diff --git a/dicos/70_lemonldap_ng.xml b/dicos/70_lemonldap_ng.xml index bfede2a..6aaf053 100644 --- a/dicos/70_lemonldap_ng.xml +++ b/dicos/70_lemonldap_ng.xml @@ -2,16 +2,18 @@ - - - - + + + + + + - lemonldap-ng-fastcgi-server + lemonldap-ng-fastcgi-server 80 443 @@ -76,6 +78,14 @@ + + non + lemonng + + + non + lemona2 + manager. nom_domaine_local @@ -103,7 +113,8 @@ non - lemon + lemonng + lemona2 lemonCAS LemonLDAP saLemon diff --git a/dicos/71_eolesso_compat.xml b/dicos/71_eolesso_compat.xml new file mode 100644 index 0000000..750c356 --- /dev/null +++ b/dicos/71_eolesso_compat.xml @@ -0,0 +1,206 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + ldapUserBaseDN + + + ldapServerPort + + + + + + + + + + diff --git a/posttemplate/70-lemon-nginx b/posttemplate/70-lemon-nginx index 6b32fa8..bc28e6f 100755 --- a/posttemplate/70-lemon-nginx +++ b/posttemplate/70-lemon-nginx @@ -1,17 +1,29 @@ #!/bin/bash ENABLE=$(CreoleGet activerLemon 'non') -CONF_FILES="manager-nginx.conf" -CONF_FILES="${CONF_FILES} handler-nginx.conf" -CONF_FILES="${CONF_FILES} portal-nginx.conf" -CONF_FILES="${CONF_FILES} test-nginx.conf" +if [ "$(CreoleGet activer_nginx_web non)" = 'oui' ];then + SERVER=nginx +else + SERVER=apache2 +fi -for CONF_FILE in ${CONF_FILES} +SERVICES="manager" +SERVICES="${SERVICES} handler" +SERVICES="${SERVICES} portal" + +for SERVICE in ${SERVICES} do - if [ -L /etc/nginx/sites-enabled/${CONF_FILE} ];then - rm /etc/nginx/sites-enabled/${CONF_FILE} + if [ -L /etc/nginx/sites-enabled/${SERVICE}-nginx.conf ];then + rm /etc/nginx/sites-enabled/${SERVICE}-nginx.conf + fi + if [ -L /etc/apache2/sites-enabled/${SERVICE}-apache2.conf ];then + a2dissite ${SERVICE}-apache2 fi if [ "${ENABLE}" = 'oui' ];then - ln -s /etc/nginx/sites-available/${CONF_FILE} /etc/nginx/sites-enabled/${CONF_FILE} + if [ "${SERVER}" = 'nginx' ];then + ln -s /etc/nginx/sites-available/${SERVICE}-nginx.conf /etc/nginx/sites-enabled/${SERVICE}-nginx.conf + elif [ "${SERVER}" = 'apache2' ];then + a2ensite ${SERVICE}-apache2.conf + fi fi -done \ No newline at end of file +done diff --git a/tmpl/handler-apache2.X.conf b/tmpl/handler-apache2.X.conf new file mode 100644 index 0000000..38ef821 --- /dev/null +++ b/tmpl/handler-apache2.X.conf @@ -0,0 +1,73 @@ +#======================================================================== +# Apache configuration for LemonLDAP::NG Handler +#======================================================================== +# This file implements the reload virtualhost that permits to reload +# configuration without restarting server, and some common instructions. +# You need then to declare this vhost in reloadUrls (in the manager +# interface if this server doesn't host the manager itself): +# +# KEY : VALUE +# host-or-IP:port : http://reload.example.com/reload +# +# IMPORTANT: +# To protect applications, see test-apache.conf template in example files + +# Uncomment this if no previous NameVirtualHost declaration +#NameVirtualHost "*:80" + +# Load LemonLDAP::NG Handler +PerlOptions +GlobalRequest +PerlModule Lemonldap::NG::Handler + +# Common error page and security parameters +ErrorDocument 403 http://%%authWebName/?lmError=403 +ErrorDocument 404 http://%%authWebName/?lmError=404 +ErrorDocument 500 http://%%authWebName/?lmError=500 +ErrorDocument 502 http://%%authWebName/?lmError=502 +ErrorDocument 503 http://%%authWebName/?lmError=503 + + + ServerName %%reloadWebName + + # Configuration reload mechanism (only 1 per physical server is + # needed): choose your URL to avoid restarting Apache when + # configuration change + + = 2.3> + Require ip 127 ::1 + + + Order Deny,Allow + Deny from all + Allow from 127.0.0.0/8 ::1 + + SetHandler perl-script + PerlResponseHandler