From c718ff2bbf8e5d77f17fd43520833430d809e5a8 Mon Sep 17 00:00:00 2001 From: Benjamin Bohard Date: Fri, 30 Aug 2019 17:22:02 +0200 Subject: [PATCH 1/2] Some configuration to switch to apache --- dicos/70_lemonldap_ng.xml | 23 ++-- dicos/71_eolesso_compat.xml | 206 ++++++++++++++++++++++++++++++++++++ posttemplate/70-lemon-nginx | 30 ++++-- tmpl/handler-apache2.X.conf | 73 +++++++++++++ tmpl/manager-apache2.X.conf | 130 +++++++++++++++++++++++ tmpl/portal-apache2.X.conf | 161 ++++++++++++++++++++++++++++ 6 files changed, 608 insertions(+), 15 deletions(-) create mode 100644 dicos/71_eolesso_compat.xml create mode 100644 tmpl/handler-apache2.X.conf create mode 100644 tmpl/manager-apache2.X.conf create mode 100644 tmpl/portal-apache2.X.conf diff --git a/dicos/70_lemonldap_ng.xml b/dicos/70_lemonldap_ng.xml index bfede2a..6aaf053 100644 --- a/dicos/70_lemonldap_ng.xml +++ b/dicos/70_lemonldap_ng.xml @@ -2,16 +2,18 @@ - - - - + + + + + + - lemonldap-ng-fastcgi-server + lemonldap-ng-fastcgi-server 80 443 @@ -76,6 +78,14 @@ + + non + lemonng + + + non + lemona2 + manager. nom_domaine_local @@ -103,7 +113,8 @@ non - lemon + lemonng + lemona2 lemonCAS LemonLDAP saLemon diff --git a/dicos/71_eolesso_compat.xml b/dicos/71_eolesso_compat.xml new file mode 100644 index 0000000..750c356 --- /dev/null +++ b/dicos/71_eolesso_compat.xml @@ -0,0 +1,206 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + ldapUserBaseDN + + + ldapServerPort + + + + + + + + + + diff --git a/posttemplate/70-lemon-nginx b/posttemplate/70-lemon-nginx index 6b32fa8..bc28e6f 100755 --- a/posttemplate/70-lemon-nginx +++ b/posttemplate/70-lemon-nginx @@ -1,17 +1,29 @@ #!/bin/bash ENABLE=$(CreoleGet activerLemon 'non') -CONF_FILES="manager-nginx.conf" -CONF_FILES="${CONF_FILES} handler-nginx.conf" -CONF_FILES="${CONF_FILES} portal-nginx.conf" -CONF_FILES="${CONF_FILES} test-nginx.conf" +if [ "$(CreoleGet activer_nginx_web non)" = 'oui' ];then + SERVER=nginx +else + SERVER=apache2 +fi -for CONF_FILE in ${CONF_FILES} +SERVICES="manager" +SERVICES="${SERVICES} handler" +SERVICES="${SERVICES} portal" + +for SERVICE in ${SERVICES} do - if [ -L /etc/nginx/sites-enabled/${CONF_FILE} ];then - rm /etc/nginx/sites-enabled/${CONF_FILE} + if [ -L /etc/nginx/sites-enabled/${SERVICE}-nginx.conf ];then + rm /etc/nginx/sites-enabled/${SERVICE}-nginx.conf + fi + if [ -L /etc/apache2/sites-enabled/${SERVICE}-apache2.conf ];then + a2dissite ${SERVICE}-apache2 fi if [ "${ENABLE}" = 'oui' ];then - ln -s /etc/nginx/sites-available/${CONF_FILE} /etc/nginx/sites-enabled/${CONF_FILE} + if [ "${SERVER}" = 'nginx' ];then + ln -s /etc/nginx/sites-available/${SERVICE}-nginx.conf /etc/nginx/sites-enabled/${SERVICE}-nginx.conf + elif [ "${SERVER}" = 'apache2' ];then + a2ensite ${SERVICE}-apache2.conf + fi fi -done \ No newline at end of file +done diff --git a/tmpl/handler-apache2.X.conf b/tmpl/handler-apache2.X.conf new file mode 100644 index 0000000..38ef821 --- /dev/null +++ b/tmpl/handler-apache2.X.conf @@ -0,0 +1,73 @@ +#======================================================================== +# Apache configuration for LemonLDAP::NG Handler +#======================================================================== +# This file implements the reload virtualhost that permits to reload +# configuration