Fixes with auth..

global/overlay/etc/puppet/modules/soc/manifests/intelmq.pp

@@ -5,6 +5,7 @@ class soc::intelmq(
   String              $servername = $facts['networking']['fqdn'],
   Boolean             $use_snakeoil = false,
   String              $apache_group = 'sunet-cert',
+  Boolean             $use_shib   = false,
 ) {
   include sunet::systemd_reload
 

global/overlay/etc/puppet/modules/soc/manifests/sso.pp

@@ -94,7 +94,18 @@ class soc::sso(
       ensure => installed,
     }
 
+    exec { 'Make sure mod_shib is loaded':
+      command => 'a2enmod shib',
+      creates => '/etc/apache2/mods-enabled/shib.load',
+    }
+
+    exec { 'Make sure authz_groupfile is loaded':
+      command => 'a2enmod authz_groupfile',
+      creates => '/etc/apache2/mods-enabled/authz_groupfile.load',
+    }
+
     $shibbase = '/etc/shibboleth'
+
   } elsif $ssotype == 'docker' {
     $shibbase = '/opt/sso/shibboleth'
 

global/overlay/etc/puppet/modules/soc/templates/intelmq/intelmq-vhost.conf.erb

@@ -33,17 +33,20 @@
         SSLSessionTickets       off
         Header                  always set Strict-Transport-Security "max-age=63072000"
 
-        <IfModule mod_shib.c>
+        <Location />
-          <Location />
+        <% if $use_shib -%>
-            AuthType shibboleth
+          AuthType shibboleth
-            ShibRequestSetting requireSession On
+          ShibRequestSetting requireSession On
-            ShibUseHeaders On
+          ShibUseHeaders On
+
+          AuthGroupFile /etc/apache2/groups.txt
+          Require group <%= @apache_group %>
+        <% else -%>
+          Require all granted
+        <% end -%>
+        </Location>
 
-            AuthGroupFile /etc/apache2/groups.txt
-            Require group <%= @apache_group %>
-          </Location>
         </IfModule>
-
         <IfModule mod_proxy.c>
                 ProxyRequests   Off
                 <Location "/api">
@@ -69,19 +72,16 @@
 
         Alias /intelmq-manager /opt/intelmq/www/intelmq-manager
         <Directory /opt/intelmq/www/intelmq-manager> 
-        <IfModule mod_shib.c>
+        <% if $use_shib -%>
-          <Location />
+          AuthType shibboleth
-            AuthType shibboleth
+          ShibRequestSetting requireSession On
-            ShibRequestSetting requireSession On
+          ShibUseHeaders On
-            ShibUseHeaders On
 
-            AuthGroupFile /etc/apache2/groups.txt
+          AuthGroupFile /etc/apache2/groups.txt
-            Require group <%= @apache_group %>
+          Require group <%= @apache_group %>
-          </Location>
+        <% else -%>
-        </IfModule>
-        <IfModule !mod_shib.c>
           Require all granted
-        </IfModule>
+        <% end -%>
 
             <IfModule mod_headers.c>
                     Header set Content-Security-Policy "script-src 'self'"