Fix ldapVerify values

this attributes and the variables names have to be named with the
same name

Makefile

@@ -3,9 +3,9 @@
 ################################
 
 SOURCE=eole-lemonldap
-VERSION=2.8
+VERSION=0.1
-EOLE_VERSION=2.8
+EOLE_VERSION=2.7
-EOLE_RELEASE=2.8.1
+EOLE_RELEASE=2.7.2
 PKGAPPS=non
 #FLASK_MODULE=<APPLICATION>
 

README.md

@@ -10,7 +10,7 @@ LemonLDAP::NG EOLE integration
 
 GenConfig -> Mode Expert -> Dépôts tiers -> Libellé du dépôt
 
-#### LemonLDAP::NG repository (if you use EOLE 2.7.2 this is not needed anymore)
+#### LemonLDAP::NG repository (if you use EOLE 2.8.X this is not needed anymore)
  
 * deb     https://lemonldap-ng.org/deb stable main
 * deb-src https://lemonldap-ng.org/deb stable main

dicos/70_lemonldap_ng.xml

@@ -9,6 +9,7 @@
         <file filelist='lemonldap-nginx' name='/etc/lemonldap-ng/manager-nginx.conf' mkdir='True' rm='True'/>
         <file filelist='lemonldap-nginx' name='/etc/lemonldap-ng/handler-nginx.conf' mkdir='True' rm='True'/>
         <file filelist='lemonldap-nginx' name='/etc/lemonldap-ng/portal-nginx.conf' mkdir='True' rm='True'/>
+        <file filelist='lemonldap-nginx' name='/etc/lemonldap-ng/nginx-lmlog.conf' mkdir='True' rm='True'/>
 
         <file filelist='lemonldap-apache' name='/etc/lemonldap-ng/manager-apache2.X.conf' mkdir='True' rm='True'/>
         <file filelist='lemonldap-apache' name='/etc/lemonldap-ng/handler-apache2.X.conf' mkdir='True' rm='True'/>
@@ -98,6 +99,12 @@
             <variable name='llChangePassword' type='oui/non' description="Permettre aux utilisateurs de changer leurs mots de passe depuis LemonLDAP">
                 <value>oui</value>
             </variable>
+            <variable name='llADPasswordMaxAge' type='number' description="Durée de vie des mots de passe (en secondes)" mode='expert'>
+                <value>5184000</value>
+            </variable>
+            <variable name='llADPasswordExpireWarn' type='number' description="Délai avant affichage d'un message d'alerte sur l'expiration du mot de passe (en secondes)">
+                <value>3456000</value>
+            </variable>
             <variable name='llResetExpiredPassword' type='oui/non' description="Autoriser le renouvellement des mots de passe expirés">
                 <value>oui</value>
             </variable>
@@ -157,6 +164,12 @@
             <slave>casLDAPAttribute</slave>
         </group>
 
+        <condition name='disabled_if_not_in' source='lemon_user_db'>
+            <param>AD</param>
+            <target type='variable'>llADPasswordMaxAge</target>
+            <target type='variable'>llADPasswordExpireWarn</target>
+        </condition>
+
         <condition name='disabled_if_in' source='activerLemon'>
             <param>non</param>
             <target type='filelist'>lemonldap</target>

dicos/71_lemonldap_ng_scribe.xml

@@ -24,9 +24,6 @@
             <target type='variable'>activer_sso</target>
         </condition>
 
-        <auto name='calc_val' target='ldapScheme'>
-            <param>ldaps</param>
-        </auto>
 
         <fill name='calc_val_first_value' target='eolesso_adresse'>
             <param type='eole' optional='True' hidden='False'>authWebName</param>
@@ -34,37 +31,42 @@
             <param type='eole'>nom_domaine_machine</param>
         </fill>
 
-        <auto name='calc_val' target='ldap_port'>
-	    <param>636</param>
-	</auto>
-
         <condition name='frozen_if_in' source='activerLemon'>
             <param>oui</param>
             <target type='variable'>eolesso_adresse</target>
         </condition>
 
+        <auto name='calc_multi_condition' target='ldapScheme'>
+            <param>oui</param>
+            <param type='eole' name='condition_1'>ldap_tls</param>
+            <param name='match'>ldaps</param>
+            <param name='default_mismatch'>ldap</param>
+        </auto>
+
         <auto name='calc_val' target='ldapServer'>
-            <param type='eole'>ad_address</param>
+            <param type='eole'>adresse_ip_ldap</param>
         </auto>
 
         <auto name='calc_val' target='ldapServerPort'>
-            <param type='number'>636</param>
+            <param type='eole'>ldap_port</param>
         </auto>
 
         <auto name='calc_val' target='lemon_user_db'>
-            <param>AD</param>
+            <param>LDAP</param>
         </auto>
 
