Some considerations:

• The Authwebserver plugin is rarely used so the issue is considered to be low priority
• We cannot just move the refactored controllers to /admin because the old and new way to call controllers would collide.
• It makes sense to have path-wise the controllers in a directory to have a clear separation between survey-taking and administration

How to fix this:

• Establish a differently named subdirectory in /controllers , for example /administration
• Move the refactored controllers there, correct paths/views etc.
• Keep refactoring old controllers

This would allow webauth to be used if applied on /admin and /administration directory.

This should happen in the dev branch because moving the controllers is quite extensive

Hello,
Many thanks for your response. Is there any another options?
Self user registration?
We are Univercity College and we have obout 15K potentials users. It was easy to login with SSO with college account.
Any other sugestions?

thanks for any help

@nohcho82

I think the Authwebserver plugin is different from SSO (LimeSAML plugin). If you want to use SSO, this will work.

Authwebserver plugin could be extended to check for "Administration" in the controller URL, perhaps?

@galads
We used Authwebserver already 10 years with Shibboleth login. Can I use another alternative? Where can I download LimeSAML plugin? How to install it?
thanks

We are also interested in troubleshooting this plugin. Because without it, we cannot switch to LS5 in an organization with almost 14,000 potential users.

We would also like to know the details of the problem, because we have a dedicated plugin based on the same solution, but for the frontend in terms of identifying survey participants (automatic token assignment) in the intranet environment.

The details of the problem are in the issue description above.

Has this issue been resolved after the patches have been deployed: 17654 and 18169 ?

I tried to simulate the problem (v5.4.12) when I go to the page /index.php/surveyAdministration/newSurvey, if I am not authenticated it returns 401 because it meets the condition
application\core\plugins\Authwebserver\Authwebserver.php(95)

After authentication, if I don't have permission, "Access Denied" is returned. So I take it the problem is solved?

After authentication, if I don't have permission, "Access Denied" is returned. So I take it the problem is solved?

Access denied and redirect ?

Else : this issue is not directly related to the 2 other fix

More to this line : https://github.com/LimeSurvey/LimeSurvey/blob/a0a3fe63fc54072ac4f71a1cd6f70f3af466af96/application/controllers/SurveyAdministrationController.php#L51 (throw a 401)
and https://github.com/LimeSurvey/LimeSurvey/blob/a0a3fe63fc54072ac4f71a1cd6f70f3af466af96/application/controllers/SurveyAdministrationController.php#L369 for the Access Denied

Hello, is there any simple way to let authwebserver working on 5.x version? I think it is very important for many people. We still use the version 3.x and can't upgrade to 5.x because of this.
thanks

@nohcho82 authwebserver work on 5.X

But issue can happen for some specific link

@DenisChenu and how to simulate this problematic place?

Because if I go to a controller (backend) action that has permission verification (and most actions do), it triggers a redirect
i.e. action newSurvey: https://github.com/LimeSurvey/LimeSurvey/blob/a0a3fe63fc54072ac4f71a1cd6f70f3af466af96/application/controllers/SurveyAdministrationController.php#L369

The authentication page in IIS is the Authwebserw plugin, and since the user is not authenticated, he enters here:
https://github.com/LimeSurvey/LimeSurvey/blob/a0a3fe63fc54072ac4f71a1cd6f70f3af466af96/application/core/plugins/Authwebserver/Authwebserver.php#L93

Result: 401, this means that the problem has been solved.
I know that not all backend controller actions have permission checking. And here may be a problem?

I know that not all backend controller actions have permission checking. And here may be a problem?

Yes, seems OK in surveyAdministration, but some other can lack of this.

At worst : doing a redirect (because not loggued user didn't have any permission) and after only a 401.

But i think @c_schmitz want to have a public without Auth, and only admin directory have Auth part …

Some webserver can have WebAuth o some directory (apache for example). It's the needed case here.

On some other (IIS) : you need 2 different name or PORT. I have a IIS where you need to connect to example.or:8080 to go to admin part.

@DenisChenu Will the issues fixed in the future releases?

Why i know this ?

Yes ? And ?

Did you have issue on specific link ?

@pstelling You might want to have a look at this one.