Request Tracker Wiki - User contributions [en]

OpenIDConnectWithApache

2016-11-15T19:45:40Z

Anthnd:

== Softwares used in this guide ==
- RT 4.4.1
- Apache
- mod_auth_openidc (an Apache module that does all the OpenIDC work)

== Installing mod_auth_openidc ==
You can find it on Github [https://github.com/pingidentity/mod_auth_openidc/ here].

You can get the latest release [https://github.com/pingidentity/mod_auth_openidc/releases/latest here].

==== Ubuntu installation ====
<pre>
sudo apt-get update
sudo apt-get install libapache2-mod-auth-openidc
a2enmod auth_openidc
service apache2 restart
</pre>

==== CentOS 7 installation ====

Get the links for the latest centos .rpm releases of cjose and mod_auth_openidc in the link above. You may also need to find a centos .rpm for [https://pkgs.org/search/hiredis hiredis] - remember to expand the tab for the OS of your choice (CentOS 7 in this case).

Then simply,
<pre>
yum install https://github.com/pingidentity/mod_auth_openidc/releases/download/v2.1.0/cjose-0.4.1-1.el7.centos.x86_64.rpm
yum install http://dl.fedoraproject.org/pub/epel/7/x86_64/h/hiredis-0.12.1-1.el7.x86_64.rpm
yum install https://github.com/pingidentity/mod_auth_openidc/releases/download/v2.1.0/mod_auth_openidc-2.1.0-1.el7.centos.x86_64.rpm
</pre>

Now the mod_auth_openidc module should be installed.

== Signing up with an OpenID Connect Provider ==
To authenticate users, your server needs to be able to talk to someone they trust to provide user identities. In this guide, we will use Google as our OpenID Connect Provider — almost everyone has a Google account. To be able to use Google's authentication services, you will need to visit their [https://console.developers.google.com Developer console].

1. Find the Google+ API
2. If you click on it, there should be a little header saying you need to create a project. Click the Create Project button and proceed through the setup
3. You will be brought back to the Google+ API screen. On this page, press the Enable button near the top
4. In the left navigation pane, go to Credentials
5. Press the Create Credentials dropdown and select OAuth client ID
6. Configure the consent screen
7. Next, it should ask you to select an application type, pick Web application
8. Give your app a name and don't fill out the other blanks unless you know what they're going to be set up to already
9. There should be a popup telling you what your client ID and secret are — these will be needed later.

== Basic setup ==
=== Configuring mod_auth_openidc ===
Now you have to piece everything together. You can read the mod_auth_openidc Documentation or Wiki pages to set everything up if you'd like, but I'll be providing a step-by-step procedure as well.

So, you're going to have to put some Apache config code somewhere to get mod_auth_openidc to start actually doing things.

For my environment, this is the path to my .conf file:
<pre>/etc/httpd/conf.d/mod_auth_openidc.conf</pre>
If you don't have a conf.d folder or some other problem, you can put the Apache config code at the end of your default Apache config file. For my environment, this is the path:
<pre>/etc/httpd/conf/httpd.conf</pre>

Whatever you choose to do, here are the basic settings that you will need to integrate Google's Sign-In with Request Tracker:

''Note: In this setup, RT is found on localhost''
<pre>
# This is the link that Google uses to introduce itself and tell your server it's trustworthy
OIDCProviderMetadataURL https://accounts.google.com/.well-known/openid-configuration

# The credentials you were presented in the Google Dev Console
OIDCClientID a1b2c3d4e5f-j8f91083j0981j02909kd408tu.apps.googleusercontent.com
OIDCClientSecret as98jtg981jk02k0a

# Must match exactly with Authorized redirect URI in your Google Dev Console
OIDCRedirectURI http://localhost/oauth2callback

# Set this to whatever you want
OIDCCryptoPassphrase anypasswordhere

# This will set the environment variable REMOTE_USER to the user's email address instead of the default setting
OIDCRemoteUserClaim email
OIDCScope "openid email"

<Location />
AuthType openid-connect
Require valid-user
LogLevel debug # If you want debug messages
</Location>
</pre>

=== Configuring Request Tracker ===
In your RT_SiteConfig.pm file
<pre>
Set( $WebRemoteUserAuth, 1 );
Set( $WebFallbackToRTLogin, 1);
</pre>
At this point, clear your mason cache with
<pre>sudo rm -rf path_to_rt/var/mason_data/obj</pre>
and restart your webserver.

