Merge branch 'master' into dist/eole/2.6.2/master

README.md

@@ -1,73 +1,16 @@
 # eole-lemonldap
 
-LemonLDAP::NG EOLE integration
+Intégration LemonLDAP::NG pour EOLE
 
 ## Howto
 
-### Repository configuration
-
 * Add the lemonldap-ng deb respository we need the last version of LemonLDAP.
 
-GenConfig -> Mode Expert -> Dépôts tiers -> Libellé du dépôt
+Gen_config -> Mode Expert -> Dépôts tiers -> Libellé du dépôt
 
-#### LemonLDAP::NG repository
+ ### LemonLDAP::NG repository
  
 * deb     https://lemonldap-ng.org/deb stable main
 * deb-src https://lemonldap-ng.org/deb stable main
 * Key URL : https://lemonldap-ng.org/_media/rpm-gpg-key-ow2 
 
-#### Cadoles Repository
-* deb [ arch=all  ] https://vulcain.cadoles.com 2.6.2-dev main
-* Key URL : https://vulcain.cadoles.com/cadoles.gpg
-
-### Install packages
-
-apt update
-apt install eole-lemonldap
-
-### Configure LemonLDAP in GenConfig
-
-* Enable lemonldap in "Services" tab
-
-Gen_Config -> Services ->  Activer LemonLDAP::NG -> "Oui"
-
-* Fill LemonLDAP configuration
-
-#### Nginx Web case
-
-By default NGINX is configured to serve "web" application, in this case the lemonLDAP::NG application will
-not be served properly, so we need to disable this function
-
-GenConfig -> Services -> Activer la publication d’applications web par Nginx -> "Non'
-
-#### Configuration DNS
-* GenConfig -> Lemonldap -> Nom DNS du manager LemonLDAP-NG
-* GenConfig -> Lemonldap -> Nom DNS du service d'authentification LemonLDAP-NG
-
-#### Configuration LDAP
-* GenConfig -> Lemonldap -> Protocole LDAP à utiliser
-* GenConfig -> Lemonldap -> Adresse du Serveur LDAP utilisé par LemonLDAP::NG
-* GenConfig -> Lemonldap -> Port d'écoute du LDAP utilisé par LemonLDAP::NG
-* GenConfig -> Lemonldap -> Base DN des utilisateurs dans l'annuaire
-* GenConfig -> Lemonldap -> Utilisateur de connection à l'annuaire (DN ex: cn=reader,o=gouv,c=fr)
-* GenConfig -> Lemonldap -> Mot de passe de l'utilisateur de connection à l'annuaire (file like /root/.reader or the clear password)
-
-#### Configuration CAS
-
-Add your CAS attributes mapping ( uid = uid and mail = mail are created by default)
-
-* GenConfig -> Lemonldap -> Nom de l'attribut CAS
-* GenConfig -> Lemonldap -> Attribut LDAP équivalent
-
-### SSL issues
-
-If you use "autosign" certificates you need to add the "manager" and "auth" service names to the alternative names.
-You also need to include "reload" service name (available in GenConfig -> Mode Expert -> Lemonldap -> Nom DNS du service Reload de LemonLDAP-NG)
-
-* GenConfig -> Mode Expert -> Certificats ssl -> Nom Alternatif de la machine (SubjectAltName)
-
-If you use "manual" certificates make sure this names are covered by your SSL Certificate
-
-If you use "letsencrypt" mode you also need to add this names to the let'sencrypt request:
-
-* GenConfig -> Mode Expert -> Certificat ssl -> Nom de domaines supplémentaires

creolefuncs/lemonldap.py

@@ -1,28 +0,0 @@
-# -*- coding: utf-8 -*-
-
-def toCidr(ip,mask=False):
-    """ Convert to CIDR notation
-        ip can be like this : 192.168.5.100/255.255.255.0
-        or you can provide the ip and the mask
-    """
-    from IPy import IP
-    try:
-        if mask:
-            data="{0}/{1}".format(ip,mask)
-        else:
-            data=ip
-        return str(IP(data))
-    except:
-        return data
-
-def readPass(encoder,reader):
-    try:
-        mypwdreader=open(reader, "r").readline().rstrip()
-        if encoder == "":
-            return mypwdreader
-        elif encoder == "base64":
-            import base64
-            return base64.b64encode(mypwdreader)
-
-    except:
-        return "mot de passe inconnu"