without restarting server, and some common instructions. +# You need then to declare this vhost in reloadUrls (in the manager +# interface if this server doesn't host the manager itself): +# +# KEY : VALUE +# host-or-IP:port : http://reload.example.com/reload +# +# IMPORTANT: +# To protect applications, see test-apache.conf template in example files + +# Uncomment this if no previous NameVirtualHost declaration +#NameVirtualHost "*:80" + +# Load LemonLDAP::NG Handler +PerlOptions +GlobalRequest +PerlModule Lemonldap::NG::Handler + +# Common error page and security parameters +ErrorDocument 403 http://%%authWebName/?lmError=403 +ErrorDocument 404 http://%%authWebName/?lmError=404 +ErrorDocument 500 http://%%authWebName/?lmError=500 +ErrorDocument 502 http://%%authWebName/?lmError=502 +ErrorDocument 503 http://%%authWebName/?lmError=503 + + + ServerName %%reloadWebName + + # Configuration reload mechanism (only 1 per physical server is + # needed): choose your URL to avoid restarting Apache when + # configuration change + + = 2.3> + Require ip 127 ::1 + + + Order Deny,Allow + Deny from all + Allow from 127.0.0.0/8 ::1 + + SetHandler perl-script + PerlResponseHandler Lemonldap::NG::Handler->reload + + SSLEngine on + SSLCertificateFile %%apache_cert + SSLCertificateKeyFile %%server_key + SSLProtocol all -SSLv3 -SSLv2 + + # Uncomment this to activate status module + # + # = 2.3> + # Require ip 127 ::1 + # + # + # Order Deny,Allow + # Deny from all + # Allow from 127.0.0.0/8 ::1 + # + # SetHandler perl-script + # PerlResponseHandler Lemonldap::NG::Handler->status + # # You may have to uncomment the next directive to skip + # # an upper PerlHeaderParserHandler directive + # #PerlHeaderParserHandler Apache2::Const::DECLINED + # + + # Uncomment this if site if you use SSL only + #Header set Strict-Transport-Security 15768000 + + + diff --git a/tmpl/manager-apache2.X.conf b/tmpl/manager-apache2.X.conf new file mode 100644 index 0000000..1116730 --- /dev/null +++ b/tmpl/manager-apache2.X.conf @@ -0,0 +1,130 @@ +#==================================================================== +# Apache configuration for LemonLDAP::NG Manager +#==================================================================== + +# Uncomment this if no previous NameVirtualHost declaration +#NameVirtualHost "*:80" + +# Manager virtual host (manager.example.com) + + ServerName %%managerWebName + LogLevel notice + #ErrorLog ${APACHE_LOG_DIR}/lm_err.log + #CustomLog ${APACHE_LOG_DIR}/lm.log combined + + # FASTCGI CONFIGURATION + # --------------------- + + # 1) URI management + RewriteEngine on + + RewriteRule "^/$" "/psgi/manager-server.fcgi" [PT] + # For performances, you can delete the previous RewriteRule line after + # puttings html files: simply put the HTML results of differents modules + # (configuration, sessions, notifications) as manager.html, sessions.html, + # notifications.html and uncomment the 2 following lines: + # DirectoryIndex manager.html + # RewriteCond "%{REQUEST_FILENAME}" "!\.html$" + SSLEngine on + SSLCertificateFile %%apache_cert + SSLCertificateKeyFile %%server_key + SSLProtocol all -SSLv3 -SSLv2 + + # REST URLs + RewriteCond "%{REQUEST_FILENAME}" "!^/(?:static|doc|fr-doc|lib|javascript|favicon).*" + RewriteRule "^/(.