Now when you visit your Request Tracker, you should immediately be prompted to login with Google — or if you're already logged in to your Google account, your Google email address will be checked against RT's user database. That means if you want RT to grant access to <code>johndoe@example.com</code>, there must exist an RT user with the '''name''' <code>johndoe@example.com</code>. Otherwise, RT will display a page saying that you are unauthorized and since we set <code>WebFallbackToRTLogin</code> to 1, you will also have a link that will bring you to RT's default login page.

==== Logout fix ====
If you intend to use only the basic configuration, you will need to change how the default RT menu Logout button works. By default, it will log you out of RT, but it will '''not''' log you out of your Google account. Because of that, when you logout and get redirected to the login page, the Google email address you used to sign in will be authenticated against RT's database again and you'll be logged back in — making it basically impossible to logout.

There likely exists a certain configuration to fix this issue, but the advanced configuration provides a more flexible solution.

== Advanced configuration ==

Instead of Google Sign-In first and deferring to RT's login system on failure, the advanced configuration uses Google Sign-In side-by-side RT's default login system. This requires certain "hacky" adjustments to the HTML pages, additional configuration files, and some more lines in the OpenIDC Apache .conf file.

== Work in progress ==
More will be added and elaborated when time permits.

OpenIDConnectWithApache

2016-11-07T20:38:48Z

Anthnd:

== Softwares used in this guide ==
- RT 4.4.1
- Apache
- mod_auth_openidc (an Apache module that does all the OpenIDC work)
- CentOS 7

== Installing mod_auth_openidc ==
You can find it on Github [https://github.com/pingidentity/mod_auth_openidc/ here].

You can get the latest release [https://github.com/pingidentity/mod_auth_openidc/releases/latest here].

==== Ubuntu installation ====
<pre>
sudo apt-get update
sudo apt-get install libapache2-mod-auth-openidc
a2enmod auth_openidc
service apache2 restart
</pre>

==== CentOS 7 installation ====

Get the links for the latest centos .rpm releases of cjose and mod_auth_openidc in the link above. You may also need to find a centos .rpm for [https://pkgs.org/search/hiredis hiredis] - remember to expand the tab for the OS of your choice (CentOS 7 in this case).

Then simply,
<pre>
yum install https://github.com/pingidentity/mod_auth_openidc/releases/download/v2.1.0/cjose-0.4.1-1.el7.centos.x86_64.rpm
yum install http://dl.fedoraproject.org/pub/epel/7/x86_64/h/hiredis-0.12.1-1.el7.x86_64.rpm
yum install https://github.com/pingidentity/mod_auth_openidc/releases/download/v2.1.0/mod_auth_openidc-2.1.0-1.el7.centos.x86_64.rpm
</pre>

Now the mod_auth_openidc module should be installed.

== Signing up with an OpenID Connect Provider ==
To authenticate users, your server needs to be able to talk to someone they trust to provide user identities. In this guide, we will use Google as our OpenID Connect Provider — almost everyone has a Google account. To be able to use Google's authentication services, you will need to visit their [https://console.developers.google.com Developer console].

