Login-Only Repository - Revision history

Drn@ecs.soton.ac.uk: /* EPrints 3.4 and above */

2025-04-25T10:56:45Z

EPrints 3.4 and above

← Older revision		Revision as of 10:56, 25 April 2025
Line 16:		Line 16:
	This configuration will block all access to publication abstract/summary pages and their documents, browse view pages and any CGI script pages, such as search, export, etc. It will still allow users to access a login page, so if they do have an account they can login. In the configuration above, it is assumed that users will be authenticated locally. If institutions single sign-on (e.g. [[Shibboleth]] is being used then <code>"users/login"</code> can be removed from the exceptions and <code>login_required_url</code> should be updated appropriately. The <code>"handle_404"</code> exception is not essential but it saves a user having to login to find a page does not actually exist, which may be preferable or may be a security concern if they can see a page does not exist without logging in. You may want to add additional CGI scripts to exceptions such as <code>"reset_password"</code> and <code>"confirm"</code> to support password resets or <code>"register"</code> to allow visitors to register for user accounts.		This configuration will block all access to publication abstract/summary pages and their documents, browse view pages and any CGI script pages, such as search, export, etc. It will still allow users to access a login page, so if they do have an account they can login. In the configuration above, it is assumed that users will be authenticated locally. If institutions single sign-on (e.g. [[Shibboleth]] is being used then <code>"users/login"</code> can be removed from the exceptions and <code>login_required_url</code> should be updated appropriately. The <code>"handle_404"</code> exception is not essential but it saves a user having to login to find a page does not actually exist, which may be preferable or may be a security concern if they can see a page does not exist without logging in. You may want to add additional CGI scripts to exceptions such as <code>"reset_password"</code> and <code>"confirm"</code> to support password resets or <code>"register"</code> to allow visitors to register for user accounts.

	The above configuration does not prevent access to static pages like the home, about, policies, etc. If these need authentication as well, then similar configuration as describe fore EPrints 3.3 and older described below will need to be added to the HTTPS and also possibly HTTP Apache virtualhost configuration. From EPrints 3.4.7+ there will be additional configuration options for static pages. The following two lines of configuration will allow all but the homepage (and its resources, based on a vanilla installation) to be restricted behind a login:		The above configuration does not prevent access to static pages like the home, about, policies, etc. If these need authentication as well, then similar configuration as describe fore EPrints 3.3 and older described below will need to be added to the HTTPS and also possibly HTTP Apache virtualhost configuration.

			From '''EPrints 3.4.7+''' there will be additional configuration options for static pages. The following two lines of configuration will allow all but the homepage (and its resources, based on a vanilla installation) to be restricted behind a login:
	$c->{login_required_for_static}->{enable} = 1;		$c->{login_required_for_static}->{enable} = 1;
	$c->{login_required_for_static}->{exceptions} = [ "/", "/favicon.ico", "/images/.", "/style/images/." ];		$c->{login_required_for_static}->{exceptions} = [ "/", "/favicon.ico", "/images/.", "/style/images/." ];

Drn@ecs.soton.ac.uk: Added eprints config instructions for 3.4.x

2025-04-25T10:56:22Z

Added eprints config instructions for 3.4.x

← Older revision		Revision as of 10:56, 25 April 2025
Line 1:		Line 1:
	'''* * * MODIFIED APRIL 2025 TO UPDATE INSTRUCTIONS FOR APACHE 2.4.x * * *'''		'''* * * MODIFIED APRIL 2025 TO ADD INSTRUCTIONS ON USING EPRINTS CONFIGURATION UPDATE EXISTING INSTRUCTIONS FOR USER WITH APACHE 2.4.x * * *'''

	This instructions tell you how to configure your repository so that even ~~the static pages and~~ search and view pages require a valid username/password.		This instructions tell you how to configure your repository so that even search and view pages and potentially even static pages require a valid username/password.

	The <code>/images</code> and <code>/style</code> directories are deliberately unsecured, so that you can explicitly always view the files in them (you need the CSS + images to render the login page!)		The <code>/images</code> and <code>/style</code> directories are deliberately unsecured, so that you can explicitly always view the files in them (you need the CSS + images to render the login page!)
Line 7:		Line 7:
	This even secures things like the OAI interface, and registration. So you'll probably want to disable web-based registration in favour of importing users or creating them with an admin account.		This even secures things like the OAI interface, and registration. So you'll probably want to disable web-based registration in favour of importing users or creating them with an admin account.

