Merge branch 'master' into dist/eole/2.6.2/master

We need to provide what EoleSSO provides.

For me this 3 new template have to be placed in a dedicated package
like eole-sso-client, this templates are not necessary for the server
only usefull for the clients.

README.md

@@ -1,15 +1,73 @@
 # eole-lemonldap
 
-Intégration LemonLDAP::NG pour EOLE
+LemonLDAP::NG EOLE integration
 
 ## Howto
 
+### Repository configuration
+
 * Add the lemonldap-ng deb respository we need the last version of LemonLDAP.
 
-Gen_config -> Mode Expert -> Dépôts tiers -> Libellé du dépôt
+GenConfig -> Mode Expert -> Dépôts tiers -> Libellé du dépôt
 
-*# LemonLDAP::NG repository
-deb     https://lemonldap-ng.org/deb stable main
-deb-src https://lemonldap-ng.org/deb stable main
-Key URL : https://lemonldap-ng.org/_media/rpm-gpg-key-ow2 
+#### LemonLDAP::NG repository
+ 
+* deb     https://lemonldap-ng.org/deb stable main
+* deb-src https://lemonldap-ng.org/deb stable main
+* Key URL : https://lemonldap-ng.org/_media/rpm-gpg-key-ow2 
 
+#### Cadoles Repository
+* deb [ arch=all  ] https://vulcain.cadoles.com 2.6.2-dev main
+* Key URL : https://vulcain.cadoles.com/cadoles.gpg
+
+### Install packages
+
+apt update
+apt install eole-lemonldap
+
+### Configure LemonLDAP in GenConfig
+
+* Enable lemonldap in "Services" tab
+
+Gen_Config -> Services ->  Activer LemonLDAP::NG -> "Oui"
+
+* Fill LemonLDAP configuration
+
+#### Nginx Web case
+
+By default NGINX is configured to serve "web" application, in this case the lemonLDAP::NG application will
+not be served properly, so we need to disable this function
+
+GenConfig -> Services -> Activer la publication d’applications web par Nginx -> "Non'
+
+#### Configuration DNS
+* GenConfig -> Lemonldap -> Nom DNS du manager LemonLDAP-NG
+* GenConfig -> Lemonldap -> Nom DNS du service d'authentification LemonLDAP-NG
+
+#### Configuration LDAP
+* GenConfig -> Lemonldap -> Protocole LDAP à utiliser
+* GenConfig -> Lemonldap -> Adresse du Serveur LDAP utilisé par LemonLDAP::NG
+* GenConfig -> Lemonldap -> Port d'écoute du LDAP utilisé par LemonLDAP::NG
+* GenConfig -> Lemonldap -> Base DN des utilisateurs dans l'annuaire
+* GenConfig -> Lemonldap -> Utilisateur de connection à l'annuaire (DN ex: cn=reader,o=gouv,c=fr)
+* GenConfig -> Lemonldap -> Mot de passe de l'utilisateur de connection à l'annuaire (file like /root/.reader or the clear password)
+
+#### Configuration CAS
+
+Add your CAS attributes mapping ( uid = uid and mail = mail are created by default)
+
+* GenConfig -> Lemonldap -> Nom de l'attribut CAS
+* GenConfig -> Lemonldap -> Attribut LDAP équivalent
+
+### SSL issues
+
+If you use "autosign" certificates you need to add the "manager" and "auth" service names to the alternative names.
+You also need to include "reload" service name (available in GenConfig -> Mode Expert -> Lemonldap -> Nom DNS du service Reload de LemonLDAP-NG)
+
+* GenConfig -> Mode Expert -> Certificats ssl -> Nom Alternatif de la machine (SubjectAltName)
+
+If you use "manual" certificates make sure this names are covered by your SSL Certificate
+
+If you use "letsencrypt" mode you also need to add this names to the let'sencrypt request:
+
+* GenConfig -> Mode Expert -> Certificat ssl -> Nom de domaines supplémentaires