         <auto name='calc_val' target='llRegisterDB'>
-            <param>AD</param>
+            <param>LDAP</param>
+        </auto>
+        <auto name='calc_val' target='ldapUserBaseDN'>
+            <param type='eole'>ldap_base_dn</param>
         </auto>
-
         <auto name='calc_val' target='ldapBindUserDN'>
-            <param type='eole'>sasl_ldap_reader</param>
+            <param type='eole'>ldap_reader</param>
         </auto>
 
         <auto name='calc_val' target='ldapBindUserPassword'>
-	    <param>/etc/eole/private/sasl-reader.password</param>
+	        <param type='eole'>ldap_reader_passfile</param>
         </auto>
 
         <auto name='calc_val' target='casFolder'>
@@ -75,4 +77,4 @@
 
     <help />
 
-</creole>
+</creole>

eole-lemonldap-ng.mk

@@ -0,0 +1,2 @@
+creolefuncs_DATA_DIR := $(DESTDIR)/usr/share/creole/funcs
+lemonldap-ng_DATA_DIR          := $(eole_DIR)/lemonldap-ng

eole-lemonldap.mk

@@ -1 +0,0 @@
-creolefuncs_DATA_DIR := $(DESTDIR)/usr/share/creole/funcs

lemonldap-ng/LDAP.pm

@@ -0,0 +1,102 @@
+package Lemonldap::NG::Portal::UserDB::LDAP;
+
+use strict;
+use Mouse;
+use utf8;
+use Lemonldap::NG::Portal::Main::Constants qw(PE_OK);
+
+extends 'Lemonldap::NG::Portal::Lib::LDAP';
+
+our $VERSION = '2.0.6';
+
+has ldapGroupAttributeNameSearch => (
+    is      => 'rw',
+    lazy    => 1,
+    builder => sub {
+        my $attributes = [];
+        @$attributes =
+          split( /\s+/, $_[0]->{conf}->{ldapGroupAttributeNameSearch} )
+          if $_[0]->{conf}->{ldapGroupAttributeNameSearch};
+        push( @$attributes, $_[0]->{conf}->{ldapGroupAttributeNameGroup} )
+          if (  $_[0]->{conf}->{ldapGroupRecursive}
+            and $_[0]->{conf}->{ldapGroupAttributeNameGroup} ne "dn" );
+        return $attributes;
+    }
+);
+
+# RUNNING METHODS
+#
+# getUser is provided by Portal::Lib::LDAP
+
+# Load all parameters included in exportedVars parameter.
+# Multi-value parameters are loaded in a single string with
+# a separator (param multiValuesSeparator)
+# @return Lemonldap::NG::Portal constant
+sub setSessionInfo {
+    my ( $self, $req ) = @_;
+    $req->{sessionInfo}->{_dn} = $req->data->{dn};
+
+    my %vars = ( %{ $self->conf->{exportedVars} },
+        %{ $self->conf->{ldapExportedVars} } );
+    while ( my ( $k, $v ) = each %vars ) {
+
+        # getLdapValue returns an empty string for missing attribute
+        # but we really want to return undef so they don't get stored in session
+        $req->sessionInfo->{$k} =
+          $self->ldap->getLdapValue( $req->data->{ldapentry}, $v ) || undef;
+    }
+
+    PE_OK;
+}
+
+# Load all groups in $groups.
+# @return Lemonldap::NG::Portal constant
+sub setGroups {
+    my ( $self, $req ) = @_;
+    my $groups  = $req->{sessionInfo}->{groups};
+    my $hGroups = $req->{sessionInfo}->{hGroups};
+
+    if ( $self->conf->{ldapGroupBase} ) {
+
+        # Get value for group search
+        my $group_value = $self->ldap->getLdapValue( $req->data->{ldapentry},
+            $self->conf->{ldapGroupAttributeNameUser} );
+
+        if ( $self->conf->{ldapGroupDecodeSearchedValue} ) {
+            utf8::decode($group_value);
+        }
+
+        $self->logger->debug( "Searching LDAP groups in "
+              . $self->conf->{ldapGroupBase}
+              . " for $group_value" );
+
+        # Call searchGroups
+        my $ldapGroups = $self->ldap->searchGroups(
+            $self->conf->{ldapGroupBase},
+            $self->conf->{ldapGroupAttributeName},
+            $group_value,
+            $self->ldapGroupAttributeNameSearch,
+            $req->{ldapGroupDuplicateCheck}
+        );
+
+        foreach ( keys %$ldapGroups ) {
+            my $groupName = $_;
+            $hGroups->{$groupName} = $ldapGroups->{$groupName};
+            my $groupValues = [];
+            foreach ( @{ $self->ldapGroupAttributeNameSearch } ) {
+                next if $_ =~ /^name$/;
+                my $firstValue = $ldapGroups->{$groupName}->{$_}->[0];
+                push @$groupValues, $firstValue;
+            }
+            $groups .= $self->conf->{multiValuesSeparator} if $groups;
+            $groups .= join( '|', @$groupValues );
+        }
+
+    }
+
+    $req->{sessionInfo}->{groups}  = $groups;
+    $req->{sessionInfo}->{hGroups} = $hGroups;
+    PE_OK;
+}
+
+1;

