Merge packaging from upstream

Merge branch 'master' into dist/eole/2.7.2/master
Updating packaging from eole
2020-12-09 09:42:51 +01:00 · 2020-12-09 09:29:03 +01:00 · 2020-12-09 09:28:26 +01:00 · 2020-12-07 16:06:55 +01:00 · 2020-12-03 16:52:33 +01:00 · 2020-11-26 17:14:12 +01:00
13 changed files with 165 additions and 86 deletions
--- a/debian/compat
+++ b/debian/compat
@ -1 +0,0 @@
-9
--- a/debian/control
+++ b/debian/control
@ -1,30 +1,51 @@
-Source: eole-lemonldap
+Source: eole-lemonldap-ng
 Section: web
 Priority: optional
-Maintainer: Cadoles <eole@ac-dijon.fr>
-Build-Depends: debhelper (>= 9)
-Standards-Version: 3.9.3
-Homepage: https://forge.cadoles.com/Cadoles/eole-lemonldap
-Vcs-Git: https://forge.cadoles.com/Cadoles/eole-lemonldap.git
-Vcs-Browser: https://forge.cadoles.com/Cadoles/eole-lemonldap
+Maintainer: Équipe EOLE <eole@ac-dijon.fr>
+Build-Depends: debhelper-compat (= 12)
+Standards-Version: 4.5.0
+Homepage: https://dev-eole.ac-dijon.fr/projects/sso
+Vcs-Git: https://dev-eole.ac-dijon.fr/git/eole-lemonldap-ng.git
+Vcs-Browser: https://dev-eole.ac-dijon.fr/projects/sso/repository

-Package: eole-lemonldap
+Package: eole-lemonldap-ng
 Architecture: all
-Depends: ${misc:Depends}, eole-client-annuaire, python-configparser, eole-lemonldap-pkg
-Conflicts: eole-sso
-Provides: eole-sso
-Description: Dictionnaires et templates pour la configuration d'un serveur LemonLDAP::NG, testée uniquement avec eolebase
+Depends: eole-lemonldap-ng-pkg,
+         ${misc:Depends}
+Description: Dictionnaires et templates pour la configuration d'un serveur LemonLDAP::NG
+ Pour toute information complémentaire, veuillez vous rendre sur le
+ site du projet EOLE.
+
+Package: eole-lemonldap-ng-scribe
+Architecture: all
+Depends: eole-scribe,
+         eole-lemonldap-ng,
+	 libapache2-mod-perl2,
+         ${misc:Depends}
+Description: Dictionnaire pour calculer les valeurs automatiquement sur Scribe
 .
- Pour toute information complémentaire, veuillez vous rendre sur la forge Cadoles.
+ Pour toute information complémentaire, veuillez vous rendre sur le
+ site du projet EOLE.

-Package: eole-lemonldap-pkg
+Package: eole-lemonldap-ng-pkg
 Architecture: all
-Depends: ${misc:Depends}, lemonldap-ng, lemonldap-ng-doc, lemonldap-ng-fastcgi-server,
-   libxml-libxml-perl, libxml-libxslt-perl, libcgi-emulate-psgi-perl, libauthen-captcha-perl, liblasso-perl,
-   libxml-simple-perl, libcgi-compile-perl, libmouse-perl, libio-string-perl, libnet-openid-server-perl,
-   libemail-sender-perl, libgd-securityimage-perl, libimage-magick-perl, libnet-ldap-perl,
-   libunicode-string-perl, libsoap-lite-perl, libhtml-template-perl, libcache-cache-perl,
-   libdbi-perl, perl-modules, libwww-perl
+Section: metapackages
+Depends: lemonldap-ng,
+         lemonldap-ng-doc,
+         lemonldap-ng-fastcgi-server,
+         lemonldap-ng-handler,
+         liblemonldap-ng-handler-perl,
+         liblemonldap-ng-manager-perl,
+         liblemonldap-ng-portal-perl,
+         libauthen-captcha-perl,
+         libauthen-sasl-perl,
+         libemail-sender-perl,
+         libgd-securityimage-perl,
+         libimage-magick-perl,
+         libio-string-perl,
+         liblasso-perl,
+         libnet-openid-server-perl,
+         ${misc:Depends}
 Description: Paquet de dépendances pour eole-lemonldap.
 .
 Pour toute information complémentaire, veuillez vous rendre sur la forge Cadoles.
--- a/debian/copyright
+++ b/debian/copyright
@ -1,22 +1,15 @@
 Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
-Upstream-Name: {PROJECT}
-Source: {URL}
+Upstream-Name: eole-lemonldap-ng
+Source: http://dev-eole.ac-dijon.fr/projects/sso