creolefuncs/lemonldap.py

@@ -0,0 +1,66 @@
+# -*- coding: utf-8 -*-
+
+def toCidr(ip,mask=False):
+    """ Convert to CIDR notation
+        ip can be like this : 192.168.5.100/255.255.255.0
+        or you can provide the ip and the mask
+    """
+    from IPy import IP
+    try:
+        if mask:
+            data="{0}/{1}".format(ip,mask)
+        else:
+            data=ip
+        return str(IP(data))
+    except:
+        return data
+
+def readPass(encoder,reader):
+    try:
+        mypwdreader=open(reader, "r").readline().rstrip()
+        if encoder == "":
+            return mypwdreader
+        elif encoder == "base64":
+            import base64
+            return base64.b64encode(mypwdreader)
+
+    except:
+        return "mot de passe inconnu"
+
+def getSSOFilters():
+    """ Convert former eole-sso filters to LemonLDAP filters
+    """
+    import glob
+    from ConfigParser import ConfigParser
+    import json
+    try:
+       filters = {}
+       filterDirectory = "/usr/share/sso/app_filters/"
+       filterExtention = ".ini"
+       filterSection = "utilisateur"
+       filterFiles = glob.glob("{0}/*{1}".format(filterDirectory, filterExtention))
+       toClean = ["uid","mail","cn","__name__"]
+       for fi in filterFiles:
+          # Don't parse "applications.ini"
+          config = ConfigParser()
+          config.read(fi)
+          if filterSection in config._sections:
+             filters.update(config._sections[filterSection].items())
+
+       for key in toClean:
+           del(filters[key])
+
+       res = ""
+       index=0
+       size=len(filters)
+       for k,v in filters.items():
+           res += "        \"{0}\": \"{1}\",".format(k,v)
+           index += 1
+           if index != size:
+               res += "\n"
+
+       return(res)
+
+    except:
+        return "Error Generating Filters"
+

debian/compat

@@ -0,0 +1 @@
+9

debian/control

@@ -0,0 +1,20 @@
+Source: eole-lemonldap
+Section: web
+Priority: optional
+Maintainer: Cadoles <eole@ac-dijon.fr>
+Build-Depends: debhelper (>= 9)
+Standards-Version: 3.9.3
+Homepage: https://forge.cadoles.com/Cadoles/eole-lemonldap
+Vcs-Git: https://forge.cadoles.com/Cadoles/eole-lemonldap.git
+Vcs-Browser: https://forge.cadoles.com/Cadoles/eole-lemonldap
+
+Package: eole-lemonldap
+Architecture: all
+Depends: ${misc:Depends}, lemonldap-ng, lemonldap-ng-doc, lemonldap-ng-fr-doc, lemonldap-ng-fastcgi-server,
+   libxml-libxml-perl, libxml-libxslt-perl, libcgi-emulate-psgi-perl, libauthen-captcha-perl, liblasso-perl,
+   libxml-simple-perl, libcgi-compile-perl
+Conflicts: eole-sso
+Provides: eole-sso
+Description: Dictionnaires et templates pour la configuration d'un serveur LemonLDAP::NG, testée uniquement avec eolebase
+ .
+ Pour toute information complémentaire, veuillez vous rendre sur la forge Cadoles.

debian/copyright

@@ -0,0 +1,44 @@
+Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: {PROJECT}
+Source: {URL}
+
+Files: *
+Copyright: YEAR {UPSTREAM} {AUTHOR} <{MAIL}>
+License: {UPSTREAM LICENSE}
+
+Files: debian/*
+Copyright: 2012 Équipe EOLE <eole@ac-dijon.fr>
+License: CeCILL-2
+
+License: {UPSTREAM LICENSE}
+ {TEXT OF THE LICENSE}
+
+License: CeCILL-2
+ This software is governed by the CeCILL-2 license under French law and
+ abiding by the rules of distribution of free software.  You can  use,
+ modify and or redistribute the software under the terms of the CeCILL-2
+ license as circulated by CEA, CNRS and INRIA at the following URL
+ "http://www.cecill.info";.
+ .
+ As a counterpart to the access to the source code and  rights to copy,
+ modify and redistribute granted by the license, users are provided only
+ with a limited warranty  and the software's author,  the holder of the
+ economic rights,  and the successive licensors  have only  limited
+ liability.
+ .
+ In this respect, the user's attention is drawn to the risks associated
+ with loading,  using,  modifying and/or developing or reproducing the
+ software by the user in light of its specific status of free software,
+ that may mean  that it is complicated to manipulate,  and  that  also
+ therefore means  that it is reserved for developers  and  experienced
+ professionals having in-depth computer knowledge. Users are therefore
+ encouraged to load and test the software's suitability as regards their
+ requirements in conditions enabling the security of their systems and/or
+ data to be ensured and,  more generally, to use and operate it in the
+ same conditions as regards security.
+ .
+ The fact that you are presently reading this means that you have had
+ knowledge of the CeCILL-2 license and that you accept its terms.
+ .
+ On Eole systems, the complete text of the CeCILL-2 License can be found
+ in '/usr/share/common-licenses/CeCILL-2-en'.