1. Find the Google+ API
2. If you click on it, there should be a little header saying you need to create a project. Click the Create Project button and proceed through the setup
3. You will be brought back to the Google+ API screen. On this page, press the Enable button near the top
4. In the left navigation pane, go to Credentials
5. Press the Create Credentials dropdown and select OAuth client ID
6. Configure the consent screen
7. Next, it should ask you to select an application type, pick Web application
8. Give your app a name and don't fill out the other blanks unless you know what they're going to be set up to already
9. There should be a popup telling you what your client ID and secret are — these will be needed later.

== Basic setup ==
=== Configuring mod_auth_openidc ===
Now you have to piece everything together. You can read the mod_auth_openidc Documentation or Wiki pages to set everything up if you'd like, but I'll be providing a step-by-step procedure as well.

So, you're going to have to put some Apache config code somewhere to get mod_auth_openidc to start actually doing things.

For my environment, this is the path to my .conf file:
<pre>/etc/httpd/conf.d/mod_auth_openidc.conf</pre>
If you don't have a conf.d folder or some other problem, you can put the Apache config code at the end of your default Apache config file. For my environment, this is the path:
<pre>/etc/httpd/conf/httpd.conf</pre>

Whatever you choose to do, here are the basic settings that you will need to integrate Google's Sign-In with Request Tracker:

''Note: In this setup, RT is found on localhost''
<pre>
# This is the link that Google uses to introduce itself and tell your server it's trustworthy
OIDCProviderMetadataURL https://accounts.google.com/.well-known/openid-configuration

# The credentials you were presented in the Google Dev Console
OIDCClientID a1b2c3d4e5f-j8f91083j0981j02909kd408tu.apps.googleusercontent.com
OIDCClientSecret as98jtg981jk02k0a

# Must match exactly with Authorized redirect URI in your Google Dev Console
OIDCRedirectURI http://localhost/oauth2callback

# Set this to whatever you want
OIDCCryptoPassphrase anypasswordhere

# This will set the environment variable REMOTE_USER to the user's email address instead of the default setting
OIDCRemoteUserClaim email
OIDCScope "openid email"

<Location />
AuthType openid-connect
Require valid-user
LogLevel debug # If you want debug messages
</Location>
</pre>

=== Configuring Request Tracker ===
In your RT_SiteConfig.pm file
<pre>
Set( $WebRemoteUserAuth, 1 );
Set( $WebFallbackToRTLogin, 1);
</pre>
At this point, clear your mason cache with
<pre>sudo rm -rf path_to_rt/var/mason_data/obj</pre>
and restart your webserver.

Now when you visit your Request Tracker, you should immediately be prompted to login with Google — or if you're already logged in to your Google account, your Google email address will be checked against RT's user database. That means if you want RT to grant access to <code>johndoe@example.com</code>, there must exist an RT user with the '''name''' <code>johndoe@example.com</code>. Otherwise, RT will display a page saying that you are unauthorized and since we set <code>WebFallbackToRTLogin</code> to 1, you will also have a link that will bring you to RT's default login page.

==== Logout fix ====
If you intend to use only the basic configuration, you will need to change how the default RT menu Logout button works. By default, it will log you out of RT, but it will '''not''' log you out of your Google account. Because of that, when you logout and get redirected to the login page, the Google email address you used to sign in will be authenticated against RT's database again and you'll be logged back in — making it basically impossible to logout.

== Advanced configuration ==

=== Optional Google Sign-In ===
If you'd like to use Google Sign-In side-by-side RT's default login system — instead of Google Sign-In first and deferring to RT's login system on failure — you will need to add some configuration options to your .conf file and add a Google Sign-In link to RT's login page.

== Work in progress ==
More will be added and elaborated when time permits.

OpenIDConnectWithApache

2016-11-07T20:38:23Z

Anthnd:

OpenIDConnectWithApache

2016-11-07T16:37:53Z

Anthnd: /* Configuring Request Tracker */

== Softwares used in this guide ==
- RT 4.4.1
- Apache
- mod_auth_openidc (an Apache module that does all the OpenIDC work)
- CentOS 7

== Install and enable mod_auth_openidc ==
You can find it on Github [https://github.com/pingidentity/mod_auth_openidc/ here].