debian/compat

@@ -0,0 +1 @@
+9

debian/control

@@ -0,0 +1,18 @@
+Source: eole-lemonldap
+Section: web
+Priority: optional
+Maintainer: Cadoles <eole@ac-dijon.fr>
+Build-Depends: debhelper (>= 9)
+Standards-Version: 3.9.3
+Homepage: https://forge.cadoles.com/Cadoles/eole-lemonldap
+Vcs-Git: https://forge.cadoles.com/Cadoles/eole-lemonldap.git
+Vcs-Browser: https://forge.cadoles.com/Cadoles/eole-lemonldap
+
+Package: eole-lemonldap
+Architecture: all
+Depends: ${misc:Depends}, lemonldap-ng, lemonldap-ng-doc, lemonldap-ng-fr-doc, lemonldap-ng-fastcgi-server,
+   libxml-libxml-perl, libxml-libxslt-perl, libcgi-emulate-psgi-perl, libauthen-captcha-perl, liblasso-perl,
+   libxml-simple-perl, libcgi-compile-perl
+Description: Dictionnaires et templates pour la configuration d'un serveur LemonLDAP::NG, testée uniquement avec eolebase
+ .
+ Pour toute information complémentaire, veuillez vous rendre sur la forge Cadoles.

debian/copyright

@@ -0,0 +1,44 @@
+Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: {PROJECT}
+Source: {URL}
+
+Files: *
+Copyright: YEAR {UPSTREAM} {AUTHOR} <{MAIL}>
+License: {UPSTREAM LICENSE}
+
+Files: debian/*
+Copyright: 2012 Équipe EOLE <eole@ac-dijon.fr>
+License: CeCILL-2
+
+License: {UPSTREAM LICENSE}
+ {TEXT OF THE LICENSE}
+
+License: CeCILL-2
+ This software is governed by the CeCILL-2 license under French law and
+ abiding by the rules of distribution of free software.  You can  use,
+ modify and or redistribute the software under the terms of the CeCILL-2
+ license as circulated by CEA, CNRS and INRIA at the following URL
+ "http://www.cecill.info";.
+ .
+ As a counterpart to the access to the source code and  rights to copy,
+ modify and redistribute granted by the license, users are provided only
+ with a limited warranty  and the software's author,  the holder of the
+ economic rights,  and the successive licensors  have only  limited
+ liability.
+ .
+ In this respect, the user's attention is drawn to the risks associated
+ with loading,  using,  modifying and/or developing or reproducing the
+ software by the user in light of its specific status of free software,
+ that may mean  that it is complicated to manipulate,  and  that  also
+ therefore means  that it is reserved for developers  and  experienced
+ professionals having in-depth computer knowledge. Users are therefore
+ encouraged to load and test the software's suitability as regards their
+ requirements in conditions enabling the security of their systems and/or
+ data to be ensured and,  more generally, to use and operate it in the
+ same conditions as regards security.
+ .
+ The fact that you are presently reading this means that you have had
+ knowledge of the CeCILL-2 license and that you accept its terms.
+ .
+ On Eole systems, the complete text of the CeCILL-2 License can be found
+ in '/usr/share/common-licenses/CeCILL-2-en'.

debian/gbp.conf

@@ -0,0 +1,3 @@
+# Set per distribution debian tag
+[DEFAULT]
+debian-tag = debian/eole/%(version)s

debian/rules

@@ -0,0 +1,8 @@
+#!/usr/bin/make -f
+# -*- makefile -*-
+
+# Uncomment this to turn on verbose mode.
+#export DH_VERBOSE=1
+
+%:
+	dh $@

debian/source/format

@@ -0,0 +1 @@
+3.0 (native)

