Merge branch '2.8.0/master' into dist/eole/2.8.0/master

Activer la possibilité de changer son mot de passe depuis LemonLDAP
ref #31347
2020-12-07 16:07:42 +01:00 · 2020-12-07 16:07:34 +01:00 · 2020-12-07 11:18:42 +01:00 · 2020-12-03 16:51:40 +01:00 · 2020-12-03 16:50:55 +01:00 · 2020-12-02 10:20:52 +01:00
9 changed files with 143 additions and 36 deletions
--- a/debian/control
+++ b/debian/control
@ -38,6 +38,7 @@ Depends: lemonldap-ng,
         liblemonldap-ng-manager-perl,
         liblemonldap-ng-portal-perl,
         libauthen-captcha-perl,
+         libauthen-sasl-perl,
         libemail-sender-perl,
         libgd-securityimage-perl,
         libimage-magick-perl,
--- a/dicos/70_lemonldap_ng.xml
+++ b/dicos/70_lemonldap_ng.xml
@ -2,7 +2,6 @@
 <creole>

    <files>
-
        <file filelist='lemonldap' name='/etc/lemonldap-ng/lemonldap-ng.ini' mkdir='True' rm='True'/>
        <file filelist='lemonldap' name='/var/lib/lemonldap-ng/conf/lmConf-1.json' mkdir='True' rm='True'/>
        <file filelist='lemonldap' name='/etc/default/lemonldap-ng-fastcgi-server' mkdir='True' rm='True'/>
@ -15,7 +14,7 @@
        <file filelist='lemonldap-apache' name='/etc/lemonldap-ng/handler-apache2.X.conf' mkdir='True' rm='True'/>
        <file filelist='lemonldap-apache' name='/etc/lemonldap-ng/portal-apache2.X.conf' mkdir='True' rm='True'/>

-        <service>lemonldap-ng-fastcgi-server</service>
+        <service servicelist="sllemon">lemonldap-ng-fastcgi-server</service>

        <service method='apache' servicelist='lemonldap-apache'>manager-apache2</service>
        <service method='apache' servicelist='lemonldap-apache'>portal-apache2</service>
@ -28,18 +27,30 @@
    </files>

    <variables>
+        <family name='eole-sso'>
+            <variable name='eolesso_cas_folder' redefine="True" exists='True'>
+                <value>/cas</value>
+            </variable>
+            <variable name='eolesso_port' redefine="True" exists='True'>
+                <value>443</value>
+            </variable>
+        </family>
        <family name='Services'>
            <variable name='activerLemon' type='oui/non' description="Activer LemonLDAP::NG">
                <value>non</value>
            </variable>
        </family>

-        <family name='LemonLDAP'>
+        <family name='LemonLDAP' icon='lemon'>

            <variable name='managerWebName' type='string' description="Nom DNS du manager LemonLDAP-NG"/>
            <variable name='authWebName' type='string' description="Nom DNS du service d'authentification LemonLDAP-NG"/>
            <variable name='reloadWebName' type='string' description="Nom DNS du service Reload de LemonLDAP-NG" mode="expert"/>

+	    <variable name='lemon_user_db' type='string' description="Backend pour les comptes utilisateurs" mode="expert">
+                <value>LDAP</value>
+            </variable>
+
            <variable name='ldapScheme' type='string' description="Protocole LDAP à utiliser" mandatory='True'/>
            <variable name='ldapServer' type='string' description="Adresse du Serveur LDAP utilisé par LemonLDAP::NG" mandatory="True"/>
            <variable name='ldapServerPort' type='number' description="Port d'écoute du LDAP utilisé par LemonLDAP::NG" mandatory='True'/>
@ -47,11 +58,18 @@
            <variable name='ldapBindUserDN' type='string' description="Utilisateur de connection à l'annuaire" mandatory="True"/>
            <variable name='ldapBindUserPassword' type='password' description="Mot de passe de l'utilisateur de connection à l'annuaire" mandatory="True"/>
            <variable name="samlOrganizationName" type='string' description="Nom de l'organisation SAML" mode='expert'/>
+            <variable name='lmldapverify' type='oui/non' description="Vérifier les certificats SSL du serveur LDAP">
+                <value>oui</value>
+            </variable>