You can get the latest release [https://github.com/pingidentity/mod_auth_openidc/releases/latest here].

For Ubuntu:
<pre>
sudo apt-get update
sudo apt-get install libapache2-mod-auth-openidc
a2enmod auth_openidc
service apache2 restart
</pre>

For CentOS 7:

Get the links for the latest centos .rpm releases of cjose and mod_auth_openidc in the link above. You may also need to find a centos .rpm for [https://pkgs.org/search/hiredis hiredis] - remember to expand the tab for the OS of your choice (CentOS 7 in this case).

Then simply,
<pre>
yum install https://github.com/pingidentity/mod_auth_openidc/releases/download/v2.1.0/cjose-0.4.1-1.el7.centos.x86_64.rpm
yum install http://dl.fedoraproject.org/pub/epel/7/x86_64/h/hiredis-0.12.1-1.el7.x86_64.rpm
yum install https://github.com/pingidentity/mod_auth_openidc/releases/download/v2.1.0/mod_auth_openidc-2.1.0-1.el7.centos.x86_64.rpm
</pre>

Now the mod_auth_openidc module should be installed.

== Signing up with an OpenID Connect Provider ==
To authenticate users, your server needs to be able to talk to someone they trust to provide user identities. In this guide, we will use Google as our OpenID Connect Provider — almost everyone has a Google account. To be able to use Google's authentication services, you will need to visit their [https://console.developers.google.com Developer console].

1. Find the Google+ API
2. If you click on it, there should be a little header saying you need to create a project. Click the Create Project button and proceed through the setup
3. You will be brought back to the Google+ API screen. On this page, press the Enable button near the top
4. In the left navigation pane, go to Credentials
5. Press the Create Credentials dropdown and select OAuth client ID
6. Configure the consent screen
7. Next, it should ask you to select an application type, pick Web application
8. Give your app a name and don't fill out the other blanks unless you know what they're going to be set up to already
9. There should be a popup telling you what your client ID and secret are — these will be needed later.

== Configuring mod_auth_openidc ==
Now you have to piece everything together. You can read the mod_auth_openidc Documentation or Wiki pages to set everything up if you'd like, but I'll be providing a step-by-step procedure as well.

So, you're going to have to put some Apache config code somewhere to get mod_auth_openidc to start actually doing things.

For my environment, this is the path to my .conf file:
<pre>/etc/httpd/conf.d/mod_auth_openidc.conf</pre>
If you don't have a conf.d folder or some other problem, you can put the Apache config code at the end of your default Apache config file. For my environment, this is the path:
<pre>/etc/httpd/conf/httpd.conf</pre>

Whatever you choose to do, here are the basic settings that you will need to integrate Google's Sign in with Request Tracker:

''Note: In this setup, RT is found on localhost''
<pre>
# This is the link that Google uses to introduce itself and tell your server it's trustworthy
OIDCProviderMetadataURL https://accounts.google.com/.well-known/openid-configuration

# The credentials you were presented in the Google Dev Console
OIDCClientID a1b2c3d4e5f-j8f91083j0981j02909kd408tu.apps.googleusercontent.com
OIDCClientSecret as98jtg981jk02k0a

# Must match exactly with Authorized redirect URI in your Google Dev Console
OIDCRedirectURI http://localhost/oauth2callback

# Set this to whatever you want
OIDCCryptoPassphrase anypasswordhere

# This will set the environment variable REMOTE_USER to the user's email address instead of the default setting
OIDCRemoteUserClaim email
OIDCScope "openid email"

<Location />
AuthType openid-connect
Require valid-user
LogLevel debug # If you want debug messages
</Location>
</pre>

== Configuring Request Tracker ==
In your RT_SiteConfig.pm file
<pre>
Set( $WebRemoteUserAuth, 1 );
Set( $WebFallbackToRTLogin, 1);
</pre>

== Work in progress ==
I'm going to add more after the weekend.

