From 72208f440d501657f492ed7df0f19678f4b9e7e0 Mon Sep 17 00:00:00 2001
From: Joseph Nuthalpati <njoseph@riseup.net>
Date: Wed, 2 Aug 2017 16:57:48 +0530
Subject: [PATCH] SSO: Add check to see if auth_pubtkt module is available

- Solves bug #890
- Since Apache might be started before Plinth setup is ever run, we
have to handle the case where the auth_pubtkt module may not be available.
---
 .../includes/freedombox-single-sign-on.conf   | 24 ++++++++++++-------
 1 file changed, 15 insertions(+), 9 deletions(-)

diff --git a/data/etc/apache2/includes/freedombox-single-sign-on.conf b/data/etc/apache2/includes/freedombox-single-sign-on.conf
index a8ba00e70..a36944977 100644
--- a/data/etc/apache2/includes/freedombox-single-sign-on.conf
+++ b/data/etc/apache2/includes/freedombox-single-sign-on.conf
@@ -1,9 +1,15 @@
-TKTAuthPublicKey /etc/apache2/auth-pubtkt-keys/pubkey.pem
-TKTAuthLoginURL /plinth/accounts/sso/login/
-TKTAuthBackArgName next
-TKTAuthDigest SHA1
-TKTAuthRefreshURL /plinth/accounts/sso/refresh/
-TKTAuthUnauthURL /plinth
-AuthType mod_auth_pubtkt
-AuthName "FreedomBox Single Sign On"
-Require valid-user
+<IfModule mod_auth_pubtkt.c>
+    TKTAuthPublicKey /etc/apache2/auth-pubtkt-keys/pubkey.pem
+    TKTAuthLoginURL /plinth/accounts/sso/login/
+    TKTAuthBackArgName next
+    TKTAuthDigest SHA1
+    TKTAuthRefreshURL /plinth/accounts/sso/refresh/
+    TKTAuthUnauthURL /plinth
+    AuthType mod_auth_pubtkt
+    AuthName "FreedomBox Single Sign On"
+    Require valid-user
+</IfModule>
+
+<IfModule !mod_auth_pubtkt.c>
+    Deny from all
+</IfModule>
\ No newline at end of file