Merge remote-tracking branch 'eole/master' into develop

ref #31347

Makefile

@@ -3,9 +3,9 @@
 ################################
 
 SOURCE=eole-lemonldap
-VERSION=2.8
+VERSION=0.1
-EOLE_VERSION=2.8
+EOLE_VERSION=2.7
-EOLE_RELEASE=2.8.1
+EOLE_RELEASE=2.7.2
 PKGAPPS=non
 #FLASK_MODULE=<APPLICATION>
 

debian/control

@@ -1,51 +0,0 @@
-Source: eole-lemonldap-ng
-Section: web
-Priority: optional
-Maintainer: Équipe EOLE <eole@ac-dijon.fr>
-Build-Depends: debhelper-compat (= 12)
-Standards-Version: 4.5.0
-Homepage: https://dev-eole.ac-dijon.fr/projects/sso
-Vcs-Git: https://dev-eole.ac-dijon.fr/git/eole-lemonldap-ng.git
-Vcs-Browser: https://dev-eole.ac-dijon.fr/projects/sso/repository
-
-Package: eole-lemonldap-ng
-Architecture: all
-Depends: eole-lemonldap-ng-pkg,
-         ${misc:Depends}
-Description: Dictionnaires et templates pour la configuration d'un serveur LemonLDAP::NG
- Pour toute information complémentaire, veuillez vous rendre sur le
- site du projet EOLE.
-
-Package: eole-lemonldap-ng-scribe
-Architecture: all
-Depends: eole-scribe,
-         eole-lemonldap-ng,
-	 libapache2-mod-perl2,
-         ${misc:Depends}
-Description: Dictionnaire pour calculer les valeurs automatiquement sur Scribe
- .
- Pour toute information complémentaire, veuillez vous rendre sur le
- site du projet EOLE.
-
-Package: eole-lemonldap-ng-pkg
-Architecture: all
-Section: metapackages
-Depends: lemonldap-ng,
-         lemonldap-ng-doc,
-         lemonldap-ng-fastcgi-server,
-         lemonldap-ng-handler,
-         liblemonldap-ng-handler-perl,
-         liblemonldap-ng-manager-perl,
-         liblemonldap-ng-portal-perl,
-         libauthen-captcha-perl,
-         libauthen-sasl-perl,
-         libemail-sender-perl,
-         libgd-securityimage-perl,
-         libimage-magick-perl,
-         libio-string-perl,
-         liblasso-perl,
-         libnet-openid-server-perl,
-         ${misc:Depends}
-Description: Paquet de dépendances pour eole-lemonldap.
- .
- Pour toute information complémentaire, veuillez vous rendre sur la forge Cadoles.

debian/copyright

@@ -1,37 +0,0 @@
-Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
-Upstream-Name: eole-lemonldap-ng
-Source: http://dev-eole.ac-dijon.fr/projects/sso
-
-Files: *
-Copyright: 2020 Équipe EOLE <eole@ac-dijon.fr>
-License: CeCILL-C
-
-License: CeCILL-C
- This software is governed by the CeCILL-C license under French law and
- abiding by the rules of distribution of free software.  You can  use,
- modify and or redistribute the software under the terms of the CeCILL-C
- license as circulated by CEA, CNRS and INRIA at the following URL
- "http://www.cecill.info";.
- .
- As a counterpart to the access to the source code and  rights to copy,
- modify and redistribute granted by the license, users are provided only
- with a limited warranty  and the software's author,  the holder of the
- economic rights,  and the successive licensors  have only  limited
- liability.
- .
- In this respect, the user's attention is drawn to the risks associated
- with loading,  using,  modifying and/or developing or reproducing the
- software by the user in light of its specific status of free software,
- that may mean  that it is complicated to manipulate,  and  that  also
- therefore means  that it is reserved for developers  and  experienced
- professionals having in-depth computer knowledge. Users are therefore
- encouraged to load and test the software's suitability as regards their
- requirements in conditions enabling the security of their systems and/or
- data to be ensured and,  more generally, to use and operate it in the
- same conditions as regards security.
- .
- The fact that you are presently reading this means that you have had
- knowledge of the CeCILL-C license and that you accept its terms.
- .
- On Eole systems, the complete text of the CeCILL-C License can be found
- in `/usr/share/common-licenses/CeCILL-2'.

