##master-page:HomepageTemplate #format wiki #language en == == <> ##acl DimitriJanczak:read,write,delete,revert EditorGroup:read,write,revert All:read Email: <> ## You can even more obfuscate your email address by adding more uppercase letters followed by a leading and trailing blank. = Contributed Patches = == MoinMoin == * [[MoinMoin:MoinMoinPatch/SameEmailSubjectFormatForEveryNotification|Changing Email subject]] == External components == * Under Windows 2003 SP2 32-bit, ISAPI-WSGI 0.4.1 and below does not set the wsgi.url_scheme properly when https is used. MoinMoin generates then incorrect URLs in getQualifiedURL: * sometimes after redirecting to a page * always in notification email. * The following patch solves the problem and has been submitted to the ISAPI-WSGI dev group: [[attachment:isapiwsgi.patch]] * The patch is included in ISAPI-WSGI 0.4.2 thanks to Mark Rees. In fact many WSGI-based open-source projects benefit from this https new capability, just to name a few: MoinMoin, Trac, Mercurial ;-) = Example Code = == using an helper function to convert an Active Directory login into a WikiName with LDAPAuth == * Tested in MoinMoin 1.9.0 and 1.9.2 * This is useful when your users' login are some random (read: not directly People's name) sequences instead of some part of their names: * You first retrieve the sAMAccountName, and get the object and needed properties from the AD * You use those properties stored into the ldap_dict object to create the WikiName {{{#!python ## in farmconfig.py/wikiconfig.py: ## the helper function def getWikiNameFromLoginName(ldap_dict): gn = ldap_dict.get('givenName',[''])[0] sn = ldap_dict.get('sn',[''])[0] ## depending on your AD implementation of attributes use one of the following: return "%s%s" % (sn,gn) ## return "%s%s" % (gn,sn) ldapAD = LDAPAuth( #server_uri=r'ldaps://domain.fqdn', server_uri=r'ldap://domain.fqdn', #bind_dn=r'%(username)s@domain.fqdn', #bind_pw=r'%(password)s', bind_dn=r'SomeServiceAccount@domain.fqdn', bind_pw=r'GuessIt!', base_dn='ou=UsersContainer,ou=SomeWhere,dc=domain,dc=fqdn', search_filter=r"(&(sAMAccountName=%(username)s)(memberOf=CN=SomeGroupForWikiAccess,ou=MyGroups,DC=domain,DC=fqdn))", givenname_attribute=r'givenName', surname_attribute=r'sn', email_attribute=r'mail', name_callback=getWikiNameFromLoginName, autocreate=True, ) auth = [ldapAD] }}} * maybe I should write it down into some ldap_AD_snippet for inclusion into the more_examples folder? = Docs = == Installing MoinMoin 1.9.x on Windows 2003/2008 == This procedure describes how to install MoinMoin on Windows using as many native components as possible: the web server is IIS, the authentication is Active Directory based, ... <
> This also assumes you want to create a wiki farm. The structure will be: * MoinMoin code in site-packages directory of your python installation * For each wiki, the wiki data are stored in {{{C:\Wikis\}}} * Configuration settings common to all wikis will be stored under in {{{C:\Wikis\common}}}. Eg. * {{{C:\Wikis\common\config}}} will contain the python configuration files; * {{{C:\Wikis\common\user}}} will hold the user profiles. This procedure has been tested on: * Windows 2003 Standard SP2 32-bit with IIS 6.0 * (ongoing) Windows 2008R2 Standard RTM, which is 64-bit and includes IIS 7.5 {{{#!wiki tip 1. On UAC-capable and UAC-enabled Windows like Windows 2008R2, you should always issue these command from an elevated command prompt. 1. Always right-click the cmd shortcut and Select "Run As administrator". 1. If you are unsure whether your current command prompt is elevated you may look at window title which should start with "Administrator: Command Prompt" }}} === Basic installation (no authentication) === 1. Take one of he following: * a Windows 2003 Standard Edition 32-bit Server with IIS Web Service, domain member if you need AD authentication * a Windows 2008R2 Standard Edition (64-bit) with the following role and role services: * IIS Web Services Role installed * IIS Role Services: * IIS 6.0 Metabase compatibility for ISAPI-WSGI to install * ISAPI Extensions for ISAPI-WSGI to run 1. Download the latest Python 2.6.x from http://www.python.org/download/. Be sure to select the correct architecture. The 32-bit Python edition is named "Python 2.6.x Installer". The 64-bit edition is labeled as "Python 2.6.x x86-64 Installer". 1. Install Python for all users, in {{{%PROGRAMFILES%\Python26}}}. There is no need for help file, nor test suite, nor build headers nor libraries. You may just include the two first items from the installer. 1. add {{{%PROGRAMFILES%\Python26}}} to the system path as it wasn't added by python installer already. 1. add Win32 extensions for Python from http://sourceforge.net/projects/pywin32 You must download an executable that matches your python installation (Major.Minor) and your processor architecture. For python 2.6 you will end up with a file called {{{pywin32-XXX.win32-py2.6.exe}}} if you have selected a 32-bit Windows or {{{pywin32-XXX.win-amd64-py2.6.exe}}} for the 64-bit version. 1. Download 7-zip from http://www.7-zip.org. Once again pick the appropriate architecture Release 4.65 is known to work for untaring moimoin. Other unzip utilities have sometimes issues with tar files from the Unix world. 