            <variable name="lemonproc" type='number' description="Nombre de processus dédié à Lemon (équivalent au nombre de processeurs)" mandatory="True">
                <value>4</value>
            </variable>

+            <variable name="lm_loglevel" type='string' description="Verbosité des journaux" mode='expert'>
+                <value>info</value>
+            </variable>
+
            <variable name="lemonAdmin" type='string' description="LemonLDAP Administrator username" mode='expert'>
                <value>admin</value>
            </variable>
@ -74,7 +92,13 @@
            <variable name='llCheckLogins' type='oui/non' description="Permettre aux utilisateurs d'afficher l'historique de connection">
                <value>non</value>
            </variable>
-            <variable name='llResetPassword' type='oui/non' description="Permettre aux utilisateurs de réinitialiser leurs mots de passe">
+            <variable name='llResetPassword' type='oui/non' description="Permettre aux utilisateurs de réinitialiser leurs mots de passe par mail">
+                <value>oui</value>
+            </variable>
+            <variable name='llChangePassword' type='oui/non' description="Permettre aux utilisateurs de changer leurs mots de passe depuis LemonLDAP">
+                <value>oui</value>
+            </variable>
+            <variable name='llResetExpiredPassword' type='oui/non' description="Autoriser le renouvellement des mots de passe expirés">
                <value>oui</value>
            </variable>
            <variable name='llResetUrl' type='string' description="Adresse de l'application pour réinitialiser leurs mots de passe" />
@ -118,10 +142,17 @@
            <param>['ldaps','ldap']</param>
        </check>

-        <check name="valid_enum" target="llRegisterDB">
-            <param>['LDAP','Demo','Custom']</param>
+        <check name="valid_enum" target="lemon_user_db">
+            <param>['LDAP','AD']</param>
        </check>

+        <check name='valid_enum' target="lm_loglevel">
+            <param>['info','notice','warn','error','debug']</param>
+        </check>
+
+        <check name="valid_enum" target="llRegisterDB">
+            <param>['LDAP','AD','Demo','Custom']</param>
+        </check>
        <group master="casAttribute">
            <slave>casLDAPAttribute</slave>
        </group>
@ -131,6 +162,8 @@
            <target type='filelist'>lemonldap</target>
            <target type='filelist'>lemonldap-nginx</target>
            <target type='filelist'>lemonldap-apache</target>
+            <target type='servicelist'>lemonldap-apache</target>
+            <target type='servicelist'>sllemon</target>
            <target type='family'>LemonLDAP</target>
            <target type='service_accesslist'>saLemon</target>
        </condition>
@ -157,6 +190,7 @@
        <condition name='disabled_if_in' source='llResetPassword'>
            <param>non</param>
            <target type='variable'>llResetUrl</target>
+            <target type='variable'>llResetExpiredPassword</target>
        </condition>
        <check name='valid_enum' target='llSkin'>
            <param>['bootstrap','dark','impact','pastel']</param>
@ -165,10 +199,12 @@
    </constraints>

    <help>
+        <family name='LemonLDAP'>Configuration de la solution d'authentification unique LemonLDAP::NG</family>
        <variable name='activerLemon'>Activer le service LemonLDAP::NG sur ce serveur</variable>
        <variable name='managerWebName'>Nom DNS de l'application de gestion de LemonLDAP::NG ex:manager.example.fr</variable>
        <variable name='authWebName'>Nom DNS de service d'authentification de LemonLDAP::NG ex:auth.example.fr</variable>
-        <variable name='ldapUserBaseDN'>DN de l'utilisateur de connection en lecture à l'annuaire (ex: cn=reader,o=gouv,c=fr)</variable>
+	<variable name='ldapUserBaseDN'>DN de base de l'emplactement des utilisateurs dans l'annuaire (ex: ou=users,o=gouv,c=fr)</variable>
+	<variable name='ldapBindUserDN'>DN de l'utilisateur de connection en lecture à l'annuaire (ex: cn=reader,o=gouv,c=fr)</variable>
        <variable name='llCheckLogins'>Affiche une case à cocher sur la mire SSO qui permet a l'utilisateur de voir l'historique de connection de son compte avant d'être redirigé vers le service demandé</variable>
        <variable name='llCSPTargets'>Liste des domaines à ajouter à la directive form-action.</variable>
    </help>
--- a/dicos/71_lemonldap_ng_scribe.xml
+++ b/dicos/71_lemonldap_ng_scribe.xml
@ -3,10 +3,15 @@

    <files />

-    <variables />
+    <variables>
+
+        <family name='eole sso'>
+            <variable name='eolesso_adresse' description="Nom de domaine du serveur d'authentification SSO" redefine="True" exists='True' />
+        </family>
+
+    </variables>

    <constraints>
-
        <fill name='calc_multi_condition' target='activer_sso'>
            <param>oui</param>
            <param type='eole' name='condition_1'>activerLemon</param>
@ -19,31 +24,47 @@
            <target type='variable'>activer_sso</target>
        </condition>

-        <auto name='calc_multi_condition' target='ldapScheme'>
-            <param>oui</param>
-            <param type='eole' name='condition_1'>ldap_tls</param>
-            <param name='match'>ldaps</param>
-            <param name='default_mismatch'>ldap</param>
+        <auto name='calc_val' target='ldapScheme'>
+            <param>ldaps</param>
        </auto>

+        <fill name='calc_val_first_value' target='eolesso_adresse'>
+            <param type='eole' optional='True' hidden='False'>authWebName</param>
+            <param type='eole' optional='True' hidden='False'>web_url</param>
+            <param type='eole'>nom_domaine_machine</param>
+        </fill>
+
+        <auto name='calc_val' target='ldap_port'>
+	    <param>636</param>
+	</auto>
+
+        <condition name='frozen_if_in' source='activerLemon'>
+            <param>oui</param>
+            <target type='variable'>eolesso_adresse</target>
+        </condition>
+
        <auto name='calc_val' target='ldapServer'>
-            <param type='eole'>adresse_ip_ldap</param>
+            <param type='eole'>ad_address</param>
        </auto>

        <auto name='calc_val' target='ldapServerPort'>
-            <param type='eole'>ldap_port</param>
+            <param type='number'>636</param>
        </auto>

-        <auto name='calc_val' target='ldapUserBaseDN'>
-            <param type='eole'>ldap_base_dn</param>
+        <auto name='calc_val' target='lemon_user_db'>
+            <param>AD</param>
+        </auto>
+
+        <auto name='calc_val' target='llRegisterDB'>
+            <param>AD</param>
        </auto>

        <auto name='calc_val' target='ldapBindUserDN'>
-            <param type='eole'>ldap_reader</param>
+            <param type='eole'>sasl_ldap_reader</param>
        </auto>

        <auto name='calc_val' target='ldapBindUserPassword'>
-            <param type='eole'>ldap_reader_passfile</param>
+	    <param>/etc/eole/private/sasl-reader.password</param>
        </auto>

        <auto name='calc_val' target='casFolder'>
--- a/tmpl/handler-apache2.X.conf
+++ b/tmpl/handler-apache2.X.conf
@ -29,6 +29,17 @@ ErrorDocument 503 https://%%authWebName/lmerror/503
 <VirtualHost %%adresse_ip_eth0:443>
    ServerName %%reloadWebName