CustomActionQchange

2016-11-04T20:03:17Z

Anthnd: /* Code */

Below is a custom action module for adding RT::Action:Qchange via crontool that can be called for via a query similar to this "--action RT::Action::QChange --action-arg YOURNEWQUEUE --template 'blank'"

Example <code> rt-crontool --transaction last --search RT::Search::FromSQL --search-arg "Queue = 'SLA’ AND (Status='new' OR Status='open')" --condition RT::Condition::Overdue --action RT::Action::QChange --action-arg QUEUE --template 'SLA-escalation'</code>

Create the file in a place where RT can call it (notice not to put it at a place that will be overwritten at an RT upgrade, ex /opt/rt4/lib/RT/Action/Qchange.pm

This script was created by Andy Smith.

Running on RT version 4.4.1

== Code ==
<pre>
# BEGIN BPS TAGGED BLOCK {{{
#
# COPYRIGHT:
#
# This software is Copyright (c) 1996-2015 Best Practical Solutions, LLC
# <sales@bestpractical.com>
#
# (Except where explicitly superseded by other copyright notices)
#
#
# LICENSE:
#
# This work is made available to you under the terms of Version 2 of
# the GNU General Public License. A copy of that license should have
# been provided with this software, but in any event can be snarfed
# from www.gnu.org.
#
# This work is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
# 02110-1301 or visit their web page on the internet at
# <nowiki>http://www.gnu.org/licenses/old-licenses/gpl-2.0.html</nowiki>.
#
#
# CONTRIBUTION SUBMISSION POLICY:
#
# (The following paragraph is not intended to limit the rights granted
# to you to modify and distribute this software under the terms of
# the GNU General Public License and is only of importance to you if
# you choose to contribute your changes and enhancements to the
# community by submitting them to Best Practical Solutions, LLC.)
#
# By intentionally submitting any modifications, corrections or
# derivatives to this work, or any other work intended for use with
# Request Tracker, to Best Practical Solutions, LLC, you confirm that
# you are the copyright holder for those contributions and you grant
# Best Practical Solutions, LLC a nonexclusive, worldwide, irrevocable,
# royalty-free, perpetual, license to use, copy, create derivative
# works based on those contributions, and sublicense and distribute
# those contributions and any derivatives thereof.
#
# END BPS TAGGED BLOCK }}}

package RT::Action::QChange;

use strict;
use warnings;

use base qw(RT::Action::Notify);

use Email::Address;

=head1 Notify Owner or AdminCc

If the owner of this ticket is Nobody, notify the AdminCcs. Otherwise, only notify the Owner.

=cut

sub Prepare {
my $self = shift;
return 1;
}

my $self;

sub Commit {
my $self = shift;
my $argument = $self->Argument;
unless ( $argument ) {
RT::Logger->error("Argument is mandatory for Test action");
return 0;
}

my ($status, $msg) = $self->TicketObj->SetQueue("$argument");
if ( not $status ) {
RT::Logger->error("Could not reassign queue: $msg");
return 0;
}

RT::Base->_ImportOverlays();

return 1;
}

1;
</pre>

OpenIDConnectWithApache

2016-11-04T19:38:22Z

Anthnd: /* Configuring mod_auth_openidc */

== Softwares used in this guide ==
- RT 4.4.1
- Apache
- mod_auth_openidc (an Apache module that does all the OpenIDC work)
- CentOS 7

== Install and enable mod_auth_openidc ==
You can find it on Github [https://github.com/pingidentity/mod_auth_openidc/ here].

You can get the latest release [https://github.com/pingidentity/mod_auth_openidc/releases/latest here].