+)$" "/psgi/manager-server.fcgi/$1" [PT] + + Alias /psgi/ /usr/share/lemonldap-ng/manager/psgi// + + # 2) FastCGI engine + + # You can choose any FastCGI system. Here is an example using mod_fcgid + # mod_fcgid configuration + FcgidMaxRequestLen 2000000 + + SetHandler fcgid-script + Options +ExecCGI + + + # If you want to use mod_fastcgi, replace lines below by: + #FastCgiServer /usr/share/lemonldap-ng/manager/psgi/manager-server.fcgi + + # Or if you prefer to use CGI, use /psgi/manager-server.cgi instead of + # /psgi/manager-server.fcgi and adapt the rewrite rules. + + # GLOBAL CONFIGURATION + # -------------------- + + DocumentRoot /usr/share/lemonldap-ng/manager/ + + + = 2.3> + Require all granted + + + Order Deny,Allow + Allow from all + + Options +FollowSymLinks + + + AddOutputFilterByType DEFLATE text/html text/plain text/xml text/javascript text/css + SetOutputFilter DEFLATE + BrowserMatch ^Mozilla/4 gzip-only-text/html + BrowserMatch ^Mozilla/4\.0[678] no-gzip + BrowserMatch \bMSIE !no-gzip !gzip-only-text/html + SetEnvIfNoCase Request_URI \.(?:gif|jpe?g|png)$ no-gzip dont-vary + + + Header append Vary User-Agent env=!dont-vary + + + + # Static files (javascripts, HTML forms,...) + + Alias /static/ /usr/share/lemonldap-ng/manager/static// + + = 2.3> + Require all granted + + + Order Deny,Allow + Allow from all + + Options +FollowSymLinks + + + # On-line documentation + Alias /doc/ /usr/share/doc/lemonldap-ng-doc/ + Alias /lib/ /usr/share/doc/lemonldap-ng-doc/pages/documentation/current/lib/ + + = 2.3> + Require all granted + + + Order Deny,Allow + Allow from all + + ErrorDocument 404 /notfound.html + Options +FollowSymLinks + DirectoryIndex index.html start.html + + + # French version (needs fr-doc installation) + Alias /fr-doc/ /usr/share/doc/lemonldap-ng-fr-doc/ + + = 2.3> + Require all granted + + + Order Deny,Allow + Allow from all + + ErrorDocument 404 /notfoundfr.html + Options +FollowSymLinks + DirectoryIndex index.html start.html + + + # Uncomment this if site if you use SSL only + #Header set Strict-Transport-Security 15768000 + diff --git a/tmpl/portal-apache2.X.conf b/tmpl/portal-apache2.X.conf new file mode 100644 index 0000000..de30f87 --- /dev/null +++ b/tmpl/portal-apache2.X.conf @@ -0,0 +1,161 @@ +#==================================================================== +# Apache configuration for LemonLDAP::NG Portal +#==================================================================== + +# Uncomment this if no previous NameVirtualHost declaration +#NameVirtualHost "*:80" + +# Portal Virtual Host (auth.example.com) + + ServerName %%authWebName + + # DocumentRoot + DocumentRoot /var/lib/lemonldap-ng/portal/ + + = 2.3> + Require all granted + + + Order Deny,Allow + Allow from all + + Options +ExecCGI +FollowSymLinks + + SSLEngine on + SSLCertificateFile %%apache_cert + SSLCertificateKeyFile %%server_key + SSLProtocol all -SSLv3 -SSLv2 + + # Perl script + + SetHandler perl-script + PerlResponseHandler ModPerl::Registry + #CGIPassAuth on + + + + DirectoryIndex index.pl index.html + + + # SOAP functions for sessions management (disabled by default) + + = 2.3> + Require all denied + + + Order Deny,Allow + Deny from all + + + + # SOAP functions for sessions access (disabled by default) + + = 2.3> + Require all denied + + + Order Deny,Allow + Deny from all + + + + # SOAP functions for configuration access (disabled by default) + + = 2.3> + Require all denied + + + Order Deny,Allow + Deny from all + + + + # SOAP functions for notification insertion (disabled by default) + + = 2.3> + Require all denied + + + Order Deny,Allow + Deny from all + + + + # SAML2 Issuer + + RewriteEngine On + RewriteRule ^/saml/metadata /metadata.pl + RewriteRule ^/saml/.