+    SSLEngine on
+    SSLCertificateFile   %%server_cert
+    SSLCertificateKeyFile %%server_key
+    SSLCertificateChainFile /etc/ssl/certs/ca_local.crt
+    SSLProtocol all -SSLv3 -SSLv2
+    SSLProxyEngine on
+
+    LogLevel %%lm_loglevel
+
+    ErrorLog /var/log/apache2/handler_error.log
+    CustomLog /var/log/apache2/handler_access.log common
    # Configuration reload mechanism (only 1 per physical server is
    # needed): choose your URL to avoid restarting Apache when
    # configuration change
--- a/tmpl/lemonldap-ng-fastcgi-server
+++ b/tmpl/lemonldap-ng-fastcgi-server
@ -1,5 +1,5 @@
 # Number of process (default: 7)
-NPROC = %%lemonproc
+NPROC=%%lemonproc

 # Unix socket to listen to
 SOCKET=/run/llng-fastcgi-server/llng-fastcgi.sock
--- a/tmpl/lemonldap-ng.ini
+++ b/tmpl/lemonldap-ng.ini
@ -197,11 +197,11 @@ portalSkin = %%llSkin
 ; Modules displayed
 ;portalDisplayLogout = 1
 portalDisplayResetPassword = %%boolean[%%llResetPassword]
-;portalDisplayChangePassword = 1
+portalDisplayChangePassword = %%boolean[%%llChangePassword]
 ;portalDisplayAppslist = 1
 ;portalDisplayLoginHistory = 1
 ; Require the old password when changing password
-;portalRequireOldPassword = 1
+portalRequireOldPassword = %%boolean[%%llChangePassword]
 ; Attribute displayed as connected user
 ;portalUserAttr = mail
 ; Old menu HTML code
--- a/tmpl/lmConf-1.json
+++ b/tmpl/lmConf-1.json
@ -85,7 +85,7 @@
    },
    "authChoiceModules": {},
    "authChoiceParam": "lmAuth",
-    "authentication": "LDAP",
+    "authentication": "%%lemon_user_db",
    "browserIdAuthnLevel": 1,
    "captchaStorage": "Apache::Session::File",
    "captchaStorageOptions": {
@ -152,10 +152,37 @@
    "issuerDBSAMLRule": 1,
    "jsRedirect": 0,
    "key": "e\"bTCt3*eU9^\\V%b",
+%if %%llResetPassword == "oui"
+  %if %%llResetExpiredPassword == "oui"
+    %if %%lemon_user_db == "AD"
+    "ldapPpolicyControl": 0,
+    %else
+    "ldapPpolicyControl": 1,
+    %end if
+    "ldapAllowResetExpiredPassword": 1,
+    "ldapChangePasswordAsUser": 1,
+  %else
+    "ldapPpolicyControl": 0,
    "ldapAllowResetExpiredPassword": 0,
+    "ldapChangePasswordAsUser": 1,
+  %end if
+%end if
    "ldapAuthnLevel": 2,
+    "ldapSearchDeref": "find",
+%if %%eole_module == "scribe"
+    "ldapBase": "cn=Users,dc=%echo ",dc=".join(%%ad_domain.split('.')) + '",'
+    "ldapExportedVars": {
+        "cn": "cn",
+        "mail": "mail",
+        "uid": "cn"
+    },
+    "ldapGroupAttributeName": "memberUid",
+    "ldapGroupAttributeNameGroup": "dn",
+    "ldapGroupAttributeNameSearch": "cn",
+    "ldapGroupAttributeNameUser": "cn",
+    "ldapGroupObjectClass": "group",
+%else
    "ldapBase": "%%ldapUserBaseDN",
-    "ldapChangePasswordAsUser": 0,
    "ldapExportedVars": {
        "cn": "cn",
        "mail": "mail",
@ -166,13 +193,20 @@