debian/gbp.conf

@@ -0,0 +1,3 @@
+# Set per distribution debian tag
+[DEFAULT]
+debian-tag = debian/eole/%(version)s

debian/rules

@@ -0,0 +1,8 @@
+#!/usr/bin/make -f
+# -*- makefile -*-
+
+# Uncomment this to turn on verbose mode.
+#export DH_VERBOSE=1
+
+%:
+	dh $@

debian/source/format

@@ -0,0 +1 @@
+3.0 (native)

dicos/70_lemonldap_ng.xml

@@ -5,7 +5,12 @@
 		<file filelist='lemon' name='/etc/nginx/sites-available/manager-nginx.conf' mkdir='True' rm='True'/>
 		<file filelist='lemon' name='/etc/nginx/sites-available/handler-nginx.conf' mkdir='True' rm='True'/>
 		<file filelist='lemon' name='/etc/nginx/sites-available/portal-nginx.conf' mkdir='True' rm='True'/>
+		<file filelist='lemon' name='/etc/nginx/sites-available/test-nginx.conf' mkdir='True' rm='True'/>
 		<file filelist='lemon' name='/var/lib/lemonldap-ng/conf/lmConf-1.js' mkdir='True' rm='True'/>
+		<file filelist='lemonCAS' name='/usr/share/php/configCAS/cas.inc.php' source='cas.inc.php.tmpl' mkdir='True'/>
+		<file filelist='lemonCAS' name='/usr/share/php/CAS/eoleCASConfig.php' source='eoleCASConfig.php.tmpl' mkdir='True'/>
+		<file filelist='lemonCAS' name='/etc/pam_cas.conf' source="pam_cas_auth.conf"/>
+		<service>lemonldap-ng-fastcgi-server</service>
 		<service_access service='nginx'>
 			<port service_accesslist="saLemon">80</port>
 			<port service_accesslist="saLemon">443</port>
@@ -28,10 +33,29 @@
 			<variable name='ldapBindUserDN' type='string' description="Utilisateur de connection à l'annuaire" mandatory="True"/>
 			<variable name='ldapBindUserPassword' type='string' description="Mot de passe de l'utilisateur de connection à l'annuaire" mandatory="True"/>
 			<variable name="samlOrganizationName" type='string' description="Nom de l'organisation SAML" mode='expert'/>
+			<variable name="lemonAdmin" type='string' description="LemonLDAP Administrator username" mode='expert'>
+				<value>admin</value>
+			</variable>
+			<variable name="nginxBucketSize" type='number' description="Taille du hash des noms de serveur pour NGINX" mode='expert'>
+				<value>64</value>
+			</variable>
+			<variable name="casAttribute" description="Nom de l'attribut CAS" type="string" mode="expert" multi="True"/>
+			<variable name="casLDAPAttribute" description="Attribut LDAP équivalent" type="string" mode="expert"/>
+			<variable name="casFolder" description="Endpoint du service cas" type="string" mode="expert">
+				<value>cas</value>
+			</variable>
+			<variable name='cas_send_logout' type='oui/non' description="Activer le logout centralisé du serveur SSO" hidden='True'>
+				<value>oui</value>
+			</variable>
+			<variable name='ssoCALocation' type='string' description="Chemin de l'autorité de certification (ou rien)" mode="expert"/>
+			<variable name='ssoDebug' type='string' description="Activer le Debug pour la lib php-CAS" mode="expert">
+				<value>non</value>
+			</variable>
 		</family>
         <separators>
 		    <separator name="managerWebName">Configuration DNS</separator>
 		    <separator name="ldapScheme">Configuration LDAP</separator>
+		    <separator name="casAttribute">Configuration CAS</separator>
 		</separators>
 	</variables>
 	<constraints>
@@ -54,9 +78,13 @@
 		<check name="valid_enum" target="ldapScheme">
 			<param>['ldaps','ldap']</param>
         </check>
+		<group master="casAttribute">
+			<slave>casLDAPAttribute</slave>
+		</group>
 		<condition name='disabled_if_in' source='activerLemon'>
 			<param>non</param>
 			<target type='filelist'>lemon</target>
+			<target type='filelist'>lemonCAS</target>
 			<target type='family'>LemonLDAP</target>
 			<target type='service_accesslist'>saLemon</target>
 		</condition>
@@ -65,5 +93,7 @@
 		<variable name='activerLemon'>Activer l'hébergement d'une place de marché HTTP pour OpenNebula</variable>
 		<variable name='managerWebName'>Nom DNS de l'application de gestion de LemonLDAP::NG ex:manager.cadoles.com</variable>
 		<variable name='authWebName'>Nom DNS de service d'authentification de LemonLDAP::NG ex:auth.cadoles.com</variable>
+		<variable name='ldapUserBaseDN'>DN de l'utilisateur de connection en lecture à l'annuaire (ex: cn=reader,o=gouv,c=fr)</variable>
+		<variable name='nginxBucketSize'>server_names_hash_bucket_size Taille du hash des noms de serveur pour NGINX</variable>
 	</help>
 </creole>

