Merge remote-tracking branch 'eole/master' into develop

Merge branch '2.8.0/master'
set correct openldap conf
2020-12-18 16:53:36 +01:00 · 2020-12-16 10:31:04 +01:00 · 2020-12-16 10:30:33 +01:00 · 2020-12-14 14:04:43 +01:00 · 2020-12-14 14:04:09 +01:00 · 2020-12-14 10:25:37 +01:00
15 changed files with 44 additions and 607 deletions
--- a/debian/control
+++ b/debian/control
@ -1,51 +0,0 @@
-Source: eole-lemonldap
-Section: web
-Priority: optional
-Maintainer: Équipe EOLE <eole@ac-dijon.fr>
-Build-Depends: debhelper (>= 9)
-Standards-Version: 3.9.3
-Homepage: https://dev-eole.ac-dijon.fr/projects/sso
-Vcs-Git: https://dev-eole.ac-dijon.fr/git/eole-lemonldap-ng.git
-Vcs-Browser: https://dev-eole.ac-dijon.fr/projects/sso/repository
-
-Package: eole-lemonldap
-Architecture: all
-Depends: eole-lemonldap-pkg,
-         ${misc:Depends}
-Description: Dictionnaires et templates pour la configuration d'un serveur LemonLDAP::NG
- Pour toute information complémentaire, veuillez vous rendre sur le
- site du projet EOLE.
-
-Package: eole-lemonldap-ng-scribe
-Architecture: all
-Depends: eole-scribe,
-         eole-lemonldap,
-	 libapache2-mod-perl2,
-         ${misc:Depends}
-Description: Dictionnaire pour calculer les valeurs automatiquement sur Scribe
- .
- Pour toute information complémentaire, veuillez vous rendre sur le
- site du projet EOLE.
-
-Package: eole-lemonldap-pkg
-Architecture: all
-Section: metapackages
-Depends: lemonldap-ng,
-         lemonldap-ng-doc,
-         lemonldap-ng-fastcgi-server,
-         lemonldap-ng-handler,
-         liblemonldap-ng-handler-perl,
-         liblemonldap-ng-manager-perl,
-         liblemonldap-ng-portal-perl,
-         libauthen-captcha-perl,
-         libauthen-sasl-perl,
-         libemail-sender-perl,
-         libgd-securityimage-perl,
-         libimage-magick-perl,
-         libio-string-perl,
-         liblasso-perl,
-         libnet-openid-server-perl,
-         ${misc:Depends}
-Description: Paquet de dépendances pour eole-lemonldap.
- .
- Pour toute information complémentaire, veuillez vous rendre sur la forge Cadoles.
--- a/debian/copyright
+++ b/debian/copyright
@ -1,37 +0,0 @@
-Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
-Upstream-Name: eole-lemonldap
-Source: http://dev-eole.ac-dijon.fr/projects/sso
-
-Files: *
-Copyright: 2020 Équipe EOLE <eole@ac-dijon.fr>
-License: CeCILL-C
-
-License: CeCILL-C
- This software is governed by the CeCILL-C license under French law and
- abiding by the rules of distribution of free software.  You can  use,
- modify and or redistribute the software under the terms of the CeCILL-C
- license as circulated by CEA, CNRS and INRIA at the following URL
- "http://www.cecill.info";.
- .
- As a counterpart to the access to the source code and  rights to copy,
- modify and redistribute granted by the license, users are provided only
- with a limited warranty  and the software's author,  the holder of the
- economic rights,  and the successive licensors  have only  limited
- liability.
- .
- In this respect, the user's attention is drawn to the risks associated
- with loading,  using,  modifying and/or developing or reproducing the
- software by the user in light of its specific status of free software,
- that may mean  that it is complicated to manipulate,  and  that  also
- therefore means  that it is reserved for developers  and  experienced
- professionals having in-depth computer knowledge. Users are therefore
- encouraged to load and test the software's suitability as regards their
- requirements in conditions enabling the security of their systems and/or
- data to be ensured and,  more generally, to use and operate it in the
- same conditions as regards security.
- .
- The fact that you are presently reading this means that you have had
- knowledge of the CeCILL-C license and that you accept its terms.
- .
- On Eole systems, the complete text of the CeCILL-C License can be found
- in `/usr/share/common-licenses/CeCILL-2'.
--- a/debian/eole-lemonldap-ng-scribe.install
+++ b/debian/eole-lemonldap-ng-scribe.install
@ -1,2 +0,0 @@
-usr/share/eole/creole/dicos/71_lemonldap_ng_scribe.xml
-usr/share/eole/postservice/98-lemonldap-ng-scribe-register-hosts
--- a/debian/eole-lemonldap.install
+++ b/debian/eole-lemonldap.install
@ -1,6 +0,0 @@
-usr/share/creole/
-usr/share/eole/creole/dicos/70_lemonldap_ng.xml
-usr/share/eole/creole/distrib/
-usr/share/eole/diagnose/
-usr/share/eole/postservice/99-lemonldap-ng
-usr/share/eole/posttemplate/
--- a/debian/gbp.conf
+++ b/debian/gbp.conf
@ -1,3 +0,0 @@
-# Set per distribution debian tag
-[DEFAULT]
-debian-tag = debