First commit

This commit is contained in:
Philippe Caseiro 2018-03-02 15:44:00 +01:00
parent 54cfa10c7a
commit 4eb5b96a70
14 changed files with 1558 additions and 1 deletions

27
Makefile Normal file
View File

@ -0,0 +1,27 @@
################################
# Makefile pour XXX-XXX
################################
SOURCE=eole-lemonldap
VERSION=0.1
EOLE_VERSION=2.6
EOLE_RELEASE=2.6.2
PKGAPPS=non
#FLASK_MODULE=<APPLICATION>
################################
# Début de zone à ne pas éditer
################################
include eole.mk
include apps.mk
################################
# Fin de zone à ne pas éditer
################################
# Makefile rules dedicated to application
# if exists
ifneq (, $(strip $(wildcard $(SOURCE).mk)))
include $(SOURCE).mk
endif

View File

@ -1,3 +1,15 @@
# eole-lemonldap # eole-lemonldap
Intégration LemonLDAP::NG pour EOLE Intégration LemonLDAP::NG pour EOLE
## Howto
* Add the lemonldap-ng deb respository we need the last version of LemonLDAP.
Gen_config -> Mode Expert -> Dépôts tiers -> Libellé du dépôt
*# LemonLDAP::NG repository
deb https://lemonldap-ng.org/deb stable main
deb-src https://lemonldap-ng.org/deb stable main
Key URL : https://lemonldap-ng.org/_media/rpm-gpg-key-ow2

64
apps.mk Normal file
View File

@ -0,0 +1,64 @@
#
# NE PAS EDITER CE FICHIER
#
# Voir Makefile
##########################
# Application web envole #
##########################
ifneq (, $(filter oui web, $(PKGAPPS)))
#
# Sanity check
#
ifeq (, $(filter-out X.X, $(strip $(VERSION))))
$(error $$(VERSION) variable has incorrect value '$(VERSION)')
endif
# Where to store web application files
WEB_PATH := $(DESTDIR)/var/www/html
# Envole
sharenvole_PROG_DIR := $(DESTDIR)/usr/share/envole/$(SOURCE)
src_$(SOURCE)-$(VERSION)_REC_DIR := $(WEB_PATH)/$(SOURCE)
src_plugins-$(VERSION)_REC_DIR := $(WEB_PATH)/$(SOURCE)/plugin
src_lang-$(VERSION)_REC_DIR := $(WEB_PATH)/$(SOURCE)/lang
endif
##########################
# Application EOLE flask #
##########################
ifneq (, $(filter flask, $(PKGAPPS)))
#
# Sanity check
#
ifeq (, $(filter-out XXX, $(strip $(FLASK_MODULE))))
$(error $$(FLASK_MODULE) variable has incorrect value '$(FLASK_MODULE)')
endif
ifeq (, $(strip $(wildcard src/$(FLASK_MODULE).conf)))
$(error missing eoleflask configuration file 'src/$(FLASK_MODULE).conf')
endif
# Everything is related to mount point
APPS_MOUNT_POINT := $(shell sed -ne 's|^"MOUNT_POINT"[[:space:]]*:[[:space:]]*"/\([^"]*\)",|\1|p' \
src/$(FLASK_MODULE).conf)
ifeq (, $(strip $(APPS_MOUNT_POINT)))
$(error no "MOUNT_POINT" in eoleflask configuration file 'src/$(FLASK_MODULE).conf')
endif
# eole-flask configuration
src_DATA_DIR := $(DESTDIR)/etc/eole/flask/available
# Where to store flask application files
FLASK_PATH := $(eole_DIR)/flask/$(APPS_MOUNT_POINT)
# static files
src_$(FLASK_MODULE)_static_REC_DIR := $(FLASK_PATH)/static
src_$(FLASK_MODULE)_templates_REC_DIR := $(FLASK_PATH)/templates
src_$(FLASK_MODULE)_instance_REC_DIR := $(FLASK_PATH)/resources
endif

42
dicos/70_lemonldap_ng.xml Normal file
View File

@ -0,0 +1,42 @@
<?xml version="1.0" encoding="utf-8"?>
<creole>
<files>
<!-- Je suis un commentaire -->
<file filelist='lemon' name='/etc/nginx/sites-available/http_lemon.conf' source='market.nginx' mkdir='True' rm='True'/>
<service_access service='nginx'>
<port service_accesslist="saLemon">80</port>
<port service_accesslist="saLemon">443</port>
</service_access>
</files>
<variables>
<family name='Services'>
<variable name='activerLemon' type='oui/non' description="Activer l'hébergement d'une place de marché HTTP ">
<value>non</value>
</variable>
</family>
<family name='Lemon-LDAP-NG'>
<variable name='managerWebName' type='string' description="Nom DNS du manager LemonLDAP-NG"/>
<variable name='authWebName' type='string' description="Nom DNS du service d'authentification LemonLDAP-NG"/>
<value>/srv/one/market</value>
</variable>
</family>
</variables>
<constraints>
<fill name='concat' target='managerWebName'>
<param type='eole'>nom_machine</param>
<param>.</param>
<param type='eole'>nom_domaine_local</param>
</fill>
<condition name='disabled_if_in' source='activerLemon'>
<param>non</param>
<target type='filelist'>lemon</target>
<target type='family'>Lemon-LDAP-NG</target>
<target type='service_accesslist'>saLemon</target>
</condition>
</constraints>
<help>
<variable name='activer_http_lemon'>Activer l'hébergement d'une place de marché HTTP pour OpenNebula</variable>
<variable name='managerWebName'>Nom DNS de l'application de gestion de LemonLDAP-NG ex:manager.cadoles.com</variable>
<variable name='authWebName'>Nom DNS de l'application de gestion de LemonLDAP-NG ex:manager.cadoles.com</variable>
</help>
</creole>

