Merge remote-tracking branch 'eole/master' into develop

Merge branch '2.8.0/master'
set correct openldap conf
2020-12-18 16:53:36 +01:00 · 2020-12-16 10:31:04 +01:00 · 2020-12-16 10:30:33 +01:00 · 2020-12-14 14:04:43 +01:00 · 2020-12-14 14:04:09 +01:00 · 2020-12-14 10:25:37 +01:00
7 changed files with 47 additions and 51 deletions
--- a/6
+++ b/6
@ -3,9 +3,9 @@
 ################################

 SOURCE=eole-lemonldap
-VERSION=2.8
-EOLE_VERSION=2.8
-EOLE_RELEASE=2.8.1
+VERSION=0.1
+EOLE_VERSION=2.7
+EOLE_RELEASE=2.7.2
 PKGAPPS=non
 #FLASK_MODULE=<APPLICATION>

--- a/dicos/70_lemonldap_ng.xml
+++ b/dicos/70_lemonldap_ng.xml
@ -9,6 +9,7 @@
        <file filelist='lemonldap-nginx' name='/etc/lemonldap-ng/manager-nginx.conf' mkdir='True' rm='True'/>
        <file filelist='lemonldap-nginx' name='/etc/lemonldap-ng/handler-nginx.conf' mkdir='True' rm='True'/>
        <file filelist='lemonldap-nginx' name='/etc/lemonldap-ng/portal-nginx.conf' mkdir='True' rm='True'/>
+        <file filelist='lemonldap-nginx' name='/etc/lemonldap-ng/nginx-lmlog.conf' mkdir='True' rm='True'/>

        <file filelist='lemonldap-apache' name='/etc/lemonldap-ng/manager-apache2.X.conf' mkdir='True' rm='True'/>
        <file filelist='lemonldap-apache' name='/etc/lemonldap-ng/handler-apache2.X.conf' mkdir='True' rm='True'/>
@ -98,6 +99,12 @@
            <variable name='llChangePassword' type='oui/non' description="Permettre aux utilisateurs de changer leurs mots de passe depuis LemonLDAP">
                <value>oui</value>
            </variable>
+            <variable name='llADPasswordMaxAge' type='number' description="Durée de vie des mots de passe (en secondes)" mode='expert'>
+                <value>5184000</value>
+            </variable>
+            <variable name='llADPasswordExpireWarn' type='number' description="Délai avant affichage d'un message d'alerte sur l'expiration du mot de passe (en secondes)">
+                <value>3456000</value>
+            </variable>
            <variable name='llResetExpiredPassword' type='oui/non' description="Autoriser le renouvellement des mots de passe expirés">
                <value>oui</value>
            </variable>
@ -157,6 +164,12 @@
            <slave>casLDAPAttribute</slave>
        </group>

+        <condition name='disabled_if_not_in' source='lemon_user_db'>
+            <param>AD</param>
+            <target type='variable'>llADPasswordMaxAge</target>
+            <target type='variable'>llADPasswordExpireWarn</target>
+        </condition>
+
        <condition name='disabled_if_in' source='activerLemon'>
            <param>non</param>
            <target type='filelist'>lemonldap</target>
--- a/dicos/71_lemonldap_ng_scribe.xml
+++ b/dicos/71_lemonldap_ng_scribe.xml
@ -24,9 +24,6 @@
            <target type='variable'>activer_sso</target>
        </condition>

-        <auto name='calc_val' target='ldapScheme'>
-            <param>ldaps</param>
-        </auto>

        <fill name='calc_val_first_value' target='eolesso_adresse'>
            <param type='eole' optional='True' hidden='False'>authWebName</param>
@ -34,37 +31,42 @@
            <param type='eole'>nom_domaine_machine</param>
        </fill>

-        <auto name='calc_val' target='ldap_port'>
-	    <param>636</param>
-	</auto>
-
        <condition name='frozen_if_in' source='activerLemon'>
            <param>oui</param>
            <target type='variable'>eolesso_adresse</target>
        </condition>