	== HTTP-only Repository Archive ==		== EPrints 3.4 and above ==
			Set the following configurations settings in a configuration file under your archive's <code>cfg/cfg.d/</code> directory (e.g. <code>zz_login_required.pl</code>).
			$c->{login_required_for_cgi}->{enable} = 1;
			$c->{login_required_for_eprints}->{enable} = 1;
			$c->{login_required_for_views}->{enable} = 1;
			$c->{login_required_for_cgi}->{exceptions} = [ "users/login", "handle_404" ];
			$c->{login_required_url} = "/cgi/users/login";
			This configuration will block all access to publication abstract/summary pages and their documents, browse view pages and any CGI script pages, such as search, export, etc. It will still allow users to access a login page, so if they do have an account they can login. In the configuration above, it is assumed that users will be authenticated locally. If institutions single sign-on (e.g. [[Shibboleth]] is being used then <code>"users/login"</code> can be removed from the exceptions and <code>login_required_url</code> should be updated appropriately. The <code>"handle_404"</code> exception is not essential but it saves a user having to login to find a page does not actually exist, which may be preferable or may be a security concern if they can see a page does not exist without logging in. You may want to add additional CGI scripts to exceptions such as <code>"reset_password"</code> and <code>"confirm"</code> to support password resets or <code>"register"</code> to allow visitors to register for user accounts.

			The above configuration does not prevent access to static pages like the home, about, policies, etc. If these need authentication as well, then similar configuration as describe fore EPrints 3.3 and older described below will need to be added to the HTTPS and also possibly HTTP Apache virtualhost configuration. From EPrints 3.4.7+ there will be additional configuration options for static pages. The following two lines of configuration will allow all but the homepage (and its resources, based on a vanilla installation) to be restricted behind a login:
			$c->{login_required_for_static}->{enable} = 1;
			$c->{login_required_for_static}->{exceptions} = [ "/", "/favicon.ico", "/images/.", "/style/images/." ];

			== EPrints 3.3 and older ==

			=== HTTP-only Repository Archive ===

	1. In <code>[[archives/ARCHIVEID/cfg/lang/en/static/]]</code> rename <code>index.xpage</code> to <code>home.xpage</code>.		1. In <code>[[archives/ARCHIVEID/cfg/lang/en/static/]]</code> rename <code>index.xpage</code> to <code>home.xpage</code>.
Line 49:		Line 64:
	5. Restart Apache.		5. Restart Apache.

	== HTTPS-only or HTTP and HTTPS Repository Archive ==		=== HTTPS-only or HTTP and HTTPS Repository Archive ===
	''TO BE WRITTEN''		''TO BE WRITTEN''

	== Allowing a few things without a password... ==		=== Allowing a few things without a password... ===

	If you need to make any other directories available without a password, say the javascript directory, copy the directory directive for the images directory and tweak it:		If you need to make any other directories available without a password, say the javascript directory, copy the directory directive for the images directory and tweak it:

Drn@ecs.soton.ac.uk: /* HTTP-only Repository Archive */

2025-04-19T12:01:46Z

HTTP-only Repository Archive

← Older revision		Revision as of 12:01, 19 April 2025
Line 14:		Line 14:
	EPRINTS_PATH/bin/generate_static ARCHIVEID		EPRINTS_PATH/bin/generate_static ARCHIVEID

	3. Add the following to <code>[[archives/ARCHIVEID/cfg/]]apachevhost.conf</code>. (Be sure to substitute <code>EPRINTS_PATH</code>, <code>ARCHIVEID</code> and <code>HOSTNAME</code> as appropriate):		3. Add the following to <code>[[Apachevhost.conf\|archives/ARCHIVEID/cfg/apachevhost.conf]]</code>. (Be sure to substitute <code>EPRINTS_PATH</code>, <code>ARCHIVEID</code> and <code>HOSTNAME</code> as appropriate):