    "ldapGroupAttributeNameSearch": "cn",
    "ldapGroupAttributeNameUser": "uid",
    "ldapGroupObjectClass": "eolegroupe",
+%end if
    "ldapGroupRecursive": 0,
    "ldapPasswordResetAttribute": "pwdReset",
    "ldapPasswordResetAttributeValue": "TRUE",
    "ldapPort": "%%ldapServerPort",
-    "ldapPpolicyControl": 0,
    "ldapPwdEnc": "utf-8",
    "ldapServer": "%%ldapScheme://%%ldapServer",
+%if %%ldapScheme == "ldaps"
+   %if %%lmldapverify == "oui"
+    "ldapVerify": "required",
+   %else
+    "ldapVerify": "none",
+   %end if
+%end if
    "ldapSetPassword": 0,
    "ldapTimeout": 120,
    "ldapUsePasswordResetAttribute": 1,
@ -205,13 +239,17 @@
    "mailTimeout": 0,
 %if %%llResetPassword == "oui"
    %if %%is_empty(%%llResetUrl)
-    "mailUrl": "https://%%authWebName/mail.pl",
+    "mailUrl": "https://%%authWebName/resetpwd",
    %else
    "mailUrl": "%%llResetUrl",
    %end if
 %end if
    "maintenance": 0,
+%if %%eole_module == "scribe"
+    "managerDn": "cn=%%ldapBindUserDN,cn=Users,dc=%echo ",dc=".join(%%ad_domain.split('.')) + '",'
+%else
    "managerDn": "%%ldapBindUserDN",
+%end if
 %if %%is_file(%%ldapBindUserPassword)
    "managerPassword": "%%readPass("", %%ldapBindUserPassword)",
 %else
@ -244,7 +282,7 @@
    "openIdSreg_fullname": "cn",
    "openIdSreg_nickname": "uid",
    "openIdSreg_timezone": "_timezone",
-    "passwordDB": "LDAP",
+    "passwordDB": "%%lemon_user_db",
    "persistentStorage": "Apache::Session::File",
    "persistentStorageOptions": {
        "Directory": "/var/lib/lemonldap-ng/psessions",
@ -254,7 +292,7 @@
    "portalAntiFrame": 1,
    "portalCheckLogins": %%boolean[%%llCheckLogins],
    "portalDisplayAppslist": 1,
-    "portalDisplayChangePassword": "$_auth =~ /^(LDAP|DBI|Demo)$/",
+    "portalDisplayChangePassword": "$_auth =~ /^(AD|LDAP|DBI|Demo)$/",
    "portalDisplayLoginHistory": 1,
    "portalDisplayLogout": 1,
    "portalDisplayRegister": 1,
@ -364,7 +402,7 @@
    "useRedirectOnForbidden": 0,
    "useSafeJail": 1,
    "userControl": "^[\\w\\.\\-@]+$",
-    "userDB": "LDAP",
+    "userDB": "%%lemon_user_db",
    "vhostOptions": {
        "%%managerWebName": {
            "vhostHttps": "1"
--- a/tmpl/manager-apache2.X.conf
+++ b/tmpl/manager-apache2.X.conf
@ -13,13 +13,13 @@
 <VirtualHost %%adresse_ip_eth0:443>
    ServerName %%managerWebName
    SSLEngine on
-    SSLCertificateFile    /etc/ssl/certs/eole.crt
-    SSLCertificateKeyFile /etc/ssl/private/eole.key
+    SSLCertificateFile    %%server_cert
+    SSLCertificateKeyFile %%server_key
    SSLCertificateChainFile /etc/ssl/certs/ca_local.crt
    SSLProtocol all -SSLv3 -SSLv2
    SSLProxyEngine on

-    LogLevel info
+    LogLevel %%lm_loglevel
    ErrorLog /var/log/apache2/manager_error.log
    CustomLog /var/log/apache2/manager_access.log common