* /index.pl + + + # CAS Issuer + + RewriteEngine On + RewriteRule ^/cas/.* /index.pl + + + # OpenID Issuer + + RewriteEngine On + RewriteRule ^/openidserver/.* /index.pl + + + # OpenID Connect Issuer + + RewriteEngine On + #RewriteCond %{HTTP:Authorization} . + #RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] + RewriteRule ^/oauth2/.* /index.pl + RewriteRule ^/.well-known/openid-configuration$ /openid-configuration.pl + + + # Get Issuer + + RewriteEngine On + RewriteRule ^/get/.* /index.pl + + + # Public pages + + RewriteEngine On + RewriteRule ^/public* /public.pl + + + + + AddOutputFilterByType DEFLATE text/html text/plain text/xml text/javascript text/css + SetOutputFilter DEFLATE + BrowserMatch ^Mozilla/4 gzip-only-text/html + BrowserMatch ^Mozilla/4\.0[678] no-gzip + BrowserMatch \bMSIE !no-gzip !gzip-only-text/html + SetEnvIfNoCase Request_URI \.(?:gif|jpe?g|png)$ no-gzip dont-vary + + + Header append Vary User-Agent env=!dont-vary + + + + + ExpiresActive On + ExpiresDefault "access plus 1 month" + + + + # Uncomment this if site if you use SSL only + #Header set Strict-Transport-Security 15768000 + + +############################################## +## Best performance under ModPerl::Registry ## +############################################## + +# Uncomment this to increase performance of Portal: + + #require Lemonldap::NG::Portal::SharedConf; + #Lemonldap::NG::Portal::SharedConf->compile( + # qw(delete header cache read_from_client cookie redirect unescapeHTML)); + # Uncomment this line if you use Lemonldap::NG menu + #require Lemonldap::NG::Portal::Menu; + # Uncomment this line if you use portal SOAP capabilities + #require SOAP::Lite; + From 223e7cc2c61d9e5f03d22e901a17aba3657d2ffc Mon Sep 17 00:00:00 2001 From: Benjamin Bohard Date: Mon, 2 Sep 2019 14:00:48 +0200 Subject: [PATCH 2/2] Delete old configuration --- tmpl/lmConf-1.js | 441 ----------------------------------------------- 1 file changed, 441 deletions(-) delete mode 100644 tmpl/lmConf-1.js diff --git a/tmpl/lmConf-1.js b/tmpl/lmConf-1.js deleted file mode 100644 index 60af145..0000000 --- a/tmpl/lmConf-1.js +++ /dev/null @@ -1,441 +0,0 @@ -%set %%ssoFilters = %%getSSOFilters -{ - "ldapGroupAttributeNameUser": "dn", - "cfgAuthorIP": "172.16.0.1", - "samlSPMetaDataXML": null, - "facebookAuthnLevel": 1, - "mailConfirmSubject": "[LemonLDAP::NG] Password reset confirmation", - "secureTokenAttribute": "uid", - "singleSession": 0, - "registerConfirmSubject": "[LemonLDAP::NG] Account register confirmation", - "CAS_pgtFile": "/tmp/pgt.txt", - "cookieName": "lemonldap", - "slaveExportedVars": {}, - "whatToTrace": "_whatToTrace", - "oidcRPMetaDataOptions": {}, - "notifyDeleted": 1, - "useRedirectOnError": 1, - "samlSPMetaDataExportedAttributes": null, - "ldapPwdEnc": "utf-8", - "openIdSPList": "0;", - "samlNameIDFormatMapEmail": "mail", - "samlSPMetaDataOptions": null, - "issuerDBOpenIDRule": 1, - "casStorageOptions": {}, - "mailFrom": "noreply@%%nom_domaine_local", - "timeoutActivity": 0, - "oidcRPMetaDataExportedVars": {}, - "issuerDBSAMLActivation": 0, - "issuerDBCASPath": "^/%%casFolder/", - "randomPasswordRegexp": "[A-Z]{3}[a-z]{5}.