231
eole.mk Normal file
View File

@ -0,0 +1,231 @@
#
# NE PAS EDITER CE FICHIER
#
# Utiliser <appli>.mk à inclure à la fin de Makefile
#################
# Sanity checks #
#################
ifeq (, $(DESTDIR))
$(warning $$(DESTDIR) is empty, installation will be done in /)
endif
ifeq (, $(filter-out XXX-XXX, $(strip $(SOURCE))))
$(error $$(SOURCE) variable has incorrect value '$(SOURCE)')
endif
ifeq (, $(filter-out 2.X, $(strip $(EOLE_VERSION))))
$(error $$(EOLE_VERSION) variable has incorrect value '$(EOLE_VERSION)')
endif
ifeq (, $(filter-out 2.X.Y, $(strip $(EOLE_RELEASE))))
$(error $$(EOLE_RELEASE) variable has incorrect value '$(EOLE_RELEASE)')
endif
#########################
# Variables definitions #
#########################
INSTALL := install
INSTALL_DATA := install -m 644
INSTALL_PROGRAM := install -m 755
INSTALL_DIRECTORY := install -m 755 -d
INSTALL_RECURSIVE := cp -dr --no-preserve=ownership
# Standard path
bin_PROG_DIR := $(DESTDIR)/usr/bin
sbin_PROG_DIR := $(DESTDIR)/usr/sbin
man8_DATA_DIR := $(DESTDIR)/usr/share/man/fr.UTF-8/man8
# Base
eole_DIR := $(DESTDIR)/usr/share/eole
ifeq ($(strip $(EOLE_VERSION)), 2.3)
diagnose_PROG_DIR := $(eole_DIR)/diagnose/module
else
diagnose_PROG_DIR := $(eole_DIR)/diagnose/
endif
# Creole
creole_DIR := $(eole_DIR)/creole
dicos_DATA_DIR := $(creole_DIR)/dicos
tmpl_DATA_DIR := $(creole_DIR)/distrib
preservice_PROG_DIR := $(eole_DIR)/preservice
pretemplate_PROG_DIR := $(eole_DIR)/pretemplate
posttemplate_PROG_DIR := $(eole_DIR)/posttemplate
postservice_PROG_DIR := $(eole_DIR)/postservice
ifeq ($(strip $(EOLE_VERSION)), 2.3)
firewall_DATA_DIR := $(eole_DIR)/firewall
endif
bacula_restore_DATA_DIR := $(eole_DIR)/bacula/restore
bareos_restore_DATA_DIR := $(eole_DIR)/bareos/restore
bacula_fichier_DATA_DIR := $(DESTDIR)/etc/bacula/baculafichiers.d
bareos_fichier_DATA_DIR := $(DESTDIR)/etc/bareos/bareosfichiers.d
ifeq ($(strip $(EOLE_VERSION)), 2.3)
schedule_pre_PROG_DIR := $(eole_DIR)/schedule/pre
schedule_post_PROG_DIR := $(eole_DIR)/schedule/post
else
schedule_scripts_PROG_DIR := $(eole_DIR)/schedule/scripts
endif
extra_REC_DIR := $(creole_DIR)/extra
# Zéphir
zephir_DATA_DIR := $(DESTDIR)/usr/share/zephir
zephir_configs_DATA_DIR := $(zephir_DATA_DIR)/monitor/configs
zephir_srv_DATA_DIR := $(zephir_configs_DATA_DIR)/services
zephir_scripts_PROG_DIR := $(zephir_DATA_DIR)/scripts
# SSO
sso_DATA_DIR := $(DESTDIR)/usr/share/sso
sso_filtres_DATA_DIR := $(sso_DATA_DIR)/app_filters
sso_user-info_DATA_DIR := $(sso_DATA_DIR)/user_infos
# EAD
ead_DATA_DIR := $(DESTDIR)/usr/share/ead2/backend/config
ead_actions_DATA_DIR := $(ead_DATA_DIR)/actions
ead_perms_DATA_DIR := $(ead_DATA_DIR)/perms
ead_roles_DATA_DIR := $(ead_DATA_DIR)/roles
# Program libraries goes under /usr/lib/<PROGRAM>/
lib_$(SOURCE)_DATA_DIR := $(DESTDIR)/usr/lib/$(SOURCE)
# Scripts Eole
scripts_PROG_DIR := $(eole_DIR)/sbin
lib_eole_DATA_DIR := $(DESTDIR)/usr/lib/eole
# LDAP
ldap_passwords_DATA_DIR := $(eole_DIR)/annuaire/password_files
# LXC
lxc_DATA_DIR := $(eole_DIR)/lxc
lxc_fstab_DATA_DIR := $(lxc_DATA_DIR)/fstab
lxc_hosts_DATA_DIR := $(lxc_DATA_DIR)/hosts
# SQL
sql_DATA_DIR := $(eole_DIR)/mysql/$(SOURCE)
sql_gen_DATA_DIR := $(sql_DATA_DIR)/gen
sql_updates_DATA_DIR := $(sql_DATA_DIR)/updates
sql_conf_gen_DATA_DIR := $(eole_DIR)/applications/gen
sql_conf_passwords_DATA_DIR := $(eole_DIR)/applications/passwords
sql_conf_updates_DATA_DIR := $(eole_DIR)/applications/updates/$(SOURCE)
# EoleDB sql directory
db_DIR := $(eole_DIR)/db
db_gen_DATA_DIR := $(eole_DIR)/db/$(SOURCE)/gen
db_updates_DATA_DIR := $(eole_DIR)/db/$(SOURCE)/updates
# Certifs
certs_DATA_DIR := $(eole_DIR)/certs
# Logrotate
logrotate_DATA_DIR := $(DESTDIR)/etc/logrotate.d
# Cron
cron_PROG_DIR := $(DESTDIR)/etc/cron.daily
# Python modules
ifneq ($(DESTDIR),)
PYTHON_OPTS := --root $(DESTDIR)
endif
# Translation
TRANSLATION_SRC := translation
TRANSLATION_DEST := $(DESTDIR)/usr/share/locale
PO_FILES = $(wildcard $(TRANSLATION_SRC)/*/*.po)
MO_FOLDERS = $(addprefix $(TRANSLATION_DEST), $(addsuffix LC_MESSAGES,$(subst $(TRANSLATION_SRC),,$(dir $(PO_FILES)))))
#############################################
# Common directories and files installation #
#############################################
all:
$(MO_FOLDERS):
$(INSTALL_DIRECTORY) $@
$(PO_FILES): $(MO_FOLDERS)
msgfmt -o $(TRANSLATION_DEST)$(subst $(TRANSLATION_SRC),,$(addsuffix LC_MESSAGES,$(dir $@)))/$(notdir $(@:.po=.mo)) $@
install-lang: $(PO_FILES)
install:: install-dirs install-files install-lang
# $1 = command to run
# $2 = source directory
# $3 = destination directory
define fc_install_file
if [ -d $2 ]; then \
for file in `ls -1 $2/`; do \
$1 $2/$$file $3 || true; \
done; \
fi
endef
##
## Directory creation
##
# use % to catch local name in $*
# data, program and recursive directory require a corresponding
# directory in local sources
%_DATA_DIR %_PROG_DIR %REC_DIR:
test ! -d $(subst _,/,$*) || $(INSTALL_DIRECTORY) $($@)
# Create the directory referenced by the variable without a local one.
%_DIR:
@: # do nothing
##
## Install files present directly under data, program and recursive directories
##
# $* : name of variable
# $($*): value of variable
%-instdata:
$(call fc_install_file, $(INSTALL_DATA), $(subst _,/,$(subst _DATA_DIR,,$*)), $($*))
%-instprog:
$(call fc_install_file, $(INSTALL_PROGRAM), $(subst _,/,$(subst _PROG_DIR,,$*)), $($*))
%-instrec:
$(call fc_install_file, $(INSTALL_RECURSIVE), $(subst _,/,$(subst _REC_DIR,,$*)), $($*))
# Use second expansion as variables may be created in included
# Makefiles
.SECONDEXPANSION:
# List of all directories
installdirs_LIST = $(foreach V, $(filter %_DIR, $(.VARIABLES)), \
$(if $(filter file, $(origin $(V))), \
$(V)))
# List of data directories
installdata_LIST = $(filter %_DATA_DIR, $(installdirs_LIST))
# List of program directories
installprog_LIST = $(filter %_PROG_DIR, $(installdirs_LIST))
# List of recursive directories
installrec_LIST = $(filter %_REC_DIR, $(installdirs_LIST))
# Expand directories to create as dependency
# Use double-colon to permit user to define additionnal install-dirs
install-dirs:: $$(installdirs_LIST)
# Expand files to install as dependency
# Use double-colon to permit user to define additionnal install-files
install-files:: install-data-files install-prog-files install-rec-dirs
install-data-files: $$(patsubst %,%-instdata,$$(installdata_LIST))
install-prog-files: $$(patsubst %,%-instprog,$$(installprog_LIST))
install-rec-dirs: $$(patsubst %,%-instrec,$$(installrec_LIST))
# Installation of python modules
ifeq ($(shell test -f setup.py && echo 0), 0)
install-files::
python setup.py install --no-compile --install-layout=deb $(PYTHON_OPTS)
endif
.PHONY: install install-dirs install-files install-data-files install-prog-files install-rec-dirs