 Files: *
-Copyright: YEAR {UPSTREAM} {AUTHOR} <{MAIL}>
-License: {UPSTREAM LICENSE}
+Copyright: 2020 Équipe EOLE <eole@ac-dijon.fr>
+License: CeCILL-C

-Files: debian/*
-Copyright: 2012 Équipe EOLE <eole@ac-dijon.fr>
-License: CeCILL-2
-
-License: {UPSTREAM LICENSE}
- {TEXT OF THE LICENSE}
-
-License: CeCILL-2
- This software is governed by the CeCILL-2 license under French law and
+License: CeCILL-C
+ This software is governed by the CeCILL-C license under French law and
 abiding by the rules of distribution of free software.  You can  use,
- modify and or redistribute the software under the terms of the CeCILL-2
+ modify and or redistribute the software under the terms of the CeCILL-C
 license as circulated by CEA, CNRS and INRIA at the following URL
 "http://www.cecill.info";.
 .
@ -38,7 +31,7 @@ License: CeCILL-2
 same conditions as regards security.
 .
 The fact that you are presently reading this means that you have had
- knowledge of the CeCILL-2 license and that you accept its terms.
+ knowledge of the CeCILL-C license and that you accept its terms.
 .
- On Eole systems, the complete text of the CeCILL-2 License can be found
- in '/usr/share/common-licenses/CeCILL-2-en'.
+ On Eole systems, the complete text of the CeCILL-C License can be found
+ in `/usr/share/common-licenses/CeCILL-2'.
--- a/debian/eole-lemonldap-ng-scribe.install
+++ b/debian/eole-lemonldap-ng-scribe.install
@ -0,0 +1,2 @@
+usr/share/eole/creole/dicos/71_lemonldap_ng_scribe.xml
+usr/share/eole/postservice/98-lemonldap-ng-scribe-register-hosts
--- a/debian/eole-lemonldap.install
+++ b/debian/eole-lemonldap.install
@ -1 +0,0 @@
-usr
--- a/debian/rules
+++ b/debian/rules
@ -2,7 +2,8 @@
 # -*- makefile -*-

 # Uncomment this to turn on verbose mode.
-#export DH_VERBOSE=1
+export DH_VERBOSE=1
+export DH_OPTIONS=-v

 %:
 	dh $@
--- a/dicos/70_lemonldap_ng.xml
+++ b/dicos/70_lemonldap_ng.xml
@ -2,14 +2,6 @@
 <creole>

    <files>
-<<<<<<< HEAD
-<<<<<<< HEAD
-=======
-<<<<<<< HEAD
-
->>>>>>> master
-=======
->>>>>>> master
        <file filelist='lemonldap' name='/etc/lemonldap-ng/lemonldap-ng.ini' mkdir='True' rm='True'/>
        <file filelist='lemonldap' name='/var/lib/lemonldap-ng/conf/lmConf-1.json' mkdir='True' rm='True'/>
        <file filelist='lemonldap' name='/etc/default/lemonldap-ng-fastcgi-server' mkdir='True' rm='True'/>
@ -35,6 +27,14 @@
    </files>

    <variables>
+        <family name='eole-sso'>
+            <variable name='eolesso_cas_folder' redefine="True" exists='True'>
+                <value>/cas</value>
+            </variable>
+            <variable name='eolesso_port' redefine="True" exists='True'>
+                <value>443</value>
+            </variable>
+        </family>
        <family name='Services'>
            <variable name='activerLemon' type='oui/non' description="Activer LemonLDAP::NG">
                <value>non</value>
@ -47,6 +47,10 @@
            <variable name='authWebName' type='string' description="Nom DNS du service d'authentification LemonLDAP-NG"/>
            <variable name='reloadWebName' type='string' description="Nom DNS du service Reload de LemonLDAP-NG" mode="expert"/>

+	    <variable name='lemon_user_db' type='string' description="Backend pour les comptes utilisateurs" mode="expert">
+                <value>LDAP</value>
+            </variable>
+
            <variable name='ldapScheme' type='string' description="Protocole LDAP à utiliser" mandatory='True'/>
            <variable name='ldapServer' type='string' description="Adresse du Serveur LDAP utilisé par LemonLDAP::NG" mandatory="True"/>
            <variable name='ldapServerPort' type='number' description="Port d'écoute du LDAP utilisé par LemonLDAP::NG" mandatory='True'/>
@ -54,6 +58,9 @@
            <variable name='ldapBindUserDN' type='string' description="Utilisateur de connection à l'annuaire" mandatory="True"/>
            <variable name='ldapBindUserPassword' type='password' description="Mot de passe de l'utilisateur de connection à l'annuaire" mandatory="True"/>
            <variable name="samlOrganizationName" type='string' description="Nom de l'organisation SAML" mode='expert'/>
+            <variable name='lmldapverify' type='oui/non' description="Vérifier les certificats SSL du serveur LDAP">
+                <value>oui</value>
+            </variable>

            <variable name="lemonproc" type='number' description="Nombre de processus dédié à Lemon (équivalent au nombre de processeurs)" mandatory="True">
                <value>4</value>
@ -85,7 +92,13 @@
            <variable name='llCheckLogins' type='oui/non' description="Permettre aux utilisateurs d'afficher l'historique de connection">
                <value>non</value>
            </variable>
-            <variable name='llResetPassword' type='oui/non' description="Permettre aux utilisateurs de réinitialiser leurs mots de passe">
+            <variable name='llResetPassword' type='oui/non' description="Permettre aux utilisateurs de réinitialiser leurs mots de passe par mail">
+                <value>oui</value>
+            </variable>
+            <variable name='llChangePassword' type='oui/non' description="Permettre aux utilisateurs de changer leurs mots de passe depuis LemonLDAP">
+                <value>oui</value>
+            </variable>
+            <variable name='llResetExpiredPassword' type='oui/non' description="Autoriser le renouvellement des mots de passe expirés">
                <value>oui</value>
            </variable>
            <variable name='llResetUrl' type='string' description="Adresse de l'application pour réinitialiser leurs mots de passe" />
@ -129,12 +142,16 @@
            <param>['ldaps','ldap']</param>
        </check>

+        <check name="valid_enum" target="lemon_user_db">
+            <param>['LDAP','AD']</param>
+        </check>
+
        <check name='valid_enum' target="lm_loglevel">
-            <param>['info','notice','warn','error','debug'</param>
+            <param>['info','notice','warn','error','debug']</param>
        </check>

        <check name="valid_enum" target="llRegisterDB">
-            <param>['LDAP','Demo','Custom']</param>
+            <param>['LDAP','AD','Demo','Custom']</param>
        </check>
        <group master="casAttribute">
            <slave>casLDAPAttribute</slave>
@ -173,6 +190,7 @@
        <condition name='disabled_if_in' source='llResetPassword'>
            <param>non</param>
            <target type='variable'>llResetUrl</target>
+            <target type='variable'>llResetExpiredPassword</target>
        </condition>
        <check name='valid_enum' target='llSkin'>
            <param>['bootstrap','dark','impact','pastel']</param>
--- a/dicos/71_lemonldap_ng_scribe.xml
+++ b/dicos/71_lemonldap_ng_scribe.xml
@ -6,20 +6,12 @@
    <variables>

        <family name='eole sso'>
-            <variable name='eolesso_adresse'  description="Nom de domaine du serveur d'authentification SSO" redefine="True" exists='True' />
-            <variable name='ldap_tls' redefine="True" exists='True' />
-	    <variable name='eolesso_cas_folder' redefine="True" exists='True'>
-		    <value>cas</value>
-	    </variable>
-	    <variable name='eolesso_port' redefine="True" exists='True'>
-		    <value>443</value>
-	    </variable>
+            <variable name='eolesso_adresse' description="Nom de domaine du serveur d'authentification SSO" redefine="True" exists='True' />
        </family>

