Merge branch '2.8.0/master'

ref #31347

dicos/70_lemonldap_ng.xml

@@ -9,6 +9,7 @@
         <file filelist='lemonldap-nginx' name='/etc/lemonldap-ng/manager-nginx.conf' mkdir='True' rm='True'/>
         <file filelist='lemonldap-nginx' name='/etc/lemonldap-ng/handler-nginx.conf' mkdir='True' rm='True'/>
         <file filelist='lemonldap-nginx' name='/etc/lemonldap-ng/portal-nginx.conf' mkdir='True' rm='True'/>
+        <file filelist='lemonldap-nginx' name='/etc/lemonldap-ng/nginx-lmlog.conf' mkdir='True' rm='True'/>
 
         <file filelist='lemonldap-apache' name='/etc/lemonldap-ng/manager-apache2.X.conf' mkdir='True' rm='True'/>
         <file filelist='lemonldap-apache' name='/etc/lemonldap-ng/handler-apache2.X.conf' mkdir='True' rm='True'/>
@@ -92,7 +93,10 @@
             <variable name='llCheckLogins' type='oui/non' description="Permettre aux utilisateurs d'afficher l'historique de connection">
                 <value>non</value>
             </variable>
-            <variable name='llResetPassword' type='oui/non' description="Permettre aux utilisateurs de réinitialiser leurs mots de passe">
+            <variable name='llResetPassword' type='oui/non' description="Permettre aux utilisateurs de réinitialiser leurs mots de passe par mail">
+                <value>oui</value>
+            </variable>
+            <variable name='llChangePassword' type='oui/non' description="Permettre aux utilisateurs de changer leurs mots de passe depuis LemonLDAP">
                 <value>oui</value>
             </variable>
             <variable name='llResetExpiredPassword' type='oui/non' description="Autoriser le renouvellement des mots de passe expirés">
@@ -148,7 +152,7 @@
         </check>
 
         <check name="valid_enum" target="llRegisterDB">
-            <param>['LDAP','Demo','Custom']</param>
+            <param>['LDAP','AD','Demo','Custom']</param>
         </check>
         <group master="casAttribute">
             <slave>casLDAPAttribute</slave>

dicos/71_lemonldap_ng_scribe.xml

@@ -55,6 +55,10 @@
             <param>AD</param>
         </auto>
 
+        <auto name='calc_val' target='llRegisterDB'>
+            <param>AD</param>
+        </auto>
+
         <auto name='calc_val' target='ldapBindUserDN'>
             <param type='eole'>sasl_ldap_reader</param>
         </auto>

tmpl/handler-nginx.conf

@@ -23,8 +23,7 @@ server {
 }
 
 server {
-  listen 443;
-  ssl on;
+  listen 443 ssl;
 %if %%cert_type == "letsencrypt"
   ssl_certificate %%le_config_dir/live/%%managerWebName/cert.pem;
   ssl_certificate_key %%le_config_dir/live/%%managerWebName/privkey.pem;
@@ -62,7 +61,7 @@ server {
     deny all;
 
     # Uncomment this if you use https only
-    #add_header Strict-Transport-Security "max-age=15768000";
+    add_header Strict-Transport-Security "max-age=15768000";
   }
 
 }

tmpl/lemonldap-ng.ini

@@ -197,11 +197,11 @@ portalSkin = %%llSkin
 ; Modules displayed
 ;portalDisplayLogout = 1
 portalDisplayResetPassword = %%boolean[%%llResetPassword]
-;portalDisplayChangePassword = 1
+portalDisplayChangePassword = %%boolean[%%llChangePassword]
 ;portalDisplayAppslist = 1
 ;portalDisplayLoginHistory = 1
 ; Require the old password when changing password
-;portalRequireOldPassword = 1
+portalRequireOldPassword = %%boolean[%%llChangePassword]
 ; Attribute displayed as connected user
 ;portalUserAttr = mail
 ; Old menu HTML code