--- a/tmpl/portal-apache2.X.conf
+++ b/tmpl/portal-apache2.X.conf
@ -13,13 +13,13 @@
 <VirtualHost %%adresse_ip_eth0:443>
    ServerName %%authWebName
    SSLEngine on
-    SSLCertificateFile    /etc/ssl/certs/eole.crt
-    SSLCertificateKeyFile /etc/ssl/private/eole.key
+    SSLCertificateFile    %%server_cert
+    SSLCertificateKeyFile %%server_key
    SSLCertificateChainFile /etc/ssl/certs/ca_local.crt
    SSLProtocol all -SSLv3 -SSLv2
    SSLProxyEngine on

-    LogLevel info
+    LogLevel %%lm_loglevel
    ErrorLog /var/log/apache2/portal_error.log
    CustomLog /var/log/apache2/portal_access.log common
Author	SHA1	Message	Date
Philippe Caseiro	1c91addc6d	Merge branch '2.8.0/master' into dist/eole/2.8.0/master	2020-12-07 16:07:42 +01:00
Philippe Caseiro	87818bd6f0	Activer la possibilité de changer son mot de passe depuis LemonLDAP ref #31347	2020-12-07 16:07:34 +01:00
Philippe Caseiro	e5afd4ccff	Adding missing dep for smtp auth support ref #31346	2020-12-07 11:18:42 +01:00
Philippe Caseiro	34239e8ce5	Merge branch '2.8.0/master' into dist/eole/2.8.0/master	2020-12-03 16:51:40 +01:00
Philippe Caseiro	bf94e74916	Using Active Directory (samba4) instead of OpenLDAP Moving to Active Directory the actual auth LDAP server The password is updated in the Samba4 directory so we need to use this one and not the OpenLDAP one	2020-12-03 16:50:55 +01:00
Philippe Caseiro	ad8e4a69a9	Merge branch '2.8.0/master' into dist/eole/2.8.0/master	2020-12-02 10:20:52 +01:00
Philippe Caseiro	0f3ff07b5f	Merge last evolutions from master branch	2020-12-02 10:20:42 +01:00
Philippe Caseiro	74fb92fb55	Make eole-lemonldap-ng compatible with eolebase	2020-11-24 15:51:43 +01:00
Joël Cuissinat	5c7a9f9894	Merge branch '2.8.0/master' into dist/eole/2.8.0/master	2020-11-16 15:45:55 +01:00
Joël Cuissinat	b9ef7ec41d	dicos/70_lemonldap_ng.xml : cosmetic fixes * add "lemon" icon * add help on family Ref: #30576	2020-11-16 15:40:44 +01:00
Daniel Dehennin	8d3f12de72	Merge branch '2.8.0/master' into dist/eole/2.8.0/master	2020-10-16 09:51:42 +02:00
Daniel Dehennin	251a9a3907	Disable the apache servicelist when LemonLDAP::NG is disabled Ref: #30852	2020-10-16 09:47:14 +02:00
Daniel Dehennin	c7d4949fb7	Merge branch 'master' into dist/eole/2.8.0/master	2020-10-15 09:10:44 +02:00
Daniel Dehennin	9b66227236	eolesso_adresse should be forced only when LemonLDAP::NG is enabled The “calc_val” was failing when LemonLDAP::NG was disabled because “authWebName” can't be used. We shouldn't force “eolesso_adresse” when LemonLDAP::NG is disabled, the user must be able to set whatever value she wants. * dicos/71_lemonldap_ng_scribe.xml: fill the “eolesso_adresse” and freeze it when LemonLDAP::NG is enabled. Ref: #30852	2020-10-15 09:07:40 +02:00
Daniel Dehennin	6890500d5b	Merge branch 'master' into dist/eole/2.8.0/master	2020-10-14 15:55:00 +02:00
Daniel Dehennin	90411f89f7	Override previous fill on eolesso_adresse Ref: #30852	2020-10-14 15:54:41 +02:00
Daniel Dehennin	2355b20c7d	Merge branch 'master' into dist/eole/2.8.0/master	2020-10-14 15:47:17 +02:00
Daniel Dehennin	d99ac8c9ad	Force local SSO on Scribe Ref: #30852	2020-10-14 15:46:39 +02:00