eole-lemonldap.mk

@@ -0,0 +1 @@
+creolefuncs_DATA_DIR := $(DESTDIR)/usr/share/creole/funcs

posttemplate/70-lemon-nginx

@@ -1,9 +1,10 @@
 #!/bin/bash
 
 ENABLE=$(CreoleGet activerLemon 'non')
-CONF_FILES='manager-nginx.conf'
-CONF_FILES='${CONF_FILE} handler-nginx.conf'
-CONF_FILES='${CONF_FILE} portal-nginx.conf'
+CONF_FILES="manager-nginx.conf"
+CONF_FILES="${CONF_FILES} handler-nginx.conf"
+CONF_FILES="${CONF_FILES} portal-nginx.conf"
+CONF_FILES="${CONF_FILES} test-nginx.conf"
 
 for CONF_FILE in ${CONF_FILES}
 do

tmpl/cas.inc.php.tmpl

@@ -0,0 +1,27 @@
+<?php
+define("__CAS_SERVER", "%%authWebName");
+define("__CAS_VERSION", "2.0");
+define("__CAS_FOLDER", "%%casFolder");
+define("__CAS_PORT", %%eolesso_port);
+define("__CAS_PROTO", "https");
+%if %%cas_send_logout == 'oui'
+define("__CAS_LOGOUT", true);
+%else
+define("__CAS_LOGOUT", false);
+%end if
+%if %%getVar('activer_web_valider_ca', 'non') == 'oui'
+define("__CAS_VALIDER_CA", true);
+%else
+define("__CAS_VALIDER_CA", false);
+%end if
+%if %%is_empty(%%getVar('ssoCALocation', ''))
+define("__CAS_CA_LOCATION", "/etc/ssl/certs/ca.crt");
+%else
+define("__CAS_CA_LOCATION", "%%ssoCALocation");
+%end if
+%if %%getVar("ssoDebug", 'non') == "oui"
+define("__CAS_DEBUG", true);
+%else
+define("__CAS_DEBUG", false);
+%end if
+?>

tmpl/eoleCASConfig.php.tmpl

@@ -0,0 +1,7 @@
+<?php
+%if %%mode_conteneur_actif != "non"
+define("__CAS_IP", "%%adresse_ip_br0");
+%else
+define("__CAS_IP", "false");
+%end if
+?>

tmpl/handler-nginx.conf

@@ -12,6 +12,10 @@
 # IMPORTANT:
 # To protect applications, see test-nginx.conf template in example files
 