For Ubuntu:
<pre>
sudo apt-get update
sudo apt-get install libapache2-mod-auth-openidc
a2enmod auth_openidc
service apache2 restart
</pre>

For CentOS 7:

Get the links for the latest centos .rpm releases of cjose and mod_auth_openidc in the link above. You may also need to find a centos .rpm for [https://pkgs.org/search/hiredis hiredis] - remember to expand the tab for the OS of your choice (CentOS 7 in this case).

Then simply,
<pre>
yum install https://github.com/pingidentity/mod_auth_openidc/releases/download/v2.1.0/cjose-0.4.1-1.el7.centos.x86_64.rpm
yum install http://dl.fedoraproject.org/pub/epel/7/x86_64/h/hiredis-0.12.1-1.el7.x86_64.rpm
yum install https://github.com/pingidentity/mod_auth_openidc/releases/download/v2.1.0/mod_auth_openidc-2.1.0-1.el7.centos.x86_64.rpm
</pre>

Now the mod_auth_openidc module should be installed.

== Signing up with an OpenID Connect Provider ==
To authenticate users, your server needs to be able to talk to someone they trust to provide user identities. In this guide, we will use Google as our OpenID Connect Provider — almost everyone has a Google account. To be able to use Google's authentication services, you will need to visit their [https://console.developers.google.com Developer console].

1. Find the Google+ API
2. If you click on it, there should be a little header saying you need to create a project. Click the Create Project button and proceed through the setup
3. You will be brought back to the Google+ API screen. On this page, press the Enable button near the top
4. In the left navigation pane, go to Credentials
5. Press the Create Credentials dropdown and select OAuth client ID
6. Configure the consent screen
7. Next, it should ask you to select an application type, pick Web application
8. Give your app a name and don't fill out the other blanks unless you know what they're going to be set up to already
9. There should be a popup telling you what your client ID and secret are — these will be needed later.

== Configuring mod_auth_openidc ==
Now you have to piece everything together. You can read the mod_auth_openidc Documentation or Wiki pages to set everything up if you'd like, but I'll be providing a step-by-step procedure as well.

So, you're going to have to put some Apache config code somewhere to get mod_auth_openidc to start actually doing things.

For my environment, this is the path to my .conf file:
<pre>/etc/httpd/conf.d/mod_auth_openidc.conf</pre>
If you don't have a conf.d folder or some other problem, you can put the Apache config code at the end of your default Apache config file. For my environment, this is the path:
<pre>/etc/httpd/conf/httpd.conf</pre>

Whatever you choose to do, here are the basic settings that you will need to integrate Google's Sign in with Request Tracker:

''Note: In this setup, RT is found on localhost''
<pre>
# This is the link that Google uses to introduce itself and tell your server it's trustworthy
OIDCProviderMetadataURL https://accounts.google.com/.well-known/openid-configuration

# The credentials you were presented in the Google Dev Console
OIDCClientID a1b2c3d4e5f-j8f91083j0981j02909kd408tu.apps.googleusercontent.com
OIDCClientSecret as98jtg981jk02k0a

# Must match exactly with Authorized redirect URI in your Google Dev Console
OIDCRedirectURI http://localhost/oauth2callback

# Set this to whatever you want
OIDCCryptoPassphrase anypasswordhere

# This will set the environment variable REMOTE_USER to the user's email address instead of the default setting
OIDCRemoteUserClaim email
OIDCScope "openid email"

<Location />
AuthType openid-connect
Require valid-user
LogLevel debug # If you want debug messages
</Location>
</pre>

== Configuring Request Tracker ==
In your RT_SiteConfig.pm file
<pre>Set( $WebRemoteUserAuth, 1 );</pre>

== Work in progress ==
I'm going to add more after the weekend.

OpenIDConnectWithApache

2016-11-04T19:34:33Z

Anthnd: A guide on implementing OpenID Connect into Request Tracker

== Softwares used in this guide ==
- RT 4.4.1
- Apache
- mod_auth_openidc (an Apache module that does all the OpenIDC work)
- CentOS 7

== Install and enable mod_auth_openidc ==
You can find it on Github [https://github.com/pingidentity/mod_auth_openidc/ here].