+        <auto name='calc_multi_condition' target='ldapScheme'>
+            <param>oui</param>
+            <param type='eole' name='condition_1'>ldap_tls</param>
+            <param name='match'>ldaps</param>
+            <param name='default_mismatch'>ldap</param>
+        </auto>
+
        <auto name='calc_val' target='ldapServer'>
-            <param type='eole'>ad_address</param>
+            <param type='eole'>adresse_ip_ldap</param>
        </auto>

        <auto name='calc_val' target='ldapServerPort'>
-            <param type='number'>636</param>
+            <param type='eole'>ldap_port</param>
        </auto>

        <auto name='calc_val' target='lemon_user_db'>
-            <param>AD</param>
+            <param>LDAP</param>
        </auto>

        <auto name='calc_val' target='llRegisterDB'>
-            <param>AD</param>
+            <param>LDAP</param>
+        </auto>
+        <auto name='calc_val' target='ldapUserBaseDN'>
+            <param type='eole'>ldap_base_dn</param>
        </auto>
-
        <auto name='calc_val' target='ldapBindUserDN'>
-            <param type='eole'>sasl_ldap_reader</param>
+            <param type='eole'>ldap_reader</param>
        </auto>

        <auto name='calc_val' target='ldapBindUserPassword'>
-	    <param>/etc/eole/private/sasl-reader.password</param>
+	        <param type='eole'>ldap_reader_passfile</param>
        </auto>

        <auto name='calc_val' target='casFolder'>
@ -75,4 +77,4 @@

    <help />

-</creole>
+</creole>
--- a/tmpl/handler-nginx.conf
+++ b/tmpl/handler-nginx.conf
@ -23,8 +23,7 @@ server {
 }

 server {
-  listen 443;
-  ssl on;
+  listen 443 ssl;
 %if %%cert_type == "letsencrypt"
  ssl_certificate %%le_config_dir/live/%%managerWebName/cert.pem;
  ssl_certificate_key %%le_config_dir/live/%%managerWebName/privkey.pem;
@ -62,7 +61,7 @@ server {
    deny all;

    # Uncomment this if you use https only
-    #add_header Strict-Transport-Security "max-age=15768000";
+    add_header Strict-Transport-Security "max-age=15768000";
  }

 }
--- a/tmpl/lmConf-1.json
+++ b/tmpl/lmConf-1.json
@ -13,8 +13,10 @@
 %silent %%exported_vars.sort()
 %silent %%cas_attributes.sort()
 {
-    "ADPwdExpireWarning": 0,
-    "ADPwdMaxAge": 0,
+%if %%lemon_user_db == "AD"
+    "ADPwdExpireWarning": %%llADPasswordExpireWarn,
+    "ADPwdMaxAge": %%llADPasswordMaxAge,
+%end if
    "CAS_authnLevel": 1,
    "CAS_pgtFile": "/tmp/pgt.txt",
    "CAS_proxiedServices": {},
@ -169,19 +171,6 @@
 %end if
    "ldapAuthnLevel": 2,
    "ldapSearchDeref": "find",
-%if %%eole_module == "scribe"
-    "ldapBase": "cn=Users,dc=%echo ",dc=".join(%%ad_domain.split('.')) + '",'
-    "ldapExportedVars": {
-        "cn": "cn",
-        "mail": "mail",
-        "uid": "cn"
-    },
-    "ldapGroupAttributeName": "memberUid",
-    "ldapGroupAttributeNameGroup": "dn",
-    "ldapGroupAttributeNameSearch": "cn",
-    "ldapGroupAttributeNameUser": "cn",
-    "ldapGroupObjectClass": "group",
-%else
    "ldapBase": "%%ldapUserBaseDN",
    "ldapExportedVars": {
        "cn": "cn",
@ -193,7 +182,6 @@
    "ldapGroupAttributeNameSearch": "cn",
    "ldapGroupAttributeNameUser": "uid",
    "ldapGroupObjectClass": "eolegroupe",
-%end if
    "ldapGroupRecursive": 0,
    "ldapPasswordResetAttribute": "pwdReset",
    "ldapPasswordResetAttributeValue": "TRUE",
@ -245,11 +233,7 @@
    %end if
 %end if
    "maintenance": 0,
-%if %%eole_module == "scribe"
-    "managerDn": "cn=%%ldapBindUserDN,cn=Users,dc=%echo ",dc=".join(%%ad_domain.split('.')) + '",'
-%else
    "managerDn": "%%ldapBindUserDN",
-%end if
 %if %%is_file(%%ldapBindUserPassword)
    "managerPassword": "%%readPass("", %%ldapBindUserPassword)",
 %else
--- a/tmpl/manager-nginx.conf
+++ b/tmpl/manager-nginx.conf
@ -5,8 +5,7 @@ server {
 }