debian/eole-lemonldap-ng-scribe.install

@@ -1,2 +0,0 @@
-usr/share/eole/creole/dicos/71_lemonldap_ng_scribe.xml
-usr/share/eole/postservice/98-lemonldap-ng-scribe-register-hosts

debian/eole-lemonldap-ng.install

@@ -1,6 +0,0 @@
-usr/share/creole/
-usr/share/eole/creole/dicos/70_lemonldap_ng.xml
-usr/share/eole/creole/distrib/
-usr/share/eole/diagnose/
-usr/share/eole/postservice/99-lemonldap-ng
-usr/share/eole/posttemplate/

debian/gbp.conf

@@ -1,3 +0,0 @@
-# Set per distribution debian tag
-[DEFAULT]
-debian-tag = debian/eole/%(version)s

debian/rules

@@ -1,9 +0,0 @@
-#!/usr/bin/make -f
-# -*- makefile -*-
-
-# Uncomment this to turn on verbose mode.
-export DH_VERBOSE=1
-export DH_OPTIONS=-v
-
-%:
-	dh $@

debian/source/format

@@ -1 +0,0 @@
-3.0 (native)

dicos/70_lemonldap_ng.xml

@@ -9,6 +9,7 @@
         <file filelist='lemonldap-nginx' name='/etc/lemonldap-ng/manager-nginx.conf' mkdir='True' rm='True'/>
         <file filelist='lemonldap-nginx' name='/etc/lemonldap-ng/handler-nginx.conf' mkdir='True' rm='True'/>
         <file filelist='lemonldap-nginx' name='/etc/lemonldap-ng/portal-nginx.conf' mkdir='True' rm='True'/>
+        <file filelist='lemonldap-nginx' name='/etc/lemonldap-ng/nginx-lmlog.conf' mkdir='True' rm='True'/>
 
         <file filelist='lemonldap-apache' name='/etc/lemonldap-ng/manager-apache2.X.conf' mkdir='True' rm='True'/>
         <file filelist='lemonldap-apache' name='/etc/lemonldap-ng/handler-apache2.X.conf' mkdir='True' rm='True'/>
@@ -98,6 +99,12 @@
             <variable name='llChangePassword' type='oui/non' description="Permettre aux utilisateurs de changer leurs mots de passe depuis LemonLDAP">
                 <value>oui</value>
             </variable>
+            <variable name='llADPasswordMaxAge' type='number' description="Durée de vie des mots de passe (en secondes)" mode='expert'>
+                <value>5184000</value>
+            </variable>
+            <variable name='llADPasswordExpireWarn' type='number' description="Délai avant affichage d'un message d'alerte sur l'expiration du mot de passe (en secondes)">
+                <value>3456000</value>
+            </variable>
             <variable name='llResetExpiredPassword' type='oui/non' description="Autoriser le renouvellement des mots de passe expirés">
                 <value>oui</value>
             </variable>
@@ -157,6 +164,12 @@
             <slave>casLDAPAttribute</slave>
         </group>
 
+        <condition name='disabled_if_not_in' source='lemon_user_db'>
+            <param>AD</param>
+            <target type='variable'>llADPasswordMaxAge</target>
+            <target type='variable'>llADPasswordExpireWarn</target>
+        </condition>
+
         <condition name='disabled_if_in' source='activerLemon'>
             <param>non</param>
             <target type='filelist'>lemonldap</target>

dicos/71_lemonldap_ng_scribe.xml

@@ -24,9 +24,6 @@
             <target type='variable'>activer_sso</target>
         </condition>
 
-        <auto name='calc_val' target='ldapScheme'>
-            <param>ldaps</param>
-        </auto>
 
         <fill name='calc_val_first_value' target='eolesso_adresse'>
             <param type='eole' optional='True' hidden='False'>authWebName</param>
@@ -34,37 +31,42 @@
             <param type='eole'>nom_domaine_machine</param>
         </fill>
 
-        <auto name='calc_val' target='ldap_port'>
-	    <param>636</param>
-	</auto>
-
         <condition name='frozen_if_in' source='activerLemon'>
             <param>oui</param>
             <target type='variable'>eolesso_adresse</target>
         </condition>
 
+        <auto name='calc_multi_condition' target='ldapScheme'>
+            <param>oui</param>
+            <param type='eole' name='condition_1'>ldap_tls</param>
+            <param name='match'>ldaps</param>
+            <param name='default_mismatch'>ldap</param>
+        </auto>
+
         <auto name='calc_val' target='ldapServer'>
-            <param type='eole'>ad_address</param>
+            <param type='eole'>adresse_ip_ldap</param>
         </auto>
 
         <auto name='calc_val' target='ldapServerPort'>
-            <param type='number'>636</param>
+            <param type='eole'>ldap_port</param>
         </auto>
 
         <auto name='calc_val' target='lemon_user_db'>
-            <param>AD</param>
+            <param>LDAP</param>
         </auto>
 
         <auto name='calc_val' target='llRegisterDB'>
-            <param>AD</param>
+            <param>LDAP</param>
+        </auto>
+        <auto name='calc_val' target='ldapUserBaseDN'>
+            <param type='eole'>ldap_base_dn</param>
         </auto>
-
         <auto name='calc_val' target='ldapBindUserDN'>
-            <param type='eole'>sasl_ldap_reader</param>
+            <param type='eole'>ldap_reader</param>
         </auto>
 