You can get the latest release [https://github.com/pingidentity/mod_auth_openidc/releases/latest here].

For Ubuntu:
<pre>
sudo apt-get update
sudo apt-get install libapache2-mod-auth-openidc
a2enmod auth_openidc
service apache2 restart
</pre>

For CentOS 7:

Get the links for the latest centos .rpm releases of cjose and mod_auth_openidc in the link above. You may also need to find a centos .rpm for [https://pkgs.org/search/hiredis hiredis] - remember to expand the tab for the OS of your choice (CentOS 7 in this case).

Then simply,
<pre>
yum install https://github.com/pingidentity/mod_auth_openidc/releases/download/v2.1.0/cjose-0.4.1-1.el7.centos.x86_64.rpm
yum install http://dl.fedoraproject.org/pub/epel/7/x86_64/h/hiredis-0.12.1-1.el7.x86_64.rpm
yum install https://github.com/pingidentity/mod_auth_openidc/releases/download/v2.1.0/mod_auth_openidc-2.1.0-1.el7.centos.x86_64.rpm
</pre>

Now the mod_auth_openidc module should be installed.

== Signing up with an OpenID Connect Provider ==
To authenticate users, your server needs to be able to talk to someone they trust to provide user identities. In this guide, we will use Google as our OpenID Connect Provider — almost everyone has a Google account. To be able to use Google's authentication services, you will need to visit their [https://console.developers.google.com Developer console].

1. Find the Google+ API
2. If you click on it, there should be a little header saying you need to create a project. Click the Create Project button and proceed through the setup
3. You will be brought back to the Google+ API screen. On this page, press the Enable button near the top
4. In the left navigation pane, go to Credentials
5. Press the Create Credentials dropdown and select OAuth client ID
6. Configure the consent screen
7. Next, it should ask you to select an application type, pick Web application
8. Give your app a name and don't fill out the other blanks unless you know what they're going to be set up to already
9. There should be a popup telling you what your client ID and secret are — these will be needed later.

== Configuring mod_auth_openidc ==
Now you have to piece everything together. You can read the mod_auth_openidc Documentation or Wiki pages to set everything up if you'd like, but I'll be providing a step-by-step procedure as well.

So, you're going to have to put some Apache config code somewhere to get mod_auth_openidc to start actually doing things.

For my environment, this is the path to my .conf file:
<pre>/etc/httpd/conf.d/mod_auth_openidc.conf</pre>
If you don't have a conf.d folder or some other problem, you can put the Apache config code at the end of your default Apache config file. For my environment, this is the path:
<pre>/etc/httpd/conf/httpd.conf</pre>

Whatever you choose to do, here are the basic settings that you will need to integrate Google's Sign in with Request Tracker:
<pre>
# This is the link that Google uses to introduce itself and tell your server it's trustworthy
OIDCProviderMetadataURL https://accounts.google.com/.well-known/openid-configuration

# The credentials you were presented in the Google Dev Console
OIDCClientID a1b2c3d4e5f-j8f91083j0981j02909kd408tu.apps.googleusercontent.com
OIDCClientSecret as98jtg981jk02k0a

# Must match exactly with Authorized redirect URI in your Google Dev Console
OIDCRedirectURI http://localhost/oauth2callback

# Set this to whatever you want
OIDCCryptoPassphrase anypasswordhere

# This will set the environment variable REMOTE_USER to the user's email address instead of the default setting
OIDCRemoteUserClaim email
OIDCScope "openid email"

<Location />
AuthType openid-connect
Require valid-user
LogLevel debug # If you want debug messages
</Location>
</pre>

== Configuring Request Tracker ==
In your RT_SiteConfig.pm file
<pre>Set( $WebRemoteUserAuth, 1 );</pre>

== Work in progress ==
I'm going to add more after the weekend.