48
tmpl/handler-nginx.conf Normal file
View File

@ -0,0 +1,48 @@
#=======================================================================
# Nginx configuration for LemonLDAP::NG Handler
#=======================================================================
# This file implements the reload virtualhost that permits to reload
# configuration without restarting server.
# You need then to declare this vhost in reloadUrls (in the manager
# interface if this server doesn't host the manager itself):
#
# KEY : VALUE
# host-or-IP:port : http://reload.example.com/reload
#
# IMPORTANT:
# To protect applications, see test-nginx.conf template in example files
# Log format
include /etc/lemonldap-ng/nginx-lmlog.conf;
#access_log /var/log/nginx/access.log lm_combined;
server {
listen 80;
server_name reload.example.com;
root /var/www/html;
location = /reload {
allow 127.0.0.1;
deny all;
include /etc/nginx/fastcgi_params;
fastcgi_pass unix:/var/run/llng-fastcgi-server/llng-fastcgi.sock;
fastcgi_param LLTYPE reload;
}
# Client requests
location / {
deny all;
# Uncomment this if you use https only
#add_header Strict-Transport-Security "15768000";
}
# Uncomment this if status is enabled
#location = /status {
# allow 127.0.0.1;
# deny all;
# include /etc/nginx/fastcgi_params;
# fastcgi_pass unix:/var/run/llng-fastcgi-server/llng-fastcgi.sock;
# fastcgi_param LLTYPE status;
#}
}