	<Location "">		<Location "">

Drn@ecs.soton.ac.uk: /* HTTP-only Repository Archive */

2025-04-19T12:00:13Z

HTTP-only Repository Archive

← Older revision		Revision as of 12:00, 19 April 2025
Line 14:		Line 14:
	EPRINTS_PATH/bin/generate_static ARCHIVEID		EPRINTS_PATH/bin/generate_static ARCHIVEID

	3. Add the following to [[archives/ARCHIVEID/cfg/]]apachevhost.conf (be sure to substitute <code>EPRINTS_PATH</code>, <code>ARCHIVEID</code> and <code>HOSTNAME</code> as appropriate):		3. Add the following to <code>[[archives/ARCHIVEID/cfg/]]apachevhost.conf</code>. (Be sure to substitute <code>EPRINTS_PATH</code>, <code>ARCHIVEID</code> and <code>HOSTNAME</code> as appropriate):

	<Location "">		<Location "">

Drn@ecs.soton.ac.uk: Improved instructions

2025-04-19T11:59:12Z

Improved instructions

← Older revision		Revision as of 11:59, 19 April 2025
Line 3:		Line 3:
	This instructions tell you how to configure your repository so that even the static pages and search and view pages require a valid username/password.		This instructions tell you how to configure your repository so that even the static pages and search and view pages require a valid username/password.

	The /images and /style directories are deliberately unsecured so that you can explicitly always view the files in them (you need the CSS + images to render the login page!)		The <code>/images</code> and <code>/style</code> directories are deliberately unsecured, so that you can explicitly always view the files in them (you need the CSS + images to render the login page!)

	This even secures things like the OAI interface, and registration. So you'll probably want to disable web-based registration in favour of importing users or creating them with an admin account.		This even secures things like the OAI interface, and registration. So you'll probably want to disable web-based registration in favour of importing users or creating them with an admin account.

	~~1. In [[archives/ARCHIVEID/cfg/lang/en/static/]] rename index.xpage to home.xpage~~		== HTTP-only Repository Archive ==

	2. ~~Run bin~~/~~generate_static~~ to ~~generate the~~ home.~~html file (and others)~~.		1. In <code>[[archives/ARCHIVEID/cfg/lang/en/static/]]</code> rename <code>index.xpage</code> to <code>home.xpage</code>.

	3. Add the following to [[archives/ARCHIVEID/cfg/]]apachevhost.conf (~~use your site URL in the last bit~~ and ~~replace ARCHIVEID~~):		2. Generate static pages to create the file <code>home.html</code> amongst others.
			EPRINTS_PATH/bin/generate_static ARCHIVEID

			3. Add the following to [[archives/ARCHIVEID/cfg/]]apachevhost.conf (be sure to substitute <code>EPRINTS_PATH</code>, <code>ARCHIVEID</code> and <code>HOSTNAME</code> as appropriate):

	<Location "">		<Location "">
Line 19:		Line 22:
	PerlAuthzHandler EPrints::Apache::Auth::authz		PerlAuthzHandler EPrints::Apache::Auth::authz
	require valid-user		require valid-user
	~~AuthName "Documents Area"~~
	</Location>		</Location>

	<Directory "~~/opt/eprints3~~/archives/ARCHIVEID/html/en/images">		<Directory "EPRINTS_PATH/archives/ARCHIVEID/html/en/images">
	require all granted		require all granted
	</Directory>		</Directory>

	<Directory "~~/opt/eprints3~~/archives/ARCHIVEID/html/en/style">		<Directory "EPRINTS_PATH/archives/ARCHIVEID/html/en/style">
	require all granted		require all granted
	</Directory>		</Directory>
Line 39:		Line 41:

	<LocationMatch "^/$">		<LocationMatch "^/$">
	Redirect / http://~~myarchive.ac.uk~~/cgi/users/login?target=/home.html		Redirect / http://HOSTNAME/cgi/users/login?target=/home.html
	</LocationMatch>		</LocationMatch>

	4. Restart Apache.		4. If you did not already have an [[archives/ARCHIVEID/cfg/]]apachevhost.conf then run the following to make sure it is included in your Apache configuration:
			EPRINTS_PATH/bin/generate_apacheconf --system --replace

			5. Restart Apache.

			== HTTPS-only or HTTP and HTTPS Repository Archive ==
			''TO BE WRITTEN''

	== Allowing a few things without a password... ==		== Allowing a few things without a password... ==