    </variables>

    <constraints>
-
        <fill name='calc_multi_condition' target='activer_sso'>
            <param>oui</param>
            <param type='eole' name='condition_1'>activerLemon</param>
@ -32,11 +24,8 @@
            <target type='variable'>activer_sso</target>
        </condition>

-        <auto name='calc_multi_condition' target='ldapScheme'>
-            <param>oui</param>
-            <param type='eole' name='condition_1'>ldap_tls</param>
-            <param name='match'>ldaps</param>
-            <param name='default_mismatch'>ldap</param>
+        <auto name='calc_val' target='ldapScheme'>
+            <param>ldaps</param>
        </auto>

        <fill name='calc_val_first_value' target='eolesso_adresse'>
@ -45,29 +34,37 @@
            <param type='eole'>nom_domaine_machine</param>
        </fill>

+        <auto name='calc_val' target='ldap_port'>
+	    <param>636</param>
+	</auto>
+
        <condition name='frozen_if_in' source='activerLemon'>
            <param>oui</param>
            <target type='variable'>eolesso_adresse</target>
        </condition>

        <auto name='calc_val' target='ldapServer'>
-            <param type='eole'>adresse_ip_ldap</param>
+            <param type='eole'>ad_address</param>
        </auto>

        <auto name='calc_val' target='ldapServerPort'>
-            <param type='eole'>ldap_port</param>
+            <param type='number'>636</param>
        </auto>

-        <auto name='calc_val' target='ldapUserBaseDN'>
-            <param type='eole'>ldap_base_dn</param>
+        <auto name='calc_val' target='lemon_user_db'>
+            <param>AD</param>
+        </auto>
+
+        <auto name='calc_val' target='llRegisterDB'>
+            <param>AD</param>
        </auto>

        <auto name='calc_val' target='ldapBindUserDN'>
-            <param type='eole'>ldap_reader</param>
+            <param type='eole'>sasl_ldap_reader</param>
        </auto>

        <auto name='calc_val' target='ldapBindUserPassword'>
-            <param type='eole'>ldap_reader_passfile</param>
+	    <param>/etc/eole/private/sasl-reader.password</param>
        </auto>

        <auto name='calc_val' target='casFolder'>
--- a/tmpl/handler-apache2.X.conf
+++ b/tmpl/handler-apache2.X.conf
@ -29,6 +29,17 @@ ErrorDocument 503 https://%%authWebName/lmerror/503
 <VirtualHost %%adresse_ip_eth0:443>
    ServerName %%reloadWebName