284
tmpl/lemonldap-ng.ini Normal file
View File

@ -0,0 +1,284 @@
;==============================================================================
; LemonLDAP::NG local configuration parameters
;
; This file is dedicated to configuration parameters override
; You can set here configuration parameters that will be used only by
; local LemonLDAP::NG elements
;
; Section "all" is always read first before "portal", "handler"
; and "manager"
;
; Section "configuration" is used to load global configuration and set cache
; (replace old storage.conf file)
;
; Section "apply" is read by Manager to reload handlers
; (replace old apply.conf file)
;
; Other section are only read by the specific LemonLDAP::NG component
;==============================================================================
[all]
; CUSTOM FUNCTION
; If you want to create customFunctions in rules, declare them here:
;customFunctions = function1 function2
;customFunctions = Package::func1 Package::func2
; CROSS-DOMAIN
; If you have some handlers that are not registered on the main domain,
; uncomment this
;cda = 1
; SAFE JAIL
; Uncomment this to disable Safe jail.
; Warning: this can allow malicious code in custom functions or rules
;useSafeJail = 0
[configuration]
; GLOBAL CONFIGURATION ACCESS TYPE
; (File, SOAP, RDBI/CDBI, LDAP)
; Set here the parameters needed to access to LemonLDAP::NG configuration.
; You have to set "type" to one of the followings :
;
; * File: you have to set 'dirName' parameter. Example:
;
; type = File
; dirName = /var/lib/lemonldap-ng/conf
;
; * RDBI/CDBI : you have to set 'dbiChain' (required) and 'dbiUser' and 'dbiPassword'
; if needed. Example:
;
; type = RDBI
; ;type = CDBI
; dbiChain = DBI:mysql:database=lemonldap-ng;host=1.2.3.4
; dbiUser = lemonldap
; dbiPassword = password
;
; * SOAP: SOAP configuration access is a sort of proxy: the portal is
; configured to use the real session storage type (DBI or File for
; example).
; You have to set 'proxy' parameter. Example:
;
; type = SOAP
; proxy = https://auth.example.com/index.pl/config
; proxyOptions = { timeout => 5 }
; User = lemonldap
; Password = mypassword
;
; * LDAP: you have to set ldapServer, ldapConfBase, ldapBindDN and ldapBindPassword.
;
; type = LDAP
; ldapServer = ldap://localhost
; ldapConfBase = ou=conf,ou=applications,dc=example,dc=com
; ldapBindDN = cn=manager,dc=example,dc=com
; ldapBindPassword = secret
; ldapObjectClass = applicationProcess
; ldapAttributeId = cn
; ldapAttributeContent = description
type=File
dirName = /var/lib/lemonldap-ng/conf
; LOCAL CACHE CONFIGURATION
;
; To increase performances, use a local cache for the configuration. You have
; to choose a Cache::Cache module and set its parameters. Example:
;
; localStorage = Cache::FileCache
; localStorageOptions={ \
; 'namespace' => 'lemonldap-ng-config',\
; 'default_expires_in' => 600, \
; 'directory_umask' => '007', \
; 'cache_root' => '/tmp', \
; 'cache_depth' => 0, \
; }
localStorage=Cache::FileCache
localStorageOptions={ \
'namespace' => 'lemonldap-ng-config',\
'default_expires_in' => 600, \
'directory_umask' => '007', \
'cache_root' => '/tmp', \
'cache_depth' => 0, \
}
[portal]
; PERFORMANCES
; By setting useLocalConf, Portal will use only local cached configuration
; To refresh it, you must have an handler on the same server or you have to
; restart your server. This increase performances
;useLocalConf = 1
; PORTAL CUSTOMIZATION
; Name of the skin
;portalSkin = pastel
; Modules displayed
;portalDisplayLogout = 1
;portalDisplayResetPassword = 1
;portalDisplayChangePassword = 1
;portalDisplayAppslist = 1
;portalDisplayLoginHistory = 1
; Require the old password when changing password
;portalRequireOldPassword = 1
; Attribute displayed as connected user
;portalUserAttr = mail
; Old menu HTML code
; Enable it if you use old templates
;useOldMenuItems=1
; Override error codes
;error_0 = You are well authenticated!
; Custom template parameters
; For example to use <TMPL_VAR NAME="myparam">
;tpl_myparam = test
; LOG
; By default, all is logged in Apache file. To log user actions by
; syslog, just set syslog facility here:
;syslog = auth
; SOAP FUNCTIONS
; Remove comment to activate SOAP Functions getCookies(user,pwd) and
; error(language, code)
;Soap = 1
; Note that getAttibutes() will be activated but on a different URI
; (http://auth.example.com/index.pl/sessions)
; You can also restrict attributes and macros exported by getAttributes
;exportedAttr = uid mail
; PASSWORD POLICY
; Remove comment to use LDAP Password Policy
;ldapPpolicyControl = 1
; Remove comment to store password in session (use with caution)
;storePassword = 1
; Remove comment to use LDAP modify password extension
; (beware of compatibility with LDAP Password Policy)
;ldapSetPassword = 1
; RESET PASSWORD BY MAIL
; SMTP server (default to localhost), set to '' to use default mail service
;SMTPServer = localhost
; SMTP auth user
;SMTPAuthUser = toto
; SMTP auth password
;SMTPAuthPass = secret
; Mail From address
;mailFrom = noreply@example.com
; Reply To
;mailReplyTo = noreply@example.com
; Mail confirmation URL
;mailUrl = http://reset.example.com
; Mail subject for confirmation message
;mailConfirmSubject = [LemonLDAP::NG] Password reset confirmation
; Mail body for confiramtion (can use $url for confirmation URL, and other session
; infos, like $cn). Keep comment to use HTML templates
;mailConfirmBody = Hello $cn,\n\nClick here to receive your new password: $url
; Mail subject for new password message
;mailSubject = [LemonLDAP::NG] Your new password
; Mail body for new password (can use $password for generated password, and other session
; infos, like $cn). Keep comment to use HTML templates
;mailBody = Hello $cn,\n\nYour new password is $password
; LDAP filter to use
;mailLDAPFilter = '(&(mail=$mail)(objectClass=inetOrgPerson))'
; Random regexp for password generation
;randomPasswordRegexp = [A-Z]{3}[a-z]{5}.\d{2}
; LDAP GROUPS
; Set the base DN of your groups branch
;ldapGroupBase = ou=groups,dc=example,dc=com
; Objectclass used by groups
;ldapGroupObjectClass = groupOfUniqueNames
; Attribute used by groups to store member
;ldapGroupAttributeName = uniqueMember
; Attribute used by user to link to groups
;ldapGroupAttributeNameUser = dn
; Attribute used to identify a group. The group will be displayed as
; cn|mail|status, where cn, mail and status will be replaced by their
; values.
;ldapGroupAttributeNameSearch = cn mail
; NOTIFICATIONS SERVICE
; Use it to be able to notify messages during authentication
;notification = 1
; Note that the SOAP function newNotification will be activated on
; http://auth.example.com/index.pl/notification
; If you want to hide this, just protect "/index.pl/notification" in
; your Apache configuration file
; XSS protection bypass
; By default, the portal refuse redirections that comes from sites not
; registered in the configuration (manager) except for those coming
; from trusted domains. By default, trustedDomains contains the domain
; declared in the manager. You can set trustedDomains to empty value so
; that, undeclared sites will be rejected. You can also set here a list
; of trusted domains or hosts separated by spaces. This is usefull if
; your website use LemonLDAP::NG without handler with SOAP functions.
;trustedDomains = my.trusted.host example2.com
; Check XSS
; Set to 0 to disable error on XSS attack detection
;checkXSS = 0
[handler]
; Handler cache configuration
; You can overwrite here local session cache settings in manager:
; localSessionStorage=Cache::FileCache
; localSessionStorageOptions={ \
; 'namespace' => 'lemonldap-ng-sessions', \
; 'default_expires_in' => 600, \
; 'directory_umask' => '007', \
; 'cache_root' => '/tmp', \
; 'cache_depth' => 3, \
; }
; Set https to 1 if your handler protect a https website (used only for
; redirections to the portal)
;https = 0
; Set port if your your hanlder protect a website on a non standard port
; - 80 for http, 443 for https (used only for redirections to the portal)
;port = 8080
; Set status to 1 if you want to have the report of activity (used for
; example to inform MRTG)
status = 0
; Set useRedirectOnForbidden to 1 if you want to use REDIRECT and not FORBIDDEN
; when a user is not allowed by Handler
;useRedirectOnForbidden = 1
; Hide LemonLDAP::NG Handler in Apache Server Signature
;hideSignature = 1
useRedirectOnError = 1
; Zimbra Handler parameters
;zimbraPreAuthKey = XXXX
;zimbraAccountKey = uid
;zimbraBy =id
;zimbraUrl = /service/preauth
;zimbraSsoUrl = ^/zimbrasso$
[manager]
; Manager protection: by default, the manager is protected by a demo account.
; You can protect it :
; * by Apache itself,
; * by the parameter 'protection' which can take one of the following
; values :
; * authenticate : all authenticated users can access
; * manager : manager is protected like other virtual hosts: you
; have to set rules in the corresponding virtual host
; * <rule> : you can set here directly the rule to apply
; * none : no protection
protection = manager
; logLevel. Set here one of error, warn, notice, info or debug
logLevel = warn
; staticPrefix: relative (or URL) location of static HTML components
staticPrefix = /static
;
; location of HTML templates directory
templateDir = /usr/share/lemonldap-ng/manager/templates
; languages: available languages for manager interface
languages = fr, en
; Manager modules enabled
; Set here the list of modules you want to see in manager interface
; The first will be used as default module displayed
enabledModules = conf, sessions, notifications