\\d{2}", - "samlIDPSSODescriptorSingleSignOnServiceSOAP": "urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/singleSignOnSOAP;", - "samlSPSSODescriptorSingleLogoutServiceHTTPPost": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST;#PORTAL#/saml/proxySingleLogout;#PORTAL#/saml/proxySingleLogoutReturn", - "exportedHeaders": { - "test1.%%nom_domaine_local": { - "Auth-User": "$uid" - }, - "test2.%%nom_domaine_local": { - "Auth-User": "$uid" - }, - "%%managerWebName": {} - }, - "vhostOptions": { - "%%managerWebName": { - "vhostHttps" : "1" - }, - "test1.%%nom_domaine_local": {}, - "test2.%%nom_domaine_local": {} - }, - "radiusAuthnLevel": 3, - "dbiAuthnLevel": 2, - "ldapPasswordResetAttribute": "pwdReset", - "ldapGroupObjectClass": "groupOfNames", - "apacheAuthnLevel": 4, - "samlNameIDFormatMapKerberos": "uid", - "groups": {}, - "securedCookie": 0, - "httpOnly": 1, - "yubikeyAuthnLevel": 3, - "ADPwdMaxAge": 0, - "samlUseQueryStringSpecific": 0, - "loginHistoryEnabled": 1, - "samlSPSSODescriptorSingleLogoutServiceSOAP": "urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/proxySingleLogoutSOAP;", - "failedLoginNumber": 5, - "samlServicePrivateKeyEncPwd": "", - "portalForceAuthnInterval": 0, - "cfgLog": "", - "samlIDPSSODescriptorSingleLogoutServiceHTTPRedirect": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect;#PORTAL#/saml/singleLogout;#PORTAL#/saml/singleLogoutReturn", - "exportedVars": { - "UA": "HTTP_USER_AGENT", -%for att in %%casAttribute - "%%att": "%%att", -%end for -%set %%idx = 0 -%set %%size = %%len(%%ssoFilters) - 1 -%for key,value in %%ssoFilters - %if %%idx == %%size - "%%key": "%%value" - %else - "%%key": "%%value", - %end if - %set %%idx += 1 -%end for - }, - "notificationStorage": "File", - "applicationList": { - "1sample": { - "test2": { - "options": { - "name": "Application Test 2", - "logo": "thumbnail.png", - "uri": "https://test2.%%nom_domaine_local/", - "display": "auto", - "description": "The same simple application displaying authenticated user" - }, - "type": "application" - }, - "type": "category", - "catname": "Sample applications", - "test1": { - "type": "application", - "options": { - "description": "A simple application displaying authenticated user", - "uri": "https://test1.%%nom_domaine_local/", - "logo": "demo.png", - "display": "auto", - "name": "Application Test 1" - } - } - }, - "2administration": { - "notifications": { - "options": { - "name": "Notifications explorer", - "display": "auto", - "description": "Explore WebSSO notifications", - "uri": "https://%%managerWebName/notifications.pl", - "logo": "database.png" - }, - "type": "application" - }, - "manager": { - "options": { - "uri": "https://%%managerWebName/", - "display": "auto", - "description": "Configure LemonLDAP::NG WebSSO", - "logo": "configure.png", - "name": "WebSSO Manager" - }, - "type": "application" - }, - "type": "category", - "sessions": { - "type": "application", - "options": { - "description": "Explore WebSSO