+%if %%getVar("revprox_hash_bucket_size", "non") == "non"
+server_names_hash_bucket_size %%nginxBucketSize;
+%end if
+
 # Log format
 include /etc/lemonldap-ng/nginx-lmlog.conf;
 #access_log /var/log/nginx/access.log lm_combined;
@@ -44,6 +48,9 @@ server {
 
   location = /reload {
     allow 127.0.0.1;
+%for ipaddr in %%ip_ssh_eth0
+    allow %%toCidr(%%ipaddr, %%ipaddr.netmask_ssh_eth0);
+%end for
     deny all;
     include /etc/nginx/fastcgi_params;
     fastcgi_pass unix:/var/run/llng-fastcgi-server/llng-fastcgi.sock;

tmpl/lmConf-1.js

@@ -25,7 +25,7 @@
     "timeoutActivity": 0,
     "oidcRPMetaDataExportedVars": {},
     "issuerDBSAMLActivation": 0,
-    "issuerDBCASPath": "^/cas/",
+    "issuerDBCASPath": "^/%%casFolder/",
     "randomPasswordRegexp": "[A-Z]{3}[a-z]{5}.\\d{2}",
     "samlIDPSSODescriptorSingleSignOnServiceSOAP": "urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/singleSignOnSOAP;",
     "samlSPSSODescriptorSingleLogoutServiceHTTPPost": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST;#PORTAL#/saml/proxySingleLogout;#PORTAL#/saml/proxySingleLogoutReturn",
@@ -72,7 +72,7 @@
                 "options": {
                     "name": "Application Test 2",
                     "logo": "thumbnail.png",
-                    "uri": "http://test2.%%nom_domaine_local/",
+                    "uri": "https://test2.%%nom_domaine_local/",
                     "display": "auto",
                     "description": "The same simple application displaying authenticated user"
                 },
@@ -84,7 +84,7 @@
                 "type": "application",
                 "options": {
                     "description": "A simple application displaying authenticated user",
-                    "uri": "http://test1.%%nom_domaine_local/",
+                    "uri": "https://test1.%%nom_domaine_local/",
                     "logo": "demo.png",
                     "display": "auto",
                     "name": "Application Test 1"
@@ -143,7 +143,7 @@
                     "logo": "help.png",
                     "description": "Documentation supplied with LemonLDAP::NG",
                     "display": "on",
-                    "uri": "http://%%managerWebName/doc/",
+                    "uri": "https://%%managerWebName/doc/",
                     "name": "Local documentation"
                 },
                 "type": "application"
@@ -158,13 +158,20 @@
     "samlAuthnContextMapPasswordProtectedTransport": 3,
     "ldapUsePasswordResetAttribute": 1,
     "ldapPpolicyControl": 0,
-    "casAttributes": {},
+    "casAttributes": {
+        "uid":"uid",
+%%getSSOFilters
+%for att in %%casAttribute
+        "%%att": "%%att.casLDAPAttribute",
+%end for
+        "mail":"mail"
+    },
     "issuerDBSAMLPath": "^/saml/",
     "samlAttributeAuthorityDescriptorAttributeServiceSOAP": "urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/AA/SOAP;",
     "portalDisplayAppslist": 1,
     "confirmFormMethod": "post",
     "domain": "%%nom_domaine_local",
-    "cfgNum": "9",
+    "cfgNum": "1",
     "authentication": "LDAP",
     "samlNameIDFormatMapWindows": "uid",
     "authChoiceModules": {},
@@ -200,7 +207,7 @@
     "grantSessionRules": {},
     "remoteGlobalStorage": "Lemonldap::NG::Common::Apache::Session::SOAP",
     "reloadUrls": {
-        "%%reloadWebName": "http://%%reloadWebName/reload"
+        "%%reloadWebName": "https://%%reloadWebName/reload"
     },
     "registerTimeout": 0,
     "samlIDPSSODescriptorSingleSignOnServiceHTTPPost": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST;#PORTAL#/saml/singleSignOn;",
@@ -210,7 +217,7 @@
     "registerDB": "Demo",
     "locationRules": {
         "%%managerWebName": {
-            "default": "$uid eq \"dwho\""
+            "default": "$uid eq \"%%lemonAdmin\""
         },
         "test1.%%nom_domaine_local": {
             "default": "accept",
@@ -223,7 +230,11 @@
     },
     "portalDisplayChangePassword": "$_auth =~ /^(LDAP|DBI|Demo)$/",
     "hideOldPassword": 0,
+%if %%is_file(%%ldapBindUserPassword)
+    "managerPassword": "%%readPass("", %%ldapBindUserPassword)",
+%else
     "managerPassword": "%%ldapBindUserPassword",
+%end if
     "authChoiceParam": "lmAuth",
     "lwpSslOpts": {},
     "portalSkinRules": {},
@@ -247,8 +258,8 @@
     "mailOnPasswordChange": 0,
     "captchaStorage": "Apache::Session::File",
     "remoteGlobalStorageOptions": {
-        "proxy": "http://%%authWebName/index.pl/sessions",
-        "ns": "http://%%authWebName/Lemonldap/NG/Common/CGI/SOAPService"
+        "proxy": "https://%%authWebName/index.pl/sessions",
+        "ns": "https://%%authWebName/Lemonldap/NG/Common/CGI/SOAPService"
     },
     "passwordDB": "LDAP",
     "captcha_size": 6,
@@ -319,7 +330,7 @@
     "oidcOPMetaDataJSON": null,
     "samlIdPResolveCookie": "lemonldapidp",
     "samlRelayStateTimeout": 600,
-    "samlOrganizationURL": "http://www.%%nom_domaine_local",
+    "samlOrganizationURL": "https://auth.%%nom_domaine_local",
     "globalStorageOptions": {
         "Directory": "/var/lib/lemonldap-ng/sessions",
         "LockDirectory": "/var/lib/lemonldap-ng/sessions/lock"
@@ -345,10 +356,10 @@
     "oidcOPMetaDataJWKS": null,
     "webIDAuthnLevel": 1,
     "issuerDBOpenIDActivation": "1",
-    "mailUrl": "http://%%authWebName/mail.pl",
+    "mailUrl": "https://%%authWebName/mail.pl",
     "maintenance": 0,
     "jsRedirect": 0,
-    "cfgAuthor": "dwho",
+    "cfgAuthor": "Cadoles",
     "persistentStorageOptions": {
         "LockDirectory": "/var/lib/lemonldap-ng/psessions/lock",
         "Directory": "/var/lib/lemonldap-ng/psessions"
@@ -360,7 +371,7 @@
     "ldapChangePasswordAsUser": 0,
     "CAS_proxiedServices": {},
     "key": "e\"bTCt3*eU9^\\V%b",
-    "portal": "http://%%authWebName/",
+    "portal": "https://%%authWebName/",
     "singleSessionUserByIP": 0,
     "portalOpenLinkInNewWindow": 0,
     "post": {
@@ -379,7 +390,7 @@
     "oidcOPMetaDataOptions": null,
     "samlSPSSODescriptorWantAssertionsSigned": 1,
     "samlOrganizationName": "%%samlOrganizationName",
-    "registerUrl": "http://%%authWebName/register.pl",
+    "registerUrl": "https://%%authWebName/register.pl",
     "casAccessControlPolicy": "none",
     "multiValuesSeparator": ";",
     "ldapPort": %%ldapServerPort

