LDAP authentication to HTTP_AUTH, since I wand the webserver to handle the authentication. Also I introduce a new configuration setting sso_user_regex. This is needed, because I need to extract the username from the user identified by the webserver. So I use this handy little regex to do this for me:
             $g_login_method    = HTTP_AUTH;
             $g_sso_user_regex  = '/^(.*)@ACME\.COM$/i';

    This regex would extract the username portion for users of the domain “ACME.COM”.

  2. Next would be to modify login.php to extract the username from the authenticated user, if the user was detected using “Negotiation” (which is the case if IWA was used). So I apply my previously defined regex to the “Remote-User” variable of the server to get my mantis username. So we have to insert some code at line 32:
          if ( isset($_SERVER['REMOTE_USER'])) { #  $_SERVER['AUTH_TYPE'] == 'Negotiate' )
            preg_match(config_get('sso_user_regex'), $_SERVER['REMOTE_USER'], $user_match);
            $f_username = $user_match[1];
          }
  3. The last step is to add an additional condition to the authentication_api.php to prevent from trying to authenticate the user with the mantis user database using the username and password. This would only work, if the username and password would be supplied by the webserver, but using IWA we only have the username (the password is not transmitted in IWA, only the logon-challange). So this would only work if Basic Authentication would be used instead of kerberos authentication. So validating username and password with the mantis user database is restricted for HTTP_AUTH by modifing line 121:
          if ( HTTP_AUTH != $t_login_method && !auth_does_password_match( $t_user_id, $p_password ) ) {
          # if ( !auth_does_password_match( $t_user_id, $p_password ) ) {

So this should be all, to get Integrated Windows Authentication running. Below is a patchfile to apply the changes of authentication_api.php and login.php.

Attached you’ll find a patch-file to modified the corresponding files. To apply the patch you simple need to execute (assuming you have patch, and you’re executing it within your install-directory of Mantis):

   patch < iwa_sso.patch -p0

Download: iwa_sso patch