sessions", - "uri": "https://%%managerWebName/sessions.pl", - "logo": "database.png", - "display": "auto", - "name": "Sessions explorer" - } - }, - "catname": "Administration" - }, - "3documentation": { - "catname": "Documentation", - "officialwebsite": { - "type": "application", - "options": { - "name": "Offical Website", - "description": "Official LemonLDAP::NG Website", - "logo": "network.png", - "display": "on", - "uri": "http://lemonldap-ng.org/" - } - }, - "type": "category", - "localdoc": { - "options": { - "logo": "help.png", - "description": "Documentation supplied with LemonLDAP::NG", - "display": "on", - "uri": "https://%%managerWebName/doc/", - "name": "Local documentation" - }, - "type": "application" - } - } - }, - "userControl": "^[\\w\\.\\-@]+$", - "timeout": 72000, - "portalAntiFrame": 1, - "SMTPServer": "", - "ldapTimeout": 120, - "samlAuthnContextMapPasswordProtectedTransport": 3, - "ldapUsePasswordResetAttribute": 1, - "ldapPpolicyControl": 0, - "casAttributes": { -%for att in %%casAttribute - "%%att": "%%att.casLDAPAttribute", -%end for -%set %%idx = 0 -%set %%size = %%len(%%ssoFilters) - 1 -%for key,value in %%ssoFilters - %if %%idx == %%size - "%%key": "%%key" - %else - "%%key": "%%key", - %end if - %set %%idx += 1 -%end for - }, - "issuerDBSAMLPath": "^/saml/", - "samlAttributeAuthorityDescriptorAttributeServiceSOAP": "urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/AA/SOAP;", - "portalDisplayAppslist": 1, - "confirmFormMethod": "post", - "domain": "%%nom_domaine_local", - "cfgNum": "1", - "authentication": "LDAP", - "samlNameIDFormatMapWindows": "uid", - "authChoiceModules": {}, - "ldapGroupAttributeName": "member", - "samlServicePrivateKeySigPwd": "", - "googleAuthnLevel": 1, - "successLoginNumber": 5, - "localSessionStorageOptions": { - "cache_root": "/tmp", - "namespace": "lemonldap-ng-sessions", - "default_expires_in": 600, - "directory_umask": "007", - "cache_depth": 3 - }, - "samlSPSSODescriptorArtifactResolutionServiceArtifact": "1;0;urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/artifact", - "portalRequireOldPassword": 1, - "samlIDPSSODescriptorSingleSignOnServiceHTTPArtifact": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact;#PORTAL#/saml/singleSignOnArtifact;", - "ADPwdExpireWarning": 0, - "yubikeyPublicIDSize": 12, - "ldapGroupAttributeNameGroup": "dn", - "oidcRPMetaDataOptionsExtraClaims": null, - "ldapGroupRecursive": 0, - "mailSubject": "[LemonLDAP::NG] Your new password", - "nginxCustomHandlers": {}, - "samlSPSSODescriptorAuthnRequestsSigned": 1, -%if %%llResetPassword == "oui" - "portalDisplayResetPassword": 1, -%else - "portalDisplayResetPassword": 0, -%end if - "openIdSreg_timezone": "_timezone", - "infoFormMethod": "get", - "openIdAuthnLevel": 1, - "openIdSreg_nickname": "uid", - "samlServicePublicKeyEnc": "", - "userDB": "LDAP", - "grantSessionRules": {}, - "remoteGlobalStorage": "Lemonldap::NG::Common::Apache::Session::SOAP", - "reloadUrls": { - "%%reloadWebName": "https://%%reloadWebName/reload" - }, - "registerTimeout": 0, - "samlIDPSSODescriptorSingleSignOnServiceHTTPPost": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST;#PORTAL#/saml/singleSignOn;", - "slaveAuthnLevel": 2, - "samlIDPSSODescriptorSingleLogoutServiceHTTPPost": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST;#PORTAL#/saml/singleLogout;#PORTAL#/saml/singleLogoutReturn", - "Soap": 1, -%set %%RegisterDB=%%getVar('llRegisterDB', 'Demo') -%if %%RegisterDB == "Custom" - "registerDB": "Null", -%else - "registerDB": "%%RegisterDB", -%end if - "locationRules": { - "%%managerWebName": { - "default": "$uid eq \"%%lemonAdmin\"" - }, - "test1.