167
tmpl/lmConf-1.js Normal file
View File

@ -0,0 +1,167 @@
{
"applicationList" : {
"1sample" : {
"catname" : "Sample applications",
"test1" : {
"options" : {
"description" : "A simple application displaying authenticated user",
"display" : "auto",
"logo" : "demo.png",
"name" : "Application Test 1",
"uri" : "http://test1.example.com/"
},
"type" : "application"
},
"test2" : {
"options" : {
"description" : "The same simple application displaying authenticated user",
"display" : "auto",
"logo" : "thumbnail.png",
"name" : "Application Test 2",
"uri" : "http://test2.example.com/"
},
"type" : "application"
},
"type" : "category"
},
"2administration" : {
"catname" : "Administration",
"manager" : {
"options" : {
"description" : "Configure LemonLDAP::NG WebSSO",
"display" : "auto",
"logo" : "configure.png",
"name" : "WebSSO Manager",
"uri" : "http://manager.example.com/manager.html"
},
"type" : "application"
},
"notifications" : {
"options" : {
"description" : "Explore WebSSO notifications",
"display" : "auto",
"logo" : "database.png",
"name" : "Notifications explorer",
"uri" : "http://manager.example.com/notifications.html"
},
"type" : "application"
},
"sessions" : {
"options" : {
"description" : "Explore WebSSO sessions",
"display" : "auto",
"logo" : "database.png",
"name" : "Sessions explorer",
"uri" : "http://manager.example.com/sessions.html"
},
"type" : "application"
},
"type" : "category"
},
"3documentation" : {
"catname" : "Documentation",
"localdoc" : {
"options" : {
"description" : "Documentation supplied with LemonLDAP::NG",
"display" : "on",
"logo" : "help.png",
"name" : "Local documentation",
"uri" : "http://manager.example.com/doc/"
},
"type" : "application"
},
"officialwebsite" : {
"options" : {
"description" : "Official LemonLDAP::NG Website",
"display" : "on",
"logo" : "network.png",
"name" : "Offical Website",
"uri" : "http://lemonldap-ng.org/"
},
"type" : "application"
},
"type" : "category"
}
},
"authentication" : "Demo",
"cfgAuthor" : "The LemonLDAP::NG team",
"cfgNum" : 1,
"cookieName" : "lemonldap",
"demoExportedVars" : {
"cn" : "cn",
"mail" : "mail",
"uid" : "uid"
},
"domain" : "example.com",
"exportedHeaders" : {
"test1.example.com" : {
"Auth-User" : "$uid"
},
"test2.example.com" : {
"Auth-User" : "$uid"
}
},
"exportedVars" : {
"UA" : "HTTP_USER_AGENT"
},
"globalStorage" : "Apache::Session::File",
"globalStorageOptions" : {
"Directory" : "/var/lib/lemonldap-ng/sessions",
"LockDirectory" : "/var/lib/lemonldap-ng/sessions/lock",
"generateModule" : "Lemonldap::NG::Common::Apache::Session::Generate::SHA256"
},
"groups" : {},
"localSessionStorage" : "Cache::FileCache",
"localSessionStorageOptions" : {
"cache_depth" : 3,
"cache_root" : "/tmp",
"default_expires_in" : 600,
"directory_umask" : "007",
"namespace" : "lemonldap-ng-sessions"
},
"locationRules" : {
"manager.example.com" : {
"(?#Configuration)^/(manager\\.html|conf/)" : "$uid eq \"dwho\"",
"(?#Notifications)/notifications" : "$uid eq \"dwho\" or $uid eq \"rtyler\"",
"(?#Sessions)/sessions" : "$uid eq \"dwho\" or $uid eq \"rtyler\"",
"default" : "$uid eq \"dwho\""
},
"test1.example.com" : {
"^/logout" : "logout_sso",
"default" : "accept"
},
"test2.example.com" : {
"^/logout" : "logout_sso",
"default" : "accept"
}
},
"loginHistoryEnabled" : 1,
"macros" : {
"_whatToTrace" : "$_auth eq 'SAML' ? \"$_user\\@$_idpConfKey\" : \"$_user\""
},
"mailUrl" : "http://auth.example.com/mail.pl",
"notification" : 1,
"notificationStorage" : "File",
"notificationStorageOptions" : {
"dirName" : "/var/lib/lemonldap-ng/notifications"
},
"passwordDB" : "Demo",
"persistentStorage" : "Apache::Session::File",
"persistentStorageOptions" : {
"Directory" : "/var/lib/lemonldap-ng/psessions",
"LockDirectory" : "/var/lib/lemonldap-ng/psessions/lock"
},
"portal" : "http://auth.example.com/",
"portalSkin" : "bootstrap",
"portalSkinBackground" : "1280px-Cedar_Breaks_National_Monument_partially.jpg",
"registerDB" : "Demo",
"registerUrl" : "http://auth.example.com/register.pl",
"reloadUrls" : {
"reload.example.com" : "http://reload.example.com/reload"
},
"securedCookie" : 0,
"sessionDataToRemember" : {},
"timeout" : 72000,
"userDB" : "Demo",
"whatToTrace" : "_whatToTrace"
}