lemonldap-ng/LDAP.pm.patch

@@ -0,0 +1,20 @@
+--- /usr/share/perl5/Lemonldap/NG/Portal/UserDB/LDAP.pm.old	2019-12-11 12:05:54.000000000 +0100
++++ /usr/share/perl5/Lemonldap/NG/Portal/UserDB/LDAP.pm	2021-01-05 10:54:19.188732119 +0100
+@@ -40,10 +40,15 @@
+         %{ $self->conf->{ldapExportedVars} } );
+     while ( my ( $k, $v ) = each %vars ) {
+ 
++        my $value = $self->ldap->getLdapValue( $req->data->{ldapentry}, $v );
++
+         # getLdapValue returns an empty string for missing attribute
+         # but we really want to return undef so they don't get stored in session
+-        $req->sessionInfo->{$k} =
+-          $self->ldap->getLdapValue( $req->data->{ldapentry}, $v ) || undef;
++        # This has to be a string comparison because "0" is a valid attribute
++        # value. See #2403
++        $value = undef if ( $value eq "" );
++
++        $req->sessionInfo->{$k} = $value;
+     }
+ 
+     PE_OK;

posttemplate/70-lemonldap-patch

@@ -0,0 +1,12 @@
+#!/bin/bash
+
+# vérifie si le patch est déjà appliqué
+grep -q 2403 /usr/share/perl5/Lemonldap/NG/Portal/UserDB/LDAP.pm && exit 0
+
+# copie de sauvegarde
+cp -a /usr/share/perl5/Lemonldap/NG/Portal/UserDB/LDAP.pm /usr/share/eole/lemonldap-ng/
+
+# application du patch
+patch -d / -p 0 < /usr/share/eole/lemonldap-ng/LDAP.pm.patch
+
+exit 0

tmpl/handler-nginx.conf

@@ -23,8 +23,7 @@ server {
 }
 
 server {
-  listen 443;
+  listen 443 ssl;
-  ssl on;
 %if %%cert_type == "letsencrypt"
   ssl_certificate %%le_config_dir/live/%%managerWebName/cert.pem;
   ssl_certificate_key %%le_config_dir/live/%%managerWebName/privkey.pem;
@@ -62,7 +61,7 @@ server {
     deny all;
 
     # Uncomment this if you use https only
-    #add_header Strict-Transport-Security "max-age=15768000";
+    add_header Strict-Transport-Security "max-age=15768000";
   }
 
