I have been struggling with setting up my galaxy system to allow it to use the LDAP authentication for users that come in through the frontend, while not wanting to have to use authentication when user want to access through the API....I found some solution and I thought I'd share it with the world so that people may learn from this and maybe also tell me if I am doing something wrong, or worse, insecure!

I setup two web servers in the universe file at localhost:8080 and localhost:8081.
For the one at 8080 i require authentication, for the one at 8081 I do not in the settings for apache proxy server shown below....
The I setup a ReWriteRule for anything addressed to /api/ and route that to the one at 8081, that does not require authentication, while everything else goes through 8080 which does...

It seems to work nicely, although I have a nagging feeling this leaves open some backdoors somewhere, but please tell me if I do...

<Directory /mnt/ngs/analysis/svcgalaxy/galaxy-dist/static>
  Options FollowSymLinks
  Order Allow,Deny
  Allow from all

<Proxy http://localhost:8080>
        AuthType Basic
        AuthName "GALAXY@GHI. Please log in with your Windows account"
        AuthBasicProvider ldap
        AuthLDAPURL "ldap://__YOUR_LDAP_SERVER/ou=Users - Employees,dc=genomichealth,dc=com?sAMAccountName?sub?(objectClass=*)"
        AuthzLDAPAuthoritative off
        AuthLDAPBindDN __USERNAME__
        AuthLDAPBindPassword __PASSWORD
        Require valid-user

#Extended the timeout since some GALAXY actions can take a long time
TimeOut 60000
RewriteEngine on
ReWriteRule ^(/api/.*) http://localhost:8081$1 [L]
RewriteRule ^/static/style/(.*) /mnt/ngs/analysis/svcgalaxy/galaxy-dist/static/june_2007_style/blue/$1 [L]
RewriteRule ^/static/scripts/(.*) /mnt/ngs/analysis/svcgalaxy/galaxy-dist/static/scripts/packed/$1 [L]
RewriteRule ^/static/(.*) /mnt/ngs/analysis/svcgalaxy/galaxy-dist/static/$1 [L]
RewriteRule ^/favicon.ico /mnt/ngs/analysis/svcgalaxy/galaxy-dist/static/favicon.ico [L]
RewriteRule ^/robots.txt /mnt/ngs/analysis/svcgalaxy/galaxy-dist/static/robots.txt [L]
RewriteRule ^/admin/jobs(.*) http://localhost:8079/admin/jobs$1 [P]
RewriteRule ^(.*) http://localhost:8080$1 [P]

Please keep all replies on the list by using "reply all"
in your mail client.  To manage your subscriptions to this
and other Galaxy lists, please use the interface at:


Reply via email to