Lemonldap::NG::Handler->reload + + SSLEngine on + SSLCertificateFile %%apache_cert + SSLCertificateKeyFile %%server_key + SSLProtocol all -SSLv3 -SSLv2 + + # Uncomment this to activate status module + # + # = 2.3> + # Require ip 127 ::1 + # + # + # Order Deny,Allow + # Deny from all + # Allow from 127.0.0.0/8 ::1 + # + # SetHandler perl-script + # PerlResponseHandler Lemonldap::NG::Handler->status + # # You may have to uncomment the next directive to skip + # # an upper PerlHeaderParserHandler directive + # #PerlHeaderParserHandler Apache2::Const::DECLINED + # + + # Uncomment this if site if you use SSL only + #Header set Strict-Transport-Security 15768000 + + + diff --git a/tmpl/manager-apache2.X.conf b/tmpl/manager-apache2.X.conf new file mode 100644 index 0000000..1116730 --- /dev/null +++ b/tmpl/manager-apache2.X.conf @@ -0,0 +1,130 @@ +#==================================================================== +# Apache configuration for LemonLDAP::NG Manager +#==================================================================== + +# Uncomment this if no previous NameVirtualHost declaration +#NameVirtualHost "*:80" + +# Manager virtual host (manager.example.com) + + ServerName %%managerWebName + LogLevel notice + #ErrorLog ${APACHE_LOG_DIR}/lm_err.log + #CustomLog ${APACHE_LOG_DIR}/lm.log combined + + # FASTCGI CONFIGURATION + # --------------------- + + # 1) URI management + RewriteEngine on + + RewriteRule "^/$" "/psgi/manager-server.fcgi" [PT] + # For performances, you can delete the previous RewriteRule line after + # puttings html files: simply put the HTML results of differents modules + # (configuration, sessions, notifications) as manager.html, sessions.html, + # notifications.html and uncomment the 2 following lines: + # DirectoryIndex manager.html + # RewriteCond "%{REQUEST_FILENAME}" "!\.html$" + SSLEngine on + SSLCertificateFile %%apache_cert + SSLCertificateKeyFile %%server_key + SSLProtocol all -SSLv3 -SSLv2 + + # REST URLs + RewriteCond "%{REQUEST_FILENAME}" "!^/(?:static|doc|fr-doc|lib|javascript|favicon).*" + RewriteRule "^/(.+)$" "/psgi/manager-server.fcgi/$1" [PT] + + Alias /psgi/ /usr/share/lemonldap-ng/manager/psgi// + + # 2) FastCGI engine + + # You can choose any FastCGI system. Here is an example using mod_fcgid + # mod_fcgid configuration + FcgidMaxRequestLen 2000000 + + SetHandler fcgid-script + Options +ExecCGI + + + # If you want to use mod_fastcgi, replace lines below by: + #FastCgiServer /usr/share/lemonldap-ng/manager/psgi/manager-server.fcgi + + # Or if you prefer to use CGI, use /psgi/manager-server.cgi instead of + # /psgi/manager-server.fcgi and adapt the rewrite rules. + + # GLOBAL CONFIGURATION + # -------------------- + + DocumentRoot /usr/share/lemonldap-ng/manager/ + + + = 2.3> + Require all granted + + + Order Deny,Allow + Allow from all + + Options +FollowSymLinks + + + AddOutputFilterByType DEFLATE text/html text/plain text/xml text/javascript text/css + SetOutputFilter DEFLATE + BrowserMatch ^Mozilla/4 gzip-only-text/html + BrowserMatch ^Mozilla/4\.0[678] no-gzip + BrowserMatch \bMSIE !no-gzip !gzip-only-text/html + SetEnvIfNoCase Request_URI \.(?:gif|jpe?g|png)$ no-gzip dont-vary + + + Header append Vary User-Agent env=!dont-vary + + + + # Static files (javascripts, HTML forms,...) + + Alias /static/ /usr/share/lemonldap-ng/manager/static// + + = 2.3> + Require all granted + + + Order Deny,Allow + Allow from all + + Options +FollowSymLinks + + + # On-line documentation + Alias /doc/ /usr/share/doc/lemonldap-ng-doc/ + Alias /lib/ /usr/share/doc/lemonldap-ng-doc/pages/documentation/current/lib/ + + = 2.3> + Require all granted + + + Order Deny,Allow + Allow from all + + ErrorDocument 404 /notfound.html + Options +FollowSymLinks + DirectoryIndex