386
tmpl/lmConf-9.json Normal file
View File

@ -0,0 +1,386 @@
{
"ldapGroupAttributeNameUser": "dn",
"cfgAuthorIP": "172.16.0.1",
"samlSPMetaDataXML": null,
"facebookAuthnLevel": 1,
"mailConfirmSubject": "[LemonLDAP::NG] Password reset confirmation",
"secureTokenAttribute": "uid",
"singleSession": 0,
"registerConfirmSubject": "[LemonLDAP::NG] Account register confirmation",
"CAS_pgtFile": "/tmp/pgt.txt",
"cookieName": "lemonldap",
"slaveExportedVars": {},
"whatToTrace": "_whatToTrace",
"oidcRPMetaDataOptions": {},
"notifyDeleted": 1,
"useRedirectOnError": 1,
"samlSPMetaDataExportedAttributes": null,
"ldapPwdEnc": "utf-8",
"openIdSPList": "0;",
"samlNameIDFormatMapEmail": "mail",
"samlSPMetaDataOptions": null,
"issuerDBOpenIDRule": 1,
"casStorageOptions": {},
"mailFrom": "noreply@%%nom_domaine_local",
"timeoutActivity": 0,
"oidcRPMetaDataExportedVars": {},
"issuerDBSAMLActivation": 0,
"issuerDBCASPath": "^/cas/",
"randomPasswordRegexp": "[A-Z]{3}[a-z]{5}.\\d{2}",
"samlIDPSSODescriptorSingleSignOnServiceSOAP": "urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/singleSignOnSOAP;",
"samlSPSSODescriptorSingleLogoutServiceHTTPPost": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST;#PORTAL#/saml/proxySingleLogout;#PORTAL#/saml/proxySingleLogoutReturn",
"exportedHeaders": {
"test1.%%nom_domaine_local": {
"Auth-User": "$uid"
},
"test2.%%nom_domaine_local": {
"Auth-User": "$uid"
},
"manager.%%nom_domaine_local": {}
},
"vhostOptions": {
"manager.%%nom_domaine_local": {},
"test1.%%nom_domaine_local": {},
"test2.%%nom_domaine_local": {}
},
"radiusAuthnLevel": 3,
"dbiAuthnLevel": 2,
"ldapPasswordResetAttribute": "pwdReset",
"ldapGroupObjectClass": "groupOfNames",
"apacheAuthnLevel": 4,
"samlNameIDFormatMapKerberos": "uid",
"groups": {},
"securedCookie": 0,
"httpOnly": 1,
"yubikeyAuthnLevel": 3,
"ADPwdMaxAge": 0,
"samlUseQueryStringSpecific": 0,
"loginHistoryEnabled": 1,
"samlSPSSODescriptorSingleLogoutServiceSOAP": "urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/proxySingleLogoutSOAP;",
"failedLoginNumber": 5,
"samlServicePrivateKeyEncPwd": "",
"portalForceAuthnInterval": 0,
"cfgLog": "",
"samlIDPSSODescriptorSingleLogoutServiceHTTPRedirect": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect;#PORTAL#/saml/singleLogout;#PORTAL#/saml/singleLogoutReturn",
"exportedVars": {
"UA": "HTTP_USER_AGENT"
},
"notificationStorage": "File",
"applicationList": {
"1sample": {
"test2": {
"options": {
"name": "Application Test 2",
"logo": "thumbnail.png",
"uri": "http://test2.%%nom_domaine_local/",
"display": "auto",
"description": "The same simple application displaying authenticated user"
},
"type": "application"
},
"type": "category",
"catname": "Sample applications",
"test1": {
"type": "application",
"options": {
"description": "A simple application displaying authenticated user",
"uri": "http://test1.%%nom_domaine_local/",
"logo": "demo.png",
"display": "auto",
"name": "Application Test 1"
}
}
},
"2administration": {
"notifications": {
"options": {
"name": "Notifications explorer",
"display": "auto",
"description": "Explore WebSSO notifications",
"uri": "http://manager.%%nom_domaine_local/notifications.pl",
"logo": "database.png"
},
"type": "application"
},
"manager": {
"options": {
"uri": "http://manager.%%nom_domaine_local/",
"display": "auto",
"description": "Configure LemonLDAP::NG WebSSO",
"logo": "configure.png",
"name": "WebSSO Manager"
},
"type": "application"
},
"type": "category",
"sessions": {
"type": "application",
"options": {
"description": "Explore WebSSO sessions",
"uri": "http://manager.%%nom_domaine_local/sessions.pl",
"logo": "database.png",
"display": "auto",
"name": "Sessions explorer"
}
},
"catname": "Administration"
},
"3documentation": {
"catname": "Documentation",
"officialwebsite": {
"type": "application",
"options": {
"name": "Offical Website",
"description": "Official LemonLDAP::NG Website",
"logo": "network.png",
"display": "on",
"uri": "http://lemonldap-ng.org/"
}
},
"type": "category",
"localdoc": {
"options": {
"logo": "help.png",
"description": "Documentation supplied with LemonLDAP::NG",
"display": "on",
"uri": "http://manager.%%nom_domaine_local/doc/",
"name": "Local documentation"
},
"type": "application"
}
}
},
"userControl": "^[\\w\\.\\-@]+$",
"timeout": 72000,
"portalAntiFrame": 1,
"SMTPServer": "",
"ldapTimeout": 120,
"samlAuthnContextMapPasswordProtectedTransport": 3,
"ldapUsePasswordResetAttribute": 1,
"ldapPpolicyControl": 0,
"casAttributes": {},
"issuerDBSAMLPath": "^/saml/",
"samlAttributeAuthorityDescriptorAttributeServiceSOAP": "urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/AA/SOAP;",
"portalDisplayAppslist": 1,
"confirmFormMethod": "post",
"domain": "%%nom_domaine_local",
"cfgNum": "9",
"authentication": "LDAP",
"samlNameIDFormatMapWindows": "uid",
"authChoiceModules": {},
"ldapGroupAttributeName": "member",
"samlServicePrivateKeySigPwd": "",
"googleAuthnLevel": 1,
"successLoginNumber": 5,
"localSessionStorageOptions": {
"cache_root": "/tmp",
"namespace": "lemonldap-ng-sessions",
"default_expires_in": 600,
"directory_umask": "007",
"cache_depth": 3
},
"samlSPSSODescriptorArtifactResolutionServiceArtifact": "1;0;urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/artifact",
"portalRequireOldPassword": 1,
"samlIDPSSODescriptorSingleSignOnServiceHTTPArtifact": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact;#PORTAL#/saml/singleSignOnArtifact;",
"ADPwdExpireWarning": 0,
"yubikeyPublicIDSize": 12,
"ldapGroupAttributeNameGroup": "dn",
"oidcRPMetaDataOptionsExtraClaims": null,
"ldapGroupRecursive": 0,
"mailSubject": "[LemonLDAP::NG] Your new password",
"nginxCustomHandlers": {},
"samlSPSSODescriptorAuthnRequestsSigned": 1,
"portalDisplayResetPassword": 1,
"openIdSreg_timezone": "_timezone",
"infoFormMethod": "get",
"openIdAuthnLevel": 1,
"openIdSreg_nickname": "uid",
"samlServicePublicKeyEnc": "",
"userDB": "LDAP",
"grantSessionRules": {},
"remoteGlobalStorage": "Lemonldap::NG::Common::Apache::Session::SOAP",
"reloadUrls": {
"reload.%%nom_domaine_local": "http://reload.%%nom_domaine_local/reload"
},
"registerTimeout": 0,
"samlIDPSSODescriptorSingleSignOnServiceHTTPPost": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST;#PORTAL#/saml/singleSignOn;",
"slaveAuthnLevel": 2,
"samlIDPSSODescriptorSingleLogoutServiceHTTPPost": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST;#PORTAL#/saml/singleLogout;#PORTAL#/saml/singleLogoutReturn",
"Soap": 1,
"registerDB": "Demo",
"locationRules": {
"manager.%%nom_domaine_local": {
"default": "$uid eq \"dwho\""
},
"test1.%%nom_domaine_local": {
"default": "accept",
"^/logout": "logout_sso"
},
"test2.%%nom_domaine_local": {
"default": "accept",
"^/logout": "logout_sso"
}
},
"portalDisplayChangePassword": "$_auth =~ /^(LDAP|DBI|Demo)$/",
"hideOldPassword": 0,
"managerPassword": "ohc7kei8lil8Zoesai5chisaiGhu5Yaisai6kaegh9aingai0pae8ohb",
"authChoiceParam": "lmAuth",
"lwpSslOpts": {},
"portalSkinRules": {},
"issuerDBOpenIDPath": "^/openidserver/",
"redirectFormMethod": "get",
"portalDisplayRegister": 1,
"secureTokenMemcachedServers": "127.0.0.1:11211",
"notificationStorageOptions": {
"dirName": "/var/lib/lemonldap-ng/notifications"
},
"browserIdAuthnLevel": 1,
"portalUserAttr": "_user",
"ldapVersion": 3,
"sessionDataToRemember": {},
"samlNameIDFormatMapX509": "mail",
"managerDn": "cn=reader,o=gouv,c=fr",
"mailSessionKey": "mail",
"openIdSreg_email": "mail",
"localSessionStorage": "Cache::FileCache",
"persistentStorage": "Apache::Session::File",
"mailOnPasswordChange": 0,
"captchaStorage": "Apache::Session::File",
"remoteGlobalStorageOptions": {
"proxy": "http://auth.%%nom_domaine_local/index.pl/sessions",
"ns": "http://auth.%%nom_domaine_local/Lemonldap/NG/Common/CGI/SOAPService"
},
"passwordDB": "LDAP",
"captcha_size": 6,
"mailCharset": "utf-8",
"facebookExportedVars": {},
"nullAuthnLevel": 2,
"singleIP": 0,
"dbiExportedVars": {},
"portalSkin": "bootstrap",
"storePassword": 0,
"hiddenAttributes": "_password",
"samlServicePrivateKeySig": "",
"globalStorage": "Apache::Session::File",
"notificationWildcard": "allusers",
"portalForceAuthn": 0,
"samlMetadataForceUTF8": 1,
"secureTokenUrls": ".*",
"secureTokenAllowOnError": 1,
"samlAuthnContextMapTLSClient": 5,
"ldapAllowResetExpiredPassword": 0,
"oidcOPMetaDataExportedVars": {},
"notifyOther": 0,
"secureTokenExpiration": 60,
"captcha_mail_enabled": 0,
"samlStorageOptions": {},
"samlOrganizationDisplayName": "Example",
"trustedProxies": "",
"secureTokenHeader": "Auth-Token",
"issuerDBCASActivation": 1,
"samlIDPSSODescriptorSingleSignOnServiceHTTPRedirect": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect;#PORTAL#/saml/singleSignOn;",
"samlSPSSODescriptorSingleLogoutServiceHTTPRedirect": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect;#PORTAL#/saml/proxySingleLogout;#PORTAL#/saml/proxySingleLogoutReturn",
"samlIDPMetaDataXML": {},
"oidcStorageOptions": {},
"cfgDate": 1519998069,
"samlAuthnContextMapPassword": 2,
"portalDisplayLoginHistory": 1,
"ldapPasswordResetAttributeValue": "TRUE",
"ldapServer": "%%ldapScheme://%%ldapServer",
"samlIDPSSODescriptorSingleLogoutServiceSOAP": "urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/singleLogoutSOAP;",
"samlIDPMetaDataExportedAttributes": null,
"samlServicePrivateKeyEnc": "",
"useRedirectOnForbidden": 0,
"captcha_login_enabled": 0,
"https": 0,
"checkXSS": 1,
"ldapSetPassword": 0,
"portalPingInterval": 60000,
"captchaStorageOptions": {
"Directory": "/var/lib/lemonldap-ng/captcha/"
},
"useSafeJail": 1,
"registerDoneSubject": "[LemonLDAP::NG] Your new account",
"issuerDBCASRule": 1,
"samlAuthnContextMapKerberos": 4,
"ldapGroupAttributeNameSearch": "cn",
"logoutServices": {},
"samlIDPSSODescriptorWantAuthnRequestsSigned": 1,
"portalDisplayLogout": 1,
"issuerDBGetParameters": {},
"googleExportedVars": {},
"openIdSreg_fullname": "cn",
"samlSPSSODescriptorAssertionConsumerServiceHTTPArtifact": "1;0;urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact;#PORTAL#/saml/proxySingleSignOnArtifact",
"demoExportedVars": {
"mail": "mail",
"uid": "uid",
"cn": "cn"
},
"oidcOPMetaDataJSON": null,
"samlIdPResolveCookie": "lemonldapidp",
"samlRelayStateTimeout": 600,
"samlOrganizationURL": "http://www.%%nom_domaine_local",
"globalStorageOptions": {
"Directory": "/var/lib/lemonldap-ng/sessions",
"LockDirectory": "/var/lib/lemonldap-ng/sessions/lock"
},
"ldapExportedVars": {
"mail": "mail",
"cn": "cn",
"uid": "uid"
},
"webIDExportedVars": {},
"activeTimer": 1,
"cda": 0,
"samlServicePublicKeySig": "",
"portalCheckLogins": 1,
"CAS_authnLevel": 1,
"macros": {
"_whatToTrace": "$_auth eq 'SAML' ? \"$_user\\@$_idpConfKey\" : \"$_user\""
},
"samlIDPMetaDataOptions": null,
"twitterAuthnLevel": 1,
"openIdExportedVars": {},
"captcha_register_enabled": 1,
"oidcOPMetaDataJWKS": null,
"webIDAuthnLevel": 1,
"issuerDBOpenIDActivation": "1",
"mailUrl": "http://auth.%%nom_domaine_local/mail.pl",
"maintenance": 0,
"jsRedirect": 0,
"cfgAuthor": "dwho",
"persistentStorageOptions": {
"LockDirectory": "/var/lib/lemonldap-ng/psessions/lock",
"Directory": "/var/lib/lemonldap-ng/psessions"
},
"SSLAuthnLevel": 5,
"oidcServiceMetaDataAuthnContext": {},
"samlIDPSSODescriptorArtifactResolutionServiceArtifact": "1;0;urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/artifact",
"notification": 1,
"ldapChangePasswordAsUser": 0,
"CAS_proxiedServices": {},
"key": "e\"bTCt3*eU9^\\V%b",
"portal": "http://auth.%%nom_domaine_local/",
"singleSessionUserByIP": 0,
"portalOpenLinkInNewWindow": 0,
"post": {
"test2.%%nom_domaine_local": {},
"test1.%%nom_domaine_local": {},
"manager.%%nom_domaine_local": {}
},
"samlSPSSODescriptorAssertionConsumerServiceHTTPPost": "0;1;urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST;#PORTAL#/saml/proxySingleSignOnPost",
"issuerDBSAMLRule": 1,
"samlCommonDomainCookieActivation": 0,
"syslog": "",
"ldapBase": %%ldapUserBaseDN,
"ldapAuthnLevel": 2,
"mailTimeout": 0,
"samlEntityID": "#PORTAL#/saml/metadata",
"oidcOPMetaDataOptions": null,
"samlSPSSODescriptorWantAssertionsSigned": 1,
"samlOrganizationName": "%%samlOrganizationName",
"registerUrl": "http://auth.%%nom_domaine_local/register.pl",
"casAccessControlPolicy": "none",
"multiValuesSeparator": ";",
"ldapPort": %%ldapServerPort
}