	If you need to make any other ~~Directories~~ available without a password, copy the directory directive for the images ~~dir~~ and tweak it.		If you need to make any other directories available without a password, say the javascript directory, copy the directory directive for the images directory and tweak it:
			<Directory "EPRINTS_PATH/archives/ARCHIVEID/html/en/javascript">
	~~If you need to make a single file public, for example the RSS feed, use the following:~~		require all granted
			</Directory>

	~~<Directory "~~/~~opt/eprints3/archives/ARCHIVEID/html/en/style">~~		If you need to make a single file public, for example the RSS/Atom feeds for latest publications, use the following:
	<Files "latest_tool">		<Files "latest_tool">
	require all granted		require all granted
	</Files>		</Files>
	~~</Directory>~~

	[[Category:Authentication]]		[[Category:Authentication]]

Drn@ecs.soton.ac.uk: Updated more config

2025-04-18T21:04:55Z

Updated more config

← Older revision		Revision as of 21:04, 18 April 2025
Line 52:		Line 52:
	<Directory "/opt/eprints3/archives/ARCHIVEID/html/en/style">		<Directory "/opt/eprints3/archives/ARCHIVEID/html/en/style">
	<Files "latest_tool">		<Files "latest_tool">
	~~order allow,deny~~		require all granted
	~~allow from~~ all
	~~satisfy any~~
	</Files>		</Files>
	</Directory>		</Directory>

	[[Category:Authentication]]		[[Category:Authentication]]

Drn@ecs.soton.ac.uk: Updayed instructions for Apache 2.4.x

2025-04-18T15:41:20Z

Updayed instructions for Apache 2.4.x

← Older revision		Revision as of 15:41, 18 April 2025
Line 1:		Line 1:
			'''* * * MODIFIED APRIL 2025 TO UPDATE INSTRUCTIONS FOR APACHE 2.4.x * * *'''

	This instructions tell you how to configure your repository so that even the static pages and search and view pages require a valid username/password.		This instructions tell you how to configure your repository so that even the static pages and search and view pages require a valid username/password.

Line 21:		Line 23:

	<Directory "/opt/eprints3/archives/ARCHIVEID/html/en/images">		<Directory "/opt/eprints3/archives/ARCHIVEID/html/en/images">
	~~order allow,deny~~		require all granted
	~~allow from~~ all
	~~satisfy any~~
	</Directory>		</Directory>

	<Directory "/opt/eprints3/archives/ARCHIVEID/html/en/style">		<Directory "/opt/eprints3/archives/ARCHIVEID/html/en/style">
	~~order allow,deny~~		require all granted
	~~allow from~~ all
	~~satisfy any~~
	</Directory>		</Directory>

	<Location "/cgi/reset_password">		<Location "/cgi/reset_password">
	~~order allow,deny~~		require all granted
	~~allow from~~ all
	~~satisfy any~~
	</Location>		</Location>

	<Location "/cgi/confirm">		<Location "/cgi/confirm">
	~~order allow,deny~~		require all granted
	~~allow from~~ all
	~~satisfy any~~
	</Location>		</Location>

Pm705 at 12:36, 20 March 2010

2010-03-20T12:36:39Z

← Older revision		Revision as of 12:36, 20 March 2010
Line 1:		Line 1:
	~~[[Category:Configuration]]~~
	~~[[Category:Howto]]~~
	This instructions tell you how to configure your repository so that even the static pages and search and view pages require a valid username/password.		This instructions tell you how to configure your repository so that even the static pages and search and view pages require a valid username/password.

Pm705 at 16:27, 8 February 2010

2010-02-08T16:27:44Z

← Older revision		Revision as of 16:27, 8 February 2010
Line 1:		Line 1:
			[[Category:Configuration]]
			[[Category:Howto]]
	This instructions tell you how to configure your repository so that even the static pages and search and view pages require a valid username/password.		This instructions tell you how to configure your repository so that even the static pages and search and view pages require a valid username/password.

Tdb01r at 11:58, 12 August 2009

2009-08-12T11:58:34Z

← Older revision		Revision as of 11:58, 12 August 2009
Line 63:		Line 63:
	</Files>		</Files>
	</Directory>		</Directory>

			[[Category:Authentication]]