%%nom_domaine_local": { - "default": "accept", - "^/logout": "logout_sso" - }, - "test2.%%nom_domaine_local": { - "default": "accept", - "^/logout": "logout_sso" - } - }, - "portalDisplayChangePassword": "$_auth =~ /^(LDAP|DBI|Demo)$/", - "hideOldPassword": 0, -%if %%is_file(%%ldapBindUserPassword) - "managerPassword": "%%readPass("", %%ldapBindUserPassword)", -%else - "managerPassword": "%%ldapBindUserPassword", -%end if - "authChoiceParam": "lmAuth", - "lwpSslOpts": {}, - "portalSkinRules": {}, - "issuerDBOpenIDPath": "^/openidserver/", - "redirectFormMethod": "get", - "portalDisplayRegister": 1, - "secureTokenMemcachedServers": "127.0.0.1:11211", - "notificationStorageOptions": { - "dirName": "/var/lib/lemonldap-ng/notifications" - }, - "browserIdAuthnLevel": 1, - "portalUserAttr": "_user", - "ldapVersion": 3, - "sessionDataToRemember": {}, - "samlNameIDFormatMapX509": "mail", - "managerDn": "%%ldapBindUserDN", - "mailSessionKey": "mail", - "openIdSreg_email": "mail", - "localSessionStorage": "Cache::FileCache", - "persistentStorage": "Apache::Session::File", - "mailOnPasswordChange": 0, - "captchaStorage": "Apache::Session::File", - "remoteGlobalStorageOptions": { - "proxy": "https://%%authWebName/index.pl/sessions", - "ns": "https://%%authWebName/Lemonldap/NG/Common/CGI/SOAPService" - }, - "passwordDB": "LDAP", - "captcha_size": 6, - "mailCharset": "utf-8", - "facebookExportedVars": {}, - "nullAuthnLevel": 2, - "singleIP": 0, - "dbiExportedVars": {}, - "portalSkin": "bootstrap", - "storePassword": 0, - "hiddenAttributes": "_password", - "samlServicePrivateKeySig": "", - "globalStorage": "Apache::Session::File", - "notificationWildcard": "allusers", - "portalForceAuthn": 0, - "samlMetadataForceUTF8": 1, - "secureTokenUrls": ".*", - "secureTokenAllowOnError": 1, - "samlAuthnContextMapTLSClient": 5, - "ldapAllowResetExpiredPassword": 0, - "oidcOPMetaDataExportedVars": {}, - "notifyOther": 0, - "secureTokenExpiration": 60, - "captcha_mail_enabled": 0, - "samlStorageOptions": {}, - "samlOrganizationDisplayName": "Example", - "trustedProxies": "", - "secureTokenHeader": "Auth-Token", - "issuerDBCASActivation": 1, - "samlIDPSSODescriptorSingleSignOnServiceHTTPRedirect": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect;#PORTAL#/saml/singleSignOn;", - "samlSPSSODescriptorSingleLogoutServiceHTTPRedirect": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect;#PORTAL#/saml/proxySingleLogout;#PORTAL#/saml/proxySingleLogoutReturn", - "samlIDPMetaDataXML": {}, - "oidcStorageOptions": {}, - "cfgDate": 1519998069, - "samlAuthnContextMapPassword": 2, - "portalDisplayLoginHistory": 1, - "ldapPasswordResetAttributeValue": "TRUE", - "ldapServer": "%%ldapScheme://%%ldapServer", - "samlIDPSSODescriptorSingleLogoutServiceSOAP": "urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/singleLogoutSOAP;", - "samlIDPMetaDataExportedAttributes": null, - "samlServicePrivateKeyEnc": "", - "useRedirectOnForbidden": 