+    SSLEngine on
+    SSLCertificateFile   %%server_cert
+    SSLCertificateKeyFile %%server_key
+    SSLCertificateChainFile /etc/ssl/certs/ca_local.crt
+    SSLProtocol all -SSLv3 -SSLv2
+    SSLProxyEngine on
+
+    LogLevel %%lm_loglevel
+
+    ErrorLog /var/log/apache2/handler_error.log
+    CustomLog /var/log/apache2/handler_access.log common
    # Configuration reload mechanism (only 1 per physical server is
    # needed): choose your URL to avoid restarting Apache when
    # configuration change
--- a/tmpl/lemonldap-ng.ini
+++ b/tmpl/lemonldap-ng.ini
@ -197,11 +197,11 @@ portalSkin = %%llSkin
 ; Modules displayed
 ;portalDisplayLogout = 1
 portalDisplayResetPassword = %%boolean[%%llResetPassword]
-;portalDisplayChangePassword = 1
+portalDisplayChangePassword = %%boolean[%%llChangePassword]
 ;portalDisplayAppslist = 1
 ;portalDisplayLoginHistory = 1
 ; Require the old password when changing password
-;portalRequireOldPassword = 1
+portalRequireOldPassword = %%boolean[%%llChangePassword]
 ; Attribute displayed as connected user
 ;portalUserAttr = mail
 ; Old menu HTML code
--- a/tmpl/lmConf-1.json
+++ b/tmpl/lmConf-1.json
@ -85,7 +85,7 @@
    },
    "authChoiceModules": {},
    "authChoiceParam": "lmAuth",
-    "authentication": "LDAP",
+    "authentication": "%%lemon_user_db",
    "browserIdAuthnLevel": 1,
    "captchaStorage": "Apache::Session::File",
    "captchaStorageOptions": {
@ -152,10 +152,37 @@
    "issuerDBSAMLRule": 1,
    "jsRedirect": 0,
    "key": "e\"bTCt3*eU9^\\V%b",
+%if %%llResetPassword == "oui"
+  %if %%llResetExpiredPassword == "oui"
+    %if %%lemon_user_db == "AD"
+    "ldapPpolicyControl": 0,
+    %else
+    "ldapPpolicyControl": 1,
+    %end if
+    "ldapAllowResetExpiredPassword": 1,
+    "ldapChangePasswordAsUser": 1,
+  %else
+    "ldapPpolicyControl": 0,
    "ldapAllowResetExpiredPassword": 0,
+    "ldapChangePasswordAsUser": 1,
+  %end if
+%end if
    "ldapAuthnLevel": 2,
+    "ldapSearchDeref": "find",
+%if %%eole_module == "scribe"
+    "ldapBase": "cn=Users,dc=%echo ",dc=".join(%%ad_domain.split('.')) + '",'
+    "ldapExportedVars": {
+        "cn": "cn",
+        "mail": "mail",
+        "uid": "cn"
+    },
+    "ldapGroupAttributeName": "memberUid",
+    "ldapGroupAttributeNameGroup": "dn",
+    "ldapGroupAttributeNameSearch": "cn",
+    "ldapGroupAttributeNameUser": "cn",
+    "ldapGroupObjectClass": "group",
+%else
    "ldapBase": "%%ldapUserBaseDN",
-    "ldapChangePasswordAsUser": 0,
    "ldapExportedVars": {
        "cn": "cn",
        "mail": "mail",
@ -166,13 +193,20 @@
    "ldapGroupAttributeNameSearch": "cn",
    "ldapGroupAttributeNameUser": "uid",
    "ldapGroupObjectClass": "eolegroupe",
+%end if
    "ldapGroupRecursive": 0,
    "ldapPasswordResetAttribute": "pwdReset",
    "ldapPasswordResetAttributeValue": "TRUE",
    "ldapPort": "%%ldapServerPort",
-    "ldapPpolicyControl": 0,
    "ldapPwdEnc": "utf-8",
    "ldapServer": "%%ldapScheme://%%ldapServer",
+%if %%ldapScheme == "ldaps"
+   %if %%lmldapverify == "oui"
+    "ldapVerify": "required",
+   %else
+    "ldapVerify": "none",
+   %end if
+%end if
    "ldapSetPassword": 0,
    "ldapTimeout": 120,
    "ldapUsePasswordResetAttribute": 1,
@ -212,13 +246,17 @@
    "mailTimeout": 0,
 %if %%llResetPassword == "oui"
    %if %%is_empty(%%llResetUrl)
-    "mailUrl": "https://%%authWebName/mail.pl",
+    "mailUrl": "https://%%authWebName/resetpwd",
    %else
    "mailUrl": "%%llResetUrl",
    %end if
 %end if
    "maintenance": 0,
+%if %%eole_module == "scribe"
+    "managerDn": "cn=%%ldapBindUserDN,cn=Users,dc=%echo ",dc=".join(%%ad_domain.split('.')) + '",'
+%else
    "managerDn": "%%ldapBindUserDN",
+%end if
 %if %%is_file(%%ldapBindUserPassword)
    "managerPassword": "%%readPass("", %%ldapBindUserPassword)",
 %else
@ -251,7 +289,7 @@
    "openIdSreg_fullname": "cn",
    "openIdSreg_nickname": "uid",
    "openIdSreg_timezone": "_timezone",
-    "passwordDB": "LDAP",
+    "passwordDB": "%%lemon_user_db",
    "persistentStorage": "Apache::Session::File",
    "persistentStorageOptions": {
        "Directory": "/var/lib/lemonldap-ng/psessions",
@ -261,7 +299,7 @@
    "portalAntiFrame": 1,
    "portalCheckLogins": %%boolean[%%llCheckLogins],
    "portalDisplayAppslist": 1,
-    "portalDisplayChangePassword": "$_auth =~ /^(LDAP|DBI|Demo)$/",
+    "portalDisplayChangePassword": "$_auth =~ /^(AD|LDAP|DBI|Demo)$/",
    "portalDisplayLoginHistory": 1,
    "portalDisplayLogout": 1,
    "portalDisplayRegister": 1,
@ -371,7 +409,7 @@
    "useRedirectOnForbidden": 0,
    "useSafeJail": 1,
    "userControl": "^[\\w\\.\\-@]+$",
-    "userDB": "LDAP",
+    "userDB": "%%lemon_user_db",
    "vhostOptions": {
        "%%managerWebName": {
            "vhostHttps": "1"
--- a/tmpl/manager-apache2.X.conf
+++ b/tmpl/manager-apache2.X.conf
@ -13,13 +13,13 @@
 <VirtualHost %%adresse_ip_eth0:443>
    ServerName %%managerWebName
    SSLEngine on
-    SSLCertificateFile    /etc/ssl/certs/eole.crt
-    SSLCertificateKeyFile /etc/ssl/private/eole.key
+    SSLCertificateFile    %%server_cert
+    SSLCertificateKeyFile %%server_key
    SSLCertificateChainFile /etc/ssl/certs/ca_local.crt
    SSLProtocol all -SSLv3 -SSLv2
    SSLProxyEngine on