tmpl/lmConf-1.json

@@ -160,19 +160,29 @@
     "ldapPpolicyControl": 1,
     %end if
     "ldapAllowResetExpiredPassword": 1,
+    "ldapChangePasswordAsUser": 1,
   %else
     "ldapPpolicyControl": 0,
     "ldapAllowResetExpiredPassword": 0,
+    "ldapChangePasswordAsUser": 1,
   %end if
 %end if
-    "ldapChangePasswordAsUser": 1,
     "ldapAuthnLevel": 2,
+    "ldapSearchDeref": "find",
 %if %%eole_module == "scribe"
     "ldapBase": "cn=Users,dc=%echo ",dc=".join(%%ad_domain.split('.')) + '",'
+    "ldapExportedVars": {
+        "cn": "cn",
+        "mail": "mail",
+        "uid": "cn"
+    },
+    "ldapGroupAttributeName": "memberUid",
+    "ldapGroupAttributeNameGroup": "dn",
+    "ldapGroupAttributeNameSearch": "cn",
+    "ldapGroupAttributeNameUser": "cn",
+    "ldapGroupObjectClass": "group",
 %else
     "ldapBase": "%%ldapUserBaseDN",
-%end if
-    "ldapSearchDeref": "find",
     "ldapExportedVars": {
         "cn": "cn",
         "mail": "mail",
@@ -183,6 +193,7 @@
     "ldapGroupAttributeNameSearch": "cn",
     "ldapGroupAttributeNameUser": "uid",
     "ldapGroupObjectClass": "eolegroupe",
+%end if
     "ldapGroupRecursive": 0,
     "ldapPasswordResetAttribute": "pwdReset",
     "ldapPasswordResetAttributeValue": "TRUE",
@@ -228,7 +239,7 @@
     "mailTimeout": 0,
 %if %%llResetPassword == "oui"
     %if %%is_empty(%%llResetUrl)
-    "mailUrl": "https://%%authWebName/mail.pl",
+    "mailUrl": "https://%%authWebName/resetpwd",
     %else
     "mailUrl": "%%llResetUrl",
     %end if
@@ -281,7 +292,7 @@
     "portalAntiFrame": 1,
     "portalCheckLogins": %%boolean[%%llCheckLogins],
     "portalDisplayAppslist": 1,
-    "portalDisplayChangePassword": "$_auth =~ /^(LDAP|DBI|Demo)$/",
+    "portalDisplayChangePassword": "$_auth =~ /^(AD|LDAP|DBI|Demo)$/",
     "portalDisplayLoginHistory": 1,
     "portalDisplayLogout": 1,
     "portalDisplayRegister": 1,

tmpl/manager-nginx.conf

@@ -5,8 +5,7 @@ server {
 }
 
 server {
-  listen 443;
-  ssl on;
+  listen 443 ssl;
   %if %%cert_type == "letsencrypt"
   ssl_certificate %%le_config_dir/live/%%managerWebName/cert.pem;
   ssl_certificate_key %%le_config_dir/live/%%managerWebName/privkey.pem;
@@ -70,8 +69,8 @@ server {
 
   # DEBIAN
   # If install was made with USEDEBIANLIBS (official releases), uncomment this
-  #location /javascript/ {
-  #  alias /usr/share/javascript/;
-  #}
+  location /javascript/ {
+    alias /usr/share/javascript/;
+  }
 
 }

tmpl/portal-nginx.conf

@@ -15,8 +15,7 @@ server {
 }
 
 server {
-  listen 443;
-  ssl on;
+  listen 443 ssl;
 %if %%cert_type == "letsencrypt"
   ssl_certificate %%le_config_dir/live/%%authWebName/cert.pem;
   ssl_certificate_key %%le_config_dir/live/%%authWebName/privkey.pem;
@@ -83,7 +82,7 @@ server {
 
   # DEBIAN
   # If install was made with USEDEBIANLIBS (official releases), uncomment this
-  #location /javascript/ {
-  #  alias /usr/share/javascript/;
-  #}
+  location /javascript/ {
+    alias /usr/share/javascript/;
+  }
 }