1. install moinmoin-1.9.x by: * untaring it into a temp directory * running {{{python setup.py install}}} from the distribution: it will install MoinMoin into {{{C:\Program Files\python26\Lib\Site-Packages\MoinMoin}}}. * Alternatively to install MoinMoin in a Windows-Program-like directory, use {{{python setup.py install --prefix="C:\Program Files\MoinMoin"}}}. Note the quotes when you have spaces in the directory name. If you choose this option, you must add that path to a new PYTHONPATH system variable. 1. In the directory where you have untarred the MoinMoin distribution, run {{{wikiserver.py}}} and connect to http://localhost:8080 to check the basic MoinMoin install is working (no ldap, no plugin, no external webserver). Once launched, hit ctrl-break into the cmd window to stop the web server. <
> :) Congratulations, you have installed a standalone wiki. In the next section, let's make it serve a farm through IIS. === Making IIS serve any WSGI App === 1. install ISAPI-WSGI extension by running {{{python setup.py install}}} from the temporary directory you have extracted the archive. At this time, the distribution {{{isapi_wsgi-0.4.2.win32.zip}}} is located at http://code.google.com/p/isapi-wsgi/downloads. You can also specify an alternate directory to {{{%PROGRAMFILES%\Python26\Lib\Site-Packages}}} by using the {{{--prefix}}} option. At the time of this writing, using the zip file is mandatory as you cannot use the exe installer on a 64-bit platform. 1. If you intend to use https to serve your wiki, be sure to have revision 0.4.2 or higher. 1. Test WSGI served by IIS is working * Go to the directory where you have unpacked the ISAPI-WSGI archive * Go to the examples sub-directory * Run the following command: {{{python demo.py install}}}. You should have a message saying {{{Installation complete}}}. If you have an error message under Windows 2008, this means you have forgotten to install the Metabase compatibility role service. * Point your browser to http://localhost/isapi-wsgi-demo and check you've got a web page with some text. If you obtain a "HTTP Error 500.21 - Internal Server Error Handler AboMapperCustom-XXXXX has a bad module IsapiModule in its module list" message, you forgot to install the ISAPI extensions. * Once the test is successful, remove this test application by running {{{python demo.py remove}}} from the same directory where you ran the install command <
> :) Congratulations, you have installed the gateway to serve any Python WSGI Application in IIS 6.0 or IIS 7.5. In the next section, let's make it serve our wiki farm. === Prepare the configuration of your wiki farm === 1. Create the wiki structure into the C: drive * create a {{{C:/Wikis}}} folder * create a {{{C:/wikis/common}}} folder * create a {{{C:/wikis/common/user}}} folder * create a {{{C:/wikis/common/config}}} folder * create a {{{C:/wikis/}}} folder per wiki in the farm 1. check the farmconfig.py file in {{{C:/Wikis/Common/config}}} {{attachment:farmconfig.py}} 1. create one file per wiki you want to host. Use the following attachment as a base for your work: {{attachment:testwiki.py}} 1. For each wiki you create, you must have the following folder tree under data : pages, plugin (filled from distribution), dict, cache. eg. * {{{C:/wikis/testwiki/data/cache}}}: empty * {{{C:/wikis/testwiki/data/dict}}}: empty * {{{C:/wikis/testwiki/data/pages}}}: empty * {{{C:/wikis/testwiki/data/plugins}}}: copied from the {{{\share\moin\data\plugin}}} directory from the MoinMoin Installation. * Alternatively you can copy all these directories from the whole MoinMoin' distribution's tree {{{\share\moin\data}}} . Additional files are dummy place holders 1. the SiteName in the py files should start with the prefix for your farm, eg. if you created a {{{wf/site1}}} virtual directory and then a {{{wf/site2}}}, the site names should be {{{wf/siteXX}}} in the files. === Install the loader for the MoinMoin WSGI Application === 1. Add the {{{C:\Wikis\common\config}}} directory to a new PYTHONPATH variable {{{PYTHONPATH=C:\wikis\common\config}}} If you don't do so, you need to add a {{{sys.path.append}}} directive in the files used for this web site. See help message in attachment for code. 1. Copy the following wsgi loader to the {{{%winDir%\system32\inetsrv}}}. This will also create one virtual directory per wiki in the farm. {{attachment:moinmoinloader19.py}} {{{#!wiki tip 1. This version is designed for MoinMoin 1.9 and will not work for previous versions unless you edit the comments. 1. Edit it if you need to install the wikis elsewhere than at root by changing the name attribute of the virtual directories. }}} 1. Run it as {{{moinmoinloader.py install}}}. This will create a {{{_moinmoinloader.dll}}} in the same directory. {{{#!wiki warning 1. Under Windows 2003, as w3wp.exe, the IIS process, by default runs under the "Network Service" account, the dll should be placed in a directory where this account has right to access files. A way to do it is to run it in the inetsrv directory. 