63
tmpl/manager-nginx.conf Normal file
View File

@ -0,0 +1,63 @@
server {
listen 80;
server_name manager.%%nom_domaine_local;
return 301 https://$host$request_uri;
}
server {
listen 443;
ssl on;
ssl_certificate %%server_cert;
ssl_certificate_key %%server_key;
ssl_client_certificate /etc/ssl/certs/ca.crt;
access_log /var/log/nginx/manager-lemon-ldap.access-ssl.log;
server_name manager.%%nom_domaine_local;
error_page 403 404 502 503 504 /nginx.html;
location = /nginx.html{
root /usr/share/nginx/www;
}
if ($uri !~ ^/(manager\.psgi|static|doc|fr-doc|lib|javascript|favicon)) {
rewrite ^/(.*)$ /manager.psgi/$1 break;
}
location /manager.psgi {
include /etc/nginx/fastcgi_params;
fastcgi_pass unix:/var/run/llng-fastcgi-server/llng-fastcgi.sock;
fastcgi_param LLTYPE manager;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_split_path_info ^(.*\.psgi)(/.*)$;
fastcgi_param PATH_INFO $fastcgi_path_info;
# Uncomment this if you use https only
#add_header Strict-Transport-Security "15768000";
}
location / {
index manager.psgi;
allow 127.0.0.0/8;
deny all;
try_files $uri $uri/ =404;
}
location /doc/ {
alias /usr/share/doc/lemonldap-ng-doc/;
index index.html start.html;
}
location /lib/ {
alias /usr/share/doc/lemonldap-ng-doc/pages/documentation/current/lib/;
}
location /fr-doc/ {
alias /usr/share/doc/lemonldap-ng-fr-doc/;
index index.html start.html;
}
location /static/ {
alias /usr/share/lemonldap-ng/manager/static/;
}
# DEBIAN
# If install was made with USEDEBIANLIBS (official releases), uncomment this
#location /javascript/ {
# alias /usr/share/javascript/;
#}
}

3
tmpl/nginx-lmlog.conf Normal file
View File

@ -0,0 +1,3 @@
log_format lm_combined '$remote_addr - $lmremote_user [$time_local] '
'"$request" $status $body_bytes_sent '
'"$http_referer" "$http_user_agent"';