         <auto name='calc_val' target='ldapBindUserPassword'>
-	    <param>/etc/eole/private/sasl-reader.password</param>
+	        <param type='eole'>ldap_reader_passfile</param>
         </auto>
 
         <auto name='calc_val' target='casFolder'>
@@ -75,4 +77,4 @@
 
     <help />
 
-</creole>
+</creole>

tmpl/handler-nginx.conf

@@ -23,8 +23,7 @@ server {
 }
 
 server {
-  listen 443;
+  listen 443 ssl;
-  ssl on;
 %if %%cert_type == "letsencrypt"
   ssl_certificate %%le_config_dir/live/%%managerWebName/cert.pem;
   ssl_certificate_key %%le_config_dir/live/%%managerWebName/privkey.pem;
@@ -62,7 +61,7 @@ server {
     deny all;
 
     # Uncomment this if you use https only
-    #add_header Strict-Transport-Security "max-age=15768000";
+    add_header Strict-Transport-Security "max-age=15768000";
   }
 
 }

tmpl/lmConf-1.json

@@ -13,8 +13,10 @@
 %silent %%exported_vars.sort()
 %silent %%cas_attributes.sort()
 {
-    "ADPwdExpireWarning": 0,
+%if %%lemon_user_db == "AD"
-    "ADPwdMaxAge": 0,
+    "ADPwdExpireWarning": %%llADPasswordExpireWarn,
+    "ADPwdMaxAge": %%llADPasswordMaxAge,
+%end if
     "CAS_authnLevel": 1,
     "CAS_pgtFile": "/tmp/pgt.txt",
     "CAS_proxiedServices": {},
@@ -169,19 +171,6 @@
 %end if
     "ldapAuthnLevel": 2,
     "ldapSearchDeref": "find",
-%if %%eole_module == "scribe"
-    "ldapBase": "cn=Users,dc=%echo ",dc=".join(%%ad_domain.split('.')) + '",'
-    "ldapExportedVars": {
-        "cn": "cn",
-        "mail": "mail",
-        "uid": "cn"
-    },
-    "ldapGroupAttributeName": "memberUid",
-    "ldapGroupAttributeNameGroup": "dn",
-    "ldapGroupAttributeNameSearch": "cn",
-    "ldapGroupAttributeNameUser": "cn",
-    "ldapGroupObjectClass": "group",
-%else
     "ldapBase": "%%ldapUserBaseDN",
     "ldapExportedVars": {
         "cn": "cn",
@@ -193,7 +182,6 @@
     "ldapGroupAttributeNameSearch": "cn",
     "ldapGroupAttributeNameUser": "uid",
     "ldapGroupObjectClass": "eolegroupe",
-%end if
     "ldapGroupRecursive": 0,
     "ldapPasswordResetAttribute": "pwdReset",
     "ldapPasswordResetAttributeValue": "TRUE",
@@ -245,11 +233,7 @@
     %end if
 %end if
     "maintenance": 0,
-%if %%eole_module == "scribe"
-    "managerDn": "cn=%%ldapBindUserDN,cn=Users,dc=%echo ",dc=".join(%%ad_domain.split('.')) + '",'
-%else
     "managerDn": "%%ldapBindUserDN",
-%end if
 %if %%is_file(%%ldapBindUserPassword)
     "managerPassword": "%%readPass("", %%ldapBindUserPassword)",
 %else

tmpl/manager-nginx.conf

@@ -5,8 +5,7 @@ server {
 }
 
 server {
-  listen 443;
+  listen 443 ssl;
-  ssl on;
   %if %%cert_type == "letsencrypt"
   ssl_certificate %%le_config_dir/live/%%managerWebName/cert.pem;
   ssl_certificate_key %%le_config_dir/live/%%managerWebName/privkey.pem;
@@ -70,8 +69,8 @@ server {
 
   # DEBIAN
   # If install was made with USEDEBIANLIBS (official releases), uncomment this
-  #location /javascript/ {
+  location /javascript/ {
-  #  alias /usr/share/javascript/;
+    alias /usr/share/javascript/;
-  #}
+  }
 
 }

tmpl/portal-nginx.conf

@@ -15,8 +15,7 @@ server {
 }
 
 server {
-  listen 443;
+  listen 443 ssl;
-  ssl on;
 %if %%cert_type == "letsencrypt"
   ssl_certificate %%le_config_dir/live/%%authWebName/cert.pem;
   ssl_certificate_key %%le_config_dir/live/%%authWebName/privkey.pem;
@@ -83,7 +82,7 @@ server {
 
   # DEBIAN
   # If install was made with USEDEBIANLIBS (official releases), uncomment this
-  #location /javascript/ {
+  location /javascript/ {
-  #  alias /usr/share/javascript/;
+    alias /usr/share/javascript/;
-  #}
+  }
 }