tmpl/pam_cas_auth.conf

@@ -0,0 +1,35 @@
+# sample pam_cas config
+
+# host from CAS server. mandatory
+host %%authWebName
+
+# port from CAS server. Default to 80 or 443, depends from ssl instruction
+port 443
+
+# uri to validate ticket. Default to /proxyValidate
+uriValidate /proxyValidate
+
+# https or no. values on or off. Default to on.
+ssl on
+
+# debug (on) or no (off). debug in syslog, level LOG_DEBUG. Default to off
+debug off
+
+# proxy or proxies who deliver Proxy Ticket.
+# If no proxy, pam_cas doesn't control it
+# It may be several proxy instructions
+#proxy https://%%eolesso_adresse/proxycas/casimap.php
+#proxy https://imp.its.yale.edu/cas/casProxy.php
+#proxy https://uportal1.its.yale.edu/CasProxyServlet
+#proxy https://uportal2.its.yale.edu/CasProxyServlet
+
+# trusted_ca. mandatory if ssl on.
+# It a file in pem format. It can contents several certificates
+# If the CAS server certificate is auto-signed, the file must content the certificate
+# If the certificate is trusted by an Certificate Autority, The file must content
+#    certificate from high level CA
+%if not %%is_empty(%%getVar('ssoCALocation', ''))
+trusted_ca %%eolessoCALocation
+%else
+trusted_ca /etc/ssl/certs/ca.crt
+%end if