View File

@ -0,0 +1,34 @@
auth_request_set $headername1 $upstream_http_headername1;
auth_request_set $headervalue1 $upstream_http_headervalue1;
auth_request_set $headername2 $upstream_http_headername2;
auth_request_set $headervalue2 $upstream_http_headervalue2;
auth_request_set $headername3 $upstream_http_headername3;
auth_request_set $headervalue3 $upstream_http_headervalue3;
auth_request_set $headername4 $upstream_http_headername4;
auth_request_set $headervalue4 $upstream_http_headervalue4;
auth_request_set $headername5 $upstream_http_headername5;
auth_request_set $headervalue5 $upstream_http_headervalue5;
auth_request_set $headername6 $upstream_http_headername6;
auth_request_set $headervalue6 $upstream_http_headervalue6;
auth_request_set $headername7 $upstream_http_headername7;
auth_request_set $headervalue7 $upstream_http_headervalue7;
auth_request_set $headername8 $upstream_http_headername8;
auth_request_set $headervalue8 $upstream_http_headervalue8;
auth_request_set $headername9 $upstream_http_headername9;
auth_request_set $headervalue9 $upstream_http_headervalue9;
auth_request_set $headername10 $upstream_http_headername10;
auth_request_set $headervalue10 $upstream_http_headervalue10;
auth_request_set $lmcookie $upstream_http_cookie;
access_by_lua '
i = 1
ngx.req.set_header("Cookie",ngx.var.lmcookie)
while true do
if ngx.var["headername"..i] ~= nil then
ngx.req.set_header(ngx.var["headername"..i],ngx.var["headervalue"..i])
else
break
end
i = i +1
end
';

92
tmpl/portal-nginx.conf Normal file
View File

@ -0,0 +1,92 @@
server {
listen 80;
server_name auth.%%nom_domaine_local;
return 301 https://$host$request_uri;
}
server {
listen 443;
ssl on;
ssl_certificate %%server_cert;
ssl_certificate_key %%server_key;
ssl_client_certificate /etc/ssl/certs/ca.crt;
access_log /var/log/nginx/auth-lemon-ldap.access-ssl.log;
server_name auth.%%nom_domaine_local;
root /var/lib/lemonldap-ng/portal/;
location ~ \.pl(?:$|/) {
include /etc/nginx/fastcgi_params;
fastcgi_pass unix:/var/run/llng-fastcgi-server/llng-fastcgi.sock;
fastcgi_param LLTYPE cgi;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
set $sn $request_uri;
if ($sn ~ "^(.*)\?") {
set $sn $1;
}
if ($sn ~ "^/index.pl") {
set $sn "/index.pl";
}
fastcgi_param SCRIPT_NAME $sn;
fastcgi_split_path_info ^(.*\.pl)(/.*)$;
fastcgi_param PATH_INFO $fastcgi_path_info;
# Uncomment this if you use Auth SSL:
#map $ssl_client_s_dn $ssl_client_s_dn_cn {
# default "";
# ~/CN=(?<CN>[^/]+) $CN;
#}
#fastcgi_param SSL_CLIENT_S_DN_CN $ssl_client_s_dn_cn
}
index index.pl;
location / {
try_files $uri $uri/ =404;
# Uncomment this if you use https only
#add_header Strict-Transport-Security "15768000";
}
# SOAP functions for sessions management (disabled by default)
location /index.pl/adminSessions {
deny all;
}
# SOAP functions for sessions access (disabled by default)
location /index.pl/sessions {
deny all;
}
# SOAP functions for configuration access (disabled by default)
location /index.pl/config {
deny all;
}
# SOAP functions for notification insertion (disabled by default)
location /index.pl/notification {
deny all;
}
# SAML2 Issuer
rewrite ^/saml/metadata /metadata.pl last;
rewrite ^/saml/.* /index.pl last;
# CAS Issuer
rewrite ^/cas/.* /index.pl;
# OpenID Issuer
rewrite ^/openidserver/.* /index.pl last;
# OpenID Connect Issuer
rewrite ^/oauth2/.* /index.pl last;
rewrite ^/.well-known/openid-configuration$ /openid-configuration.pl last;
# Get Issuer
rewrite ^/get/.* /index.pl;
# Public pages
rewrite ^/public.* /public.pl;
# DEBIAN
# If install was made with USEDEBIANLIBS (official releases), uncomment this
#location /javascript/ {
# alias /usr/share/javascript/;
#}
}

104
tmpl/test-nginx.conf Normal file
View File

@ -0,0 +1,104 @@
server {
listen 80;
server_name test1.%%nom_domaine_local test2.%%nom_domaine_local;
return 301 https://$host$request_uri;
}
server {
listen 443;
ssl on;
ssl_certificate %%server_cert;
ssl_certificate_key %%server_key;
ssl_client_certificate /etc/ssl/certs/ca.crt;
access_log /var/log/nginx/test1-2-lemon-ldap.access-ssl.log;
server_name test1.%%nom_domaine_local test2.%%nom_domaine_local;
root /var/lib/lemonldap-ng/test/;
# Internal authentication request
location = /lmauth {
internal;
include /etc/nginx/fastcgi_params;
fastcgi_pass unix:/var/run/llng-fastcgi-server/llng-fastcgi.sock;
# To use AuthBasic handler, uncomment this and remove "error_page 401"
# fastcgi_param LLTYPE authbasic;
# Drop post datas
fastcgi_pass_request_body off;
fastcgi_param CONTENT_LENGTH "";
# Keep original hostname
fastcgi_param HOST $http_host;
# Keep original request (LLNG server will received /llauth)
fastcgi_param X_ORIGINAL_URI $request_uri;
}
# Client requests
location / {
# Local application
index index.pl;
try_files $uri $uri/ =404;
# Reverse proxy
#proxy_pass http://remote.server/;
#include /etc/nginx/proxy_params;
##################################
# CALLING AUTHENTICATION #
##################################
auth_request /lmauth;
auth_request_set $lmremote_user $upstream_http_lm_remote_user;
auth_request_set $lmlocation $upstream_http_location;
# Uncomment this if CDA is used
#auth_request_set $cookie_value $upstream_http_set_cookie;
#add_header Set-Cookie $cookie_value;
# Remove this for AuthBasic handler
error_page 401 $lmlocation;
##################################
# PASSING HEADERS TO APPLICATION #
##################################
# IF LUA IS SUPPORTED
#include /etc/lemonldap-ng/nginx-lua-headers.conf;
# ELSE
# Set manually your headers
#auth_request_set $authuser $upstream_http_auth_user;
#proxy_set_header Auth-User $authuser;
# OR in the correspondinc block
#fastcgi_param HTTP_AUTH_USER $authuser;
# Then (if LUA not supported), change cookie header to hide LLNG cookie
#auth_request_set $lmcookie $upstream_http_cookie;
#proxy_set_header Cookie: $lmcookie;
# OR in the corresponding block
#fastcgi_param HTTP_COOKIE $lmcookie;
# Uncomment this if you use https only
#add_header Strict-Transport-Security "15768000";
# Set REMOTE_USER (for FastCGI apps only)
#fastcgi_param REMOTE_USER $lmremote_user;
}
# Handle test CGI
location ~ \.pl$ {
include /etc/nginx/fastcgi_params;
fastcgi_pass unix:/var/run/llng-fastcgi-server/llng-fastcgi.sock;
fastcgi_param LLTYPE cgi;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_split_path_info ^(.*\.pl)(/.+)$;
fastcgi_param REMOTE_USER $lmremote_user;
}
#location = /status {
# allow 127.0.0.1;
# deny all;
# include /etc/nginx/fastcgi_params;
# fastcgi_pass unix:/var/run/llng-fastcgi-server/llng-fastcgi.sock;
# fastcgi_param LLTYPE status;
#}
}