dicos/70_lemonldap_ng.xml

@@ -5,9 +5,7 @@
 		<file filelist='lemon' name='/etc/nginx/sites-available/manager-nginx.conf' mkdir='True' rm='True'/>
 		<file filelist='lemon' name='/etc/nginx/sites-available/handler-nginx.conf' mkdir='True' rm='True'/>
 		<file filelist='lemon' name='/etc/nginx/sites-available/portal-nginx.conf' mkdir='True' rm='True'/>
-		<file filelist='lemon' name='/etc/nginx/sites-available/test-nginx.conf' mkdir='True' rm='True'/>
 		<file filelist='lemon' name='/var/lib/lemonldap-ng/conf/lmConf-1.js' mkdir='True' rm='True'/>
-		<service>lemonldap-ng-fastcgi-server</service>
 		<service_access service='nginx'>
 			<port service_accesslist="saLemon">80</port>
 			<port service_accesslist="saLemon">443</port>
@@ -30,19 +28,10 @@
 			<variable name='ldapBindUserDN' type='string' description="Utilisateur de connection à l'annuaire" mandatory="True"/>
 			<variable name='ldapBindUserPassword' type='string' description="Mot de passe de l'utilisateur de connection à l'annuaire" mandatory="True"/>
 			<variable name="samlOrganizationName" type='string' description="Nom de l'organisation SAML" mode='expert'/>
-			<variable name="lemonAdmin" type='string' description="LemonLDAP Administrator username" mode='expert'>
-				<value>admin</value>
-			</variable>
-			<variable name="nginxBucketSize" type='number' description="Taille du hash des noms de serveur pour NGINX" mode='expert'>
-				<value>64</value>
-			</variable>
-			<variable name="casAttribute" description="Nom de l'attribut CAS" type="string" mode="expert" multi="True"/>
-			<variable name="casLDAPAttribute" description="Attribut LDAP équivalent" type="string" mode="expert"/>
 		</family>
         <separators>
 		    <separator name="managerWebName">Configuration DNS</separator>
 		    <separator name="ldapScheme">Configuration LDAP</separator>
-		    <separator name="casAttribute">Configuration CAS</separator>
 		</separators>
 	</variables>
 	<constraints>
@@ -65,9 +54,6 @@
 		<check name="valid_enum" target="ldapScheme">
 			<param>['ldaps','ldap']</param>
         </check>
-		<group master="casAttribute">
-			<slave>casLDAPAttribute</slave>
-		</group>
 		<condition name='disabled_if_in' source='activerLemon'>
 			<param>non</param>
 			<target type='filelist'>lemon</target>
@@ -79,7 +65,5 @@
 		<variable name='activerLemon'>Activer l'hébergement d'une place de marché HTTP pour OpenNebula</variable>
 		<variable name='managerWebName'>Nom DNS de l'application de gestion de LemonLDAP::NG ex:manager.cadoles.com</variable>
 		<variable name='authWebName'>Nom DNS de service d'authentification de LemonLDAP::NG ex:auth.cadoles.com</variable>
-		<variable name='ldapUserBaseDN'>DN de l'utilisateur de connection en lecture à l'annuaire (ex: cn=reader,o=gouv,c=fr)</variable>
-		<variable name='nginxBucketSize'>server_names_hash_bucket_size Taille du hash des noms de serveur pour NGINX</variable>
 	</help>
 </creole>

eole-lemonldap.mk

@@ -1 +0,0 @@
-creolefuncs_DATA_DIR := $(DESTDIR)/usr/share/creole/funcs

posttemplate/70-lemon-nginx

@@ -1,10 +1,9 @@
 #!/bin/bash
 
 ENABLE=$(CreoleGet activerLemon 'non')
-CONF_FILES="manager-nginx.conf"
+CONF_FILES='manager-nginx.conf'
-CONF_FILES="${CONF_FILES} handler-nginx.conf"
+CONF_FILES='${CONF_FILES} handler-nginx.conf'
-CONF_FILES="${CONF_FILES} portal-nginx.conf"
+CONF_FILES='${CONF_FILES} portal-nginx.conf'
-CONF_FILES="${CONF_FILES} test-nginx.conf"
 
 for CONF_FILE in ${CONF_FILES}
 do

tmpl/handler-nginx.conf

@@ -12,10 +12,6 @@
 # IMPORTANT:
 # To protect applications, see test-nginx.conf template in example files
 
-%if %%getVar("revprox_hash_bucket_size", "non") == "non"
-server_names_hash_bucket_size %%nginxBucketSize;
-%end if
-
 # Log format
 include /etc/lemonldap-ng/nginx-lmlog.conf;
 #access_log /var/log/nginx/access.log lm_combined;
@@ -48,9 +44,6 @@ server {
 
   location = /reload {
     allow 127.0.0.1;
-%for ipaddr in %%ip_ssh_eth0
-    allow %%toCidr(%%ipaddr, %%ipaddr.netmask_ssh_eth0);
-%end for
     deny all;
     include /etc/nginx/fastcgi_params;
     fastcgi_pass unix:/var/run/llng-fastcgi-server/llng-fastcgi.sock;