 server {
-  listen 443;
-  ssl on;
+  listen 443 ssl;
  %if %%cert_type == "letsencrypt"
  ssl_certificate %%le_config_dir/live/%%managerWebName/cert.pem;
  ssl_certificate_key %%le_config_dir/live/%%managerWebName/privkey.pem;
@ -70,8 +69,8 @@ server {

  # DEBIAN
  # If install was made with USEDEBIANLIBS (official releases), uncomment this
-  #location /javascript/ {
-  #  alias /usr/share/javascript/;
-  #}
+  location /javascript/ {
+    alias /usr/share/javascript/;
+  }

 }
--- a/tmpl/portal-nginx.conf
+++ b/tmpl/portal-nginx.conf
@ -15,8 +15,7 @@ server {
 }

 server {
-  listen 443;
-  ssl on;
+  listen 443 ssl;
 %if %%cert_type == "letsencrypt"
  ssl_certificate %%le_config_dir/live/%%authWebName/cert.pem;
  ssl_certificate_key %%le_config_dir/live/%%authWebName/privkey.pem;
@ -83,7 +82,7 @@ server {

  # DEBIAN
  # If install was made with USEDEBIANLIBS (official releases), uncomment this
-  #location /javascript/ {
-  #  alias /usr/share/javascript/;
-  #}
+  location /javascript/ {
+    alias /usr/share/javascript/;
+  }
 }
Author	SHA1	Message	Date
Philippe Caseiro	cc9a5e20ce	Merge remote-tracking branch 'eole/master' into develop	2020-12-18 16:53:36 +01:00
Matthieu Lamalle	5512f64aab	Merge branch '2.8.0/master'	2020-12-16 10:31:04 +01:00
Matthieu Lamalle	569e0caab8	set correct openldap conf	2020-12-16 10:30:33 +01:00
Matthieu Lamalle	bb18f68a54	Merge branch '2.8.0/master'	2020-12-14 14:04:43 +01:00
Matthieu Lamalle	20e382934c	set default openldap	2020-12-14 14:04:09 +01:00
Matthieu Lamalle	cf5d9485ca	Merge branch '2.8.0/master'	2020-12-14 10:25:37 +01:00
Matthieu Lamalle	cf82616454	correction on condition	2020-12-14 10:24:17 +01:00
Philippe Caseiro	e423388795	Merge branch '2.8.0/master'	2020-12-11 09:26:06 +01:00
Philippe Caseiro	e810740ba9	Adding AD password warning support	2020-12-11 09:25:41 +01:00
Philippe Caseiro	140cc084a3	Merge branch '2.8.0/master'	2020-12-09 17:17:56 +01:00
Philippe Caseiro	3753625b20	Updating nginx configuration for 2.8	2020-12-09 17:17:30 +01:00
Philippe Caseiro	df5dabbcf4	Merge branch '2.8.0/master'	2020-12-09 16:48:35 +01:00
Philippe Caseiro	47e822f9b9	Updating lmlog file for nginx mode	2020-12-09 16:48:14 +01:00
Philippe Caseiro	87818bd6f0	Activer la possibilité de changer son mot de passe depuis LemonLDAP ref #31347	2020-12-07 16:07:34 +01:00
Philippe Caseiro	bf94e74916	Using Active Directory (samba4) instead of OpenLDAP Moving to Active Directory the actual auth LDAP server The password is updated in the Samba4 directory so we need to use this one and not the OpenLDAP one	2020-12-03 16:50:55 +01:00
Philippe Caseiro	0f3ff07b5f	Merge last evolutions from master branch	2020-12-02 10:20:42 +01:00
Philippe Caseiro	74fb92fb55	Make eole-lemonldap-ng compatible with eolebase	2020-11-24 15:51:43 +01:00
vfebvre	ad9059bfae	passage en 2.7.2	2020-09-03 16:44:25 +02:00