1. If you run under a different Application Pool than the default, you must replace "Network Service" with the account you're using. In this case, that account must also have rights to execute the python program, the python scripts and on the C:\wikis hierarchy. }}}{{{#!wiki tip 1. You may name the loader filename as wish: if you rename the .py file as foobar.py the dll will be created as _foobar.dll 1. Due to the used thread model, you must use iisreset when you modify a .py config file so your changes are propagated thru the recompilation into new .pyc files 1. If you need to perform any change on the WWW bindings, run the .py file with moinmoinloader.py remove, make your changes, and re-run the file with the install parameter }}} 1. Go to http://localhost/ to check you have at least a python page. If you have a ConfigurationError it means the config files were not found: * Check the PYTHONPATH variable: in particular, if you have set it after IIS has started, you need to issue a {{{iisreset}}} * If you do not have nice layout, it is normal! see below. 1. create with IIS Manager a new virtual directory for serving static contents. The name of the virtual directory is given by {{{url_prefix_static}}} in the .py file. . If you use the above .py files, the name is moin . For MoinMoin 1.9 using Python 2.6.x, you should point it to {{{%PROGRAMFILES%\Python26\Lib\site-packages\MoinMoin\web\static\htdocs}}} if you have installed MoinMoin in site-packages. 1. Do not forget to replace the intermap.txt file with a line per wiki {{attachment:intermap.txt}} === Finishing the layout === 1. Replace underlay directory in {{{C:/wikis/common}}} subdirectory by the one found in wiki/underlay in the distribution tarball 1. go to the LanguageSetup page as SuperUser to install the help (eg. English/allpages.zip) 1. Add customizations: * themes * authentication modules * IIS customizations below if needed === Adding authentication using LDAP === 1. Install python-ldap for the matching version of python (official msi on www.python.org) if you intend to use LDAP queries 1. If you forget this and use a LDAP authenticator you will receive 500/Web Server errors. 1. use a LDAP authenticator object with bind credentials as a domain user, the user credentials do not seem to work. See Example Code == IIS Customizations: using HTTPS and an alias for your server == === Alias for you wiki === 1. Add a Host Header Value to the IIS web site for your alias {{attachment:hostheader.png}} 1. Add the CNAME in your DNS Zone === HTTPS === 1. Create a self-signed certificate with SelfSSL from the IIS resource kit: http://www.iis.net/downloads/default.aspx?tabid=34&i=1352&g=6 The SelfSSL Command format should be: {{{ selfssl /N:CN=mytestwiki.domain.fqdn,CN=mytestwiki,CN=myserver.domain.fdqn,CN=myserver /V:365 /P:443 }}}, assuming your server is named myserver and you also want the https respond to the alias mytestwiki. The certificate is valid for 365 days and the default site (port 80) will listen on port 443 for https request. 1. For ease of use, Put Self Signed certificate in Local Computer\Trusted CA store only if you intebd to do some tests locally for 1. Require SSL in Directory Security {{attachment:SSLDir.png}} 1. Add a nice welcome page to the root of your IIS Web Site 1. To have better performance when using encrypted pages, you may set {{{EnableKernelSSL:DWord=1}}} in {{{HKLM\system\CurrentControlSet\Http\parameters}}}. This will speed up https by letting the encryption/decryption routines be done in kernel mode instead of switching to user-land. {{{#!wiki tip There are restrictions about what options are supported under this mode in IIS 6.0, e.g. no client certificates, as documented here: http://msdn.microsoft.com/en-us/library/aa364671.aspx }}} You need to restart the HTTP boot driver for the changes to happen (Beware of the dependencies to HTTP SSL, IIS Admin and web services) 1. To make your users happy, replace the 403.4 Custom Error Page by {{attachment:403-4-Redirect.htm}} * If Javascript is not enabled, they got a similar error message as the IIS default 403.4 (adding "please enable Javascript") * If Javascript is enabled, the browser redirects every http://server/path/to/request to https://server/path/to/request) 1. Replace the self-signed certificate by a production one. == Debugging In MoinMoin under Windows == 1. Set an environment variable in system called MOINLOGGINGCONF. Its value is a filename with path to a configuration file specifying log level, log filename and code parts to be logged. You may use a traditional IIS-oriented path e.g. {{{%windir%\system32\logfiles\moinlogging.ini}}} {{attachment:moinloggingconf.png}} 1. Create the file pointed at by this variable. You may take it from the sample in the distribution in wiki\config\logging. 1. Do not forget if you take samples from the distribution tarball to change the Unix-like paths into Win32-like ones. 1. Create a folder {{{moin}}} under {{{%windir%\system32\logfiles}}} 1. Change the line to {{{logfile=C:\windows\system32\logfiles\moin\moin.log}}}. This is the example to debug authentication issues: {{attachment:moinlogging.ini}} 1. You need to restart the ISAPI handler for this to work. Use the {{{iisreset}}} command for this. == message to me == ... ---- CategoryHomepage