tmpl/lmConf-1.js

@@ -72,7 +72,7 @@
                 "options": {
                     "name": "Application Test 2",
                     "logo": "thumbnail.png",
-                    "uri": "https://test2.%%nom_domaine_local/",
+                    "uri": "http://test2.%%nom_domaine_local/",
                     "display": "auto",
                     "description": "The same simple application displaying authenticated user"
                 },
@@ -84,7 +84,7 @@
                 "type": "application",
                 "options": {
                     "description": "A simple application displaying authenticated user",
-                    "uri": "https://test1.%%nom_domaine_local/",
+                    "uri": "http://test1.%%nom_domaine_local/",
                     "logo": "demo.png",
                     "display": "auto",
                     "name": "Application Test 1"
@@ -143,7 +143,7 @@
                     "logo": "help.png",
                     "description": "Documentation supplied with LemonLDAP::NG",
                     "display": "on",
-                    "uri": "https://%%managerWebName/doc/",
+                    "uri": "http://%%managerWebName/doc/",
                     "name": "Local documentation"
                 },
                 "type": "application"
@@ -158,19 +158,13 @@
     "samlAuthnContextMapPasswordProtectedTransport": 3,
     "ldapUsePasswordResetAttribute": 1,
     "ldapPpolicyControl": 0,
-    "casAttributes": {
+    "casAttributes": {},
-        "uid":"uid",
-%for att in %%casAttribute
-        "%%att": "%%att.casLDAPAttribute",
-%end for
-        "mail":"mail"
-    },
     "issuerDBSAMLPath": "^/saml/",
     "samlAttributeAuthorityDescriptorAttributeServiceSOAP": "urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/AA/SOAP;",
     "portalDisplayAppslist": 1,
     "confirmFormMethod": "post",
     "domain": "%%nom_domaine_local",
-    "cfgNum": "1",
+    "cfgNum": "9",
     "authentication": "LDAP",
     "samlNameIDFormatMapWindows": "uid",
     "authChoiceModules": {},
@@ -206,7 +200,7 @@
     "grantSessionRules": {},
     "remoteGlobalStorage": "Lemonldap::NG::Common::Apache::Session::SOAP",
     "reloadUrls": {
-        "%%reloadWebName": "https://%%reloadWebName/reload"
+        "%%reloadWebName": "http://%%reloadWebName/reload"
     },
     "registerTimeout": 0,
     "samlIDPSSODescriptorSingleSignOnServiceHTTPPost": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST;#PORTAL#/saml/singleSignOn;",
@@ -216,7 +210,7 @@
     "registerDB": "Demo",
     "locationRules": {
         "%%managerWebName": {
-            "default": "$uid eq \"%%lemonAdmin\""
+            "default": "$uid eq \"dwho\""
         },
         "test1.%%nom_domaine_local": {
             "default": "accept",
@@ -229,11 +223,7 @@
     },
     "portalDisplayChangePassword": "$_auth =~ /^(LDAP|DBI|Demo)$/",
     "hideOldPassword": 0,
-%if %%is_file(%%ldapBindUserPassword)
-    "managerPassword": "%%readPass("", %%ldapBindUserPassword)",
-%else
     "managerPassword": "%%ldapBindUserPassword",
-%end if
     "authChoiceParam": "lmAuth",
     "lwpSslOpts": {},
     "portalSkinRules": {},
@@ -257,8 +247,8 @@
     "mailOnPasswordChange": 0,
     "captchaStorage": "Apache::Session::File",
     "remoteGlobalStorageOptions": {
-        "proxy": "https://%%authWebName/index.pl/sessions",
+        "proxy": "http://%%authWebName/index.pl/sessions",
-        "ns": "https://%%authWebName/Lemonldap/NG/Common/CGI/SOAPService"
+        "ns": "http://%%authWebName/Lemonldap/NG/Common/CGI/SOAPService"
     },
     "passwordDB": "LDAP",
     "captcha_size": 6,
@@ -329,7 +319,7 @@
     "oidcOPMetaDataJSON": null,
     "samlIdPResolveCookie": "lemonldapidp",
     "samlRelayStateTimeout": 600,
-    "samlOrganizationURL": "https://auth.%%nom_domaine_local",
+    "samlOrganizationURL": "http://www.%%nom_domaine_local",
     "globalStorageOptions": {
         "Directory": "/var/lib/lemonldap-ng/sessions",
         "LockDirectory": "/var/lib/lemonldap-ng/sessions/lock"
@@ -355,10 +345,10 @@
     "oidcOPMetaDataJWKS": null,
     "webIDAuthnLevel": 1,
     "issuerDBOpenIDActivation": "1",
-    "mailUrl": "https://%%authWebName/mail.pl",
+    "mailUrl": "http://%%authWebName/mail.pl",
     "maintenance": 0,
     "jsRedirect": 0,
-    "cfgAuthor": "Cadoles",
+    "cfgAuthor": "dwho",
     "persistentStorageOptions": {
         "LockDirectory": "/var/lib/lemonldap-ng/psessions/lock",
         "Directory": "/var/lib/lemonldap-ng/psessions"
@@ -370,7 +360,7 @@
     "ldapChangePasswordAsUser": 0,
     "CAS_proxiedServices": {},
     "key": "e\"bTCt3*eU9^\\V%b",
-    "portal": "https://%%authWebName/",
+    "portal": "http://%%authWebName/",
     "singleSessionUserByIP": 0,
     "portalOpenLinkInNewWindow": 0,
     "post": {
@@ -389,7 +379,7 @@
     "oidcOPMetaDataOptions": null,
     "samlSPSSODescriptorWantAssertionsSigned": 1,
     "samlOrganizationName": "%%samlOrganizationName",
-    "registerUrl": "https://%%authWebName/register.pl",
+    "registerUrl": "http://%%authWebName/register.pl",
     "casAccessControlPolicy": "none",
     "multiValuesSeparator": ";",
     "ldapPort": %%ldapServerPort