-    LogLevel info
+    LogLevel %%lm_loglevel
    ErrorLog /var/log/apache2/manager_error.log
    CustomLog /var/log/apache2/manager_access.log common

--- a/tmpl/portal-apache2.X.conf
+++ b/tmpl/portal-apache2.X.conf
@ -13,13 +13,13 @@
 <VirtualHost %%adresse_ip_eth0:443>
    ServerName %%authWebName
    SSLEngine on
-    SSLCertificateFile    /etc/ssl/certs/eole.crt
-    SSLCertificateKeyFile /etc/ssl/private/eole.key
+    SSLCertificateFile    %%server_cert
+    SSLCertificateKeyFile %%server_key
    SSLCertificateChainFile /etc/ssl/certs/ca_local.crt
    SSLProtocol all -SSLv3 -SSLv2
    SSLProxyEngine on

-    LogLevel info
+    LogLevel %%lm_loglevel
    ErrorLog /var/log/apache2/portal_error.log
    CustomLog /var/log/apache2/portal_access.log common
Author	SHA1	Message	Date
Philippe Caseiro	9c967b27ed	Merge packaging from upstream	2020-12-09 09:42:51 +01:00
Philippe Caseiro	9b8e8acce3	Merge branch 'master' into dist/eole/2.7.2/master	2020-12-09 09:29:03 +01:00
Philippe Caseiro	b9b6176453	Updating packaging from eole	2020-12-09 09:28:26 +01:00
Philippe Caseiro	fe8722e776	Activer la possibilité de changer son mot de passe depuis LemonLDAP ref #31347	2020-12-07 16:06:55 +01:00
Philippe Caseiro	200c9c41e9	Using Active Directory (samba4) instead of OpenLDAP Moving to Active Directory the actual auth LDAP server The password is updated in the Samba4 directory so we need to use this one and not the OpenLDAP one	2020-12-03 16:52:33 +01:00
Philippe Caseiro	846b92b90f	Merge branch 'master' into dist/eole/2.7.2/master	2020-11-26 17:14:12 +01:00
Philippe Caseiro	63bf3c9f98	UserBaseDN and BaseDN is not the same thing We need to use the user base dn	2020-11-26 17:13:37 +01:00
Philippe Caseiro	25c5bf5768	Merge branch 'master' into dist/eole/2.7.2/master	2020-11-26 16:58:39 +01:00
Philippe Caseiro	03a00fb7ce	Cleanup ldap_tls redefine	2020-11-26 16:58:32 +01:00
Philippe Caseiro	28af340a58	Merge branch 'master' into dist/eole/2.7.2/master	2020-11-26 16:53:14 +01:00
Philippe Caseiro	52e5c433eb	Enable option for SSL verify	2020-11-26 16:53:02 +01:00
Philippe Caseiro	55a6529380	Merge branch 'master' into dist/eole/2.7.2/master	2020-11-26 14:09:28 +01:00
Philippe Caseiro	d1ad6aeb25	Fix lm_loglevel	2020-11-26 14:09:15 +01:00
Philippe Caseiro	b6cf7bb9e3	Fix bad merge	2020-11-26 14:04:51 +01:00