 }

tmpl/lmConf-1.json

@@ -1,20 +1,30 @@
 %set %%boolean = {'oui': 1, 'non': 0}
 %set %%ssoFilters = %%getSSOFilters
+%set %%ldapAttributes = {"uid": "uid", "mail": "mail", "cn":"cn"}
 %set %%exported_vars = ['"UA": "HTTP_USER_AGENT"']
 %set %%cas_attributes = []
+%set %%ldap_attributes = {}
 %for %%attr in %%casAttribute
-    %silent %%exported_vars.append('"' + %%attr + '": "' + %%attr + '.casLDAPAttribute"')
+    %silent %%exported_vars.append('"' + %%attr + '": "' + %%attr.casLDAPAttribute + '"')
-    %silent %%cas_attributes.append('"' + %%attr + '": "' + %%attr + '.casLDAPAttribute"')
+    %silent %%cas_attributes.append('"' + %%attr + '": "' + %%attr.casLDAPAttribute + '"')
+    %set %%ldap_attributes[%%attr.casLDAPAttribute] = %%attr.casLDAPAttribute
 %end for
 %for %%key, %%value in %%ssoFilters
     %silent %%exported_vars.append('"' + %%key + '": "' + %%value + '"')
     %silent %%cas_attributes.append('"' + %%key + '": "' + %%value + '"')
+    %set %%ldap_attributes[%%value] = %%value
 %end for
 %silent %%exported_vars.sort()
 %silent %%cas_attributes.sort()
+%set %%ldapAttr = []
+%for %%k, %%v in %%ldap_attributes.items()
+   %silent %%ldapAttr.append('"' + %%k + '": "' + %%v + '"')
+%end for
 {
-    "ADPwdExpireWarning": 0,
+%if %%lemon_user_db == "AD"
-    "ADPwdMaxAge": 0,
+    "ADPwdExpireWarning": %%llADPasswordExpireWarn,
+    "ADPwdMaxAge": %%llADPasswordMaxAge,
+%end if
     "CAS_authnLevel": 1,
     "CAS_pgtFile": "/tmp/pgt.txt",
     "CAS_proxiedServices": {},
@@ -169,31 +179,15 @@
 %end if
     "ldapAuthnLevel": 2,
     "ldapSearchDeref": "find",
-%if %%eole_module == "scribe"
-    "ldapBase": "cn=Users,dc=%echo ",dc=".join(%%ad_domain.split('.')) + '",'
-    "ldapExportedVars": {
-        "cn": "cn",
-        "mail": "mail",
-        "uid": "cn"
-    },
-    "ldapGroupAttributeName": "memberUid",
-    "ldapGroupAttributeNameGroup": "dn",
-    "ldapGroupAttributeNameSearch": "cn",
-    "ldapGroupAttributeNameUser": "cn",
-    "ldapGroupObjectClass": "group",
-%else
     "ldapBase": "%%ldapUserBaseDN",
     "ldapExportedVars": {
-        "cn": "cn",
+        %%custom_join(%%ldapAttr, ',\n        ')
-        "mail": "mail",
-        "uid": "uid"
     },
     "ldapGroupAttributeName": "memberUid",
     "ldapGroupAttributeNameGroup": "dn",
     "ldapGroupAttributeNameSearch": "cn",
     "ldapGroupAttributeNameUser": "uid",
     "ldapGroupObjectClass": "eolegroupe",
-%end if
     "ldapGroupRecursive": 0,
     "ldapPasswordResetAttribute": "pwdReset",
     "ldapPasswordResetAttributeValue": "TRUE",
@@ -202,9 +196,9 @@
     "ldapServer": "%%ldapScheme://%%ldapServer",
 %if %%ldapScheme == "ldaps"
    %if %%lmldapverify == "oui"
-    "ldapVerify": "required",
+    "ldapVerify": "Require",
    %else
-    "ldapVerify": "none",
+    "ldapVerify": "None",
    %end if
 %end if
     "ldapSetPassword": 0,
@@ -245,11 +239,7 @@
     %end if
 %end if
     "maintenance": 0,
-%if %%eole_module == "scribe"
-    "managerDn": "cn=%%ldapBindUserDN,cn=Users,dc=%echo ",dc=".join(%%ad_domain.split('.')) + '",'
-%else
     "managerDn": "%%ldapBindUserDN",
-%end if
 %if %%is_file(%%ldapBindUserPassword)
     "managerPassword": "%%readPass("", %%ldapBindUserPassword)",
 %else
@@ -295,7 +285,7 @@
     "portalDisplayChangePassword": "$_auth =~ /^(AD|LDAP|DBI|Demo)$/",
     "portalDisplayLoginHistory": 1,
     "portalDisplayLogout": 1,
-    "portalDisplayRegister": 1,
+    "portalDisplayRegister": %%boolean[%%llRegisterAccount],
     "portalDisplayResetPassword": %%boolean[%%llResetPassword],
     "portalForceAuthn": 0,
     "portalForceAuthnInterval": 0,

tmpl/manager-nginx.conf

@@ -5,8 +5,7 @@ server {
 }
 
 server {
-  listen 443;
+  listen 443 ssl;
-  ssl on;
   %if %%cert_type == "letsencrypt"
   ssl_certificate %%le_config_dir/live/%%managerWebName/cert.pem;
   ssl_certificate_key %%le_config_dir/live/%%managerWebName/privkey.pem;
@@ -70,8 +69,8 @@ server {
 
   # DEBIAN
   # If install was made with USEDEBIANLIBS (official releases), uncomment this
-  #location /javascript/ {
+  location /javascript/ {
-  #  alias /usr/share/javascript/;
+    alias /usr/share/javascript/;
-  #}
+  }
 
 }

tmpl/portal-nginx.conf

@@ -15,8 +15,7 @@ server {
 }
 
 server {
-  listen 443;
+  listen 443 ssl;
-  ssl on;
 %if %%cert_type == "letsencrypt"
   ssl_certificate %%le_config_dir/live/%%authWebName/cert.pem;
   ssl_certificate_key %%le_config_dir/live/%%authWebName/privkey.pem;
@@ -83,7 +82,7 @@ server {
 
   # DEBIAN
   # If install was made with USEDEBIANLIBS (official releases), uncomment this
-  #location /javascript/ {
+  location /javascript/ {
-  #  alias /usr/share/javascript/;
+    alias /usr/share/javascript/;
-  #}
+  }
 }