0, - "captcha_login_enabled": 0, - "https": 0, - "checkXSS": 1, - "ldapSetPassword": 0, - "portalPingInterval": 60000, - "captchaStorageOptions": { - "Directory": "/var/lib/lemonldap-ng/captcha/" - }, - "useSafeJail": 1, - "registerDoneSubject": "[LemonLDAP::NG] Your new account", - "issuerDBCASRule": 1, - "samlAuthnContextMapKerberos": 4, - "ldapGroupAttributeNameSearch": "cn", - "logoutServices": {}, - "samlIDPSSODescriptorWantAuthnRequestsSigned": 1, - "portalDisplayLogout": 1, - "issuerDBGetParameters": {}, - "googleExportedVars": {}, - "openIdSreg_fullname": "cn", - "samlSPSSODescriptorAssertionConsumerServiceHTTPArtifact": "1;0;urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact;#PORTAL#/saml/proxySingleSignOnArtifact", - "demoExportedVars": { - "mail": "mail", - "uid": "uid", - "cn": "cn" - }, - "oidcOPMetaDataJSON": null, - "samlIdPResolveCookie": "lemonldapidp", - "samlRelayStateTimeout": 600, - "samlOrganizationURL": "https://auth.%%nom_domaine_local", - "globalStorageOptions": { - "Directory": "/var/lib/lemonldap-ng/sessions", - "LockDirectory": "/var/lib/lemonldap-ng/sessions/lock" - }, - "ldapExportedVars": { - "mail": "mail", - "cn": "cn", - "uid": "uid" - }, - "webIDExportedVars": {}, - "activeTimer": 1, - "cda": 0, - "samlServicePublicKeySig": "", -%if %%llCheckLogins == "oui" - "portalCheckLogins": 1, -%else - "portalCheckLogins": 0, -%end if - "CAS_authnLevel": 1, - "macros": { - "_whatToTrace": "$_auth eq 'SAML' ? \"$_user\\@$_idpConfKey\" : \"$_user\"" - }, - "samlIDPMetaDataOptions": null, - "twitterAuthnLevel": 1, - "openIdExportedVars": {}, - "captcha_register_enabled": 1, - "oidcOPMetaDataJWKS": null, - "webIDAuthnLevel": 1, - "issuerDBOpenIDActivation": "1", -%if %%is_empty(%%llResetUrl) - "mailUrl": "https://%%authWebName/mail.pl", -%else - "mailUrl": "%%llResetUrl", -%end if - "maintenance": 0, - "jsRedirect": 0, - "cfgAuthor": "Cadoles", - "persistentStorageOptions": { - "LockDirectory": "/var/lib/lemonldap-ng/psessions/lock", - "Directory": "/var/lib/lemonldap-ng/psessions" - }, - "SSLAuthnLevel": 5, - "oidcServiceMetaDataAuthnContext": {}, - "samlIDPSSODescriptorArtifactResolutionServiceArtifact": "1;0;urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/artifact", - "notification": 1, - "ldapChangePasswordAsUser": 0, - "CAS_proxiedServices": {}, - "key": "e\"bTCt3*eU9^\\V%b", - "portal": "https://%%authWebName/", - "singleSessionUserByIP": 0, - "portalOpenLinkInNewWindow": 0, - "post": { - "test2.%%nom_domaine_local": {}, - "test1.%%nom_domaine_local": {}, - "%%managerWebName": {} - }, - "samlSPSSODescriptorAssertionConsumerServiceHTTPPost": "0;1;urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST;#PORTAL#/saml/proxySingleSignOnPost", - "issuerDBSAMLRule": 1, - "samlCommonDomainCookieActivation": 0, - "syslog": "", - "ldapBase": "%%ldapUserBaseDN", - "ldapAuthnLevel": 2, - "mailTimeout": 0, - "samlEntityID": "#PORTAL#/saml/metadata", - "oidcOPMetaDataOptions": null, - "samlSPSSODescriptorWantAssertionsSigned": 1, - "samlOrganizationName": "%%samlOrganizationName", -%if %%RegisterDB == "Custom" - "registerUrl": "%%llRegisterURL", -%else - "registerUrl": "https://%%authWebName/register.pl", -%end if - "casAccessControlPolicy": "none", - "multiValuesSeparator": ";", - "ldapPort": %%ldapServerPort -}