index.html start.html + + + # French version (needs fr-doc installation) + Alias /fr-doc/ /usr/share/doc/lemonldap-ng-fr-doc/ + + = 2.3> + Require all granted + + + Order Deny,Allow + Allow from all + + ErrorDocument 404 /notfoundfr.html + Options +FollowSymLinks + DirectoryIndex index.html start.html + + + # Uncomment this if site if you use SSL only + #Header set Strict-Transport-Security 15768000 + diff --git a/tmpl/portal-apache2.X.conf b/tmpl/portal-apache2.X.conf new file mode 100644 index 0000000..de30f87 --- /dev/null +++ b/tmpl/portal-apache2.X.conf @@ -0,0 +1,161 @@ +#==================================================================== +# Apache configuration for LemonLDAP::NG Portal +#==================================================================== + +# Uncomment this if no previous NameVirtualHost declaration +#NameVirtualHost "*:80" + +# Portal Virtual Host (auth.example.com) + + ServerName %%authWebName + + # DocumentRoot + DocumentRoot /var/lib/lemonldap-ng/portal/ + + = 2.3> + Require all granted + + + Order Deny,Allow + Allow from all + + Options +ExecCGI +FollowSymLinks + + SSLEngine on + SSLCertificateFile %%apache_cert + SSLCertificateKeyFile %%server_key + SSLProtocol all -SSLv3 -SSLv2 + + # Perl script + + SetHandler perl-script + PerlResponseHandler ModPerl::Registry + #CGIPassAuth on + + + + DirectoryIndex index.pl index.html + + + # SOAP functions for sessions management (disabled by default) + + = 2.3> + Require all denied + + + Order Deny,Allow + Deny from all + + + + # SOAP functions for sessions access (disabled by default) + + = 2.3> + Require all denied + + + Order Deny,Allow + Deny from all + + + + # SOAP functions for configuration access (disabled by default) + + = 2.3> + Require all denied + + + Order Deny,Allow + Deny from all + + + + # SOAP functions for notification insertion (disabled by default) + + = 2.3> + Require all denied + + + Order Deny,Allow + Deny from all + + + + # SAML2 Issuer + + RewriteEngine On + RewriteRule ^/saml/metadata /metadata.pl + RewriteRule ^/saml/.* /index.pl + + + # CAS Issuer + + RewriteEngine On + RewriteRule ^/cas/.* /index.pl + + + # OpenID Issuer + + RewriteEngine On + RewriteRule ^/openidserver/.* /index.pl + + + # OpenID Connect Issuer + + RewriteEngine On + #RewriteCond %{HTTP:Authorization} . + #RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] + RewriteRule ^/oauth2/.* /index.pl + RewriteRule ^/.well-known/openid-configuration$ /openid-configuration.pl + + + # Get Issuer + + RewriteEngine On + RewriteRule ^/get/.* /index.pl + + + # Public pages + + RewriteEngine On + RewriteRule ^/public* /public.pl + + + + + AddOutputFilterByType DEFLATE text/html text/plain text/xml text/javascript text/css + SetOutputFilter DEFLATE + BrowserMatch ^Mozilla/4 gzip-only-text/html + BrowserMatch ^Mozilla/4\.0[678] no-gzip + BrowserMatch \bMSIE !no-gzip !gzip-only-text/html + SetEnvIfNoCase Request_URI \.(?:gif|jpe?g|png)$ no-gzip dont-vary + + + Header append Vary User-Agent env=!dont-vary + + + + + ExpiresActive On + ExpiresDefault "access plus 1 month" + + + + # Uncomment this if site if you use SSL only + #Header set Strict-Transport-Security 15768000 + + +############################################## +## Best performance under ModPerl::Registry ## +############################################## + +# Uncomment this to increase performance of Portal: + + #require Lemonldap::NG::Portal::SharedConf; + #Lemonldap::NG::Portal::SharedConf->compile( + # qw(delete header cache read_from_client cookie redirect unescapeHTML)); + # Uncomment this line if you use Lemonldap::NG menu + #require Lemonldap::NG::Portal::Menu; + # Uncomment this line if you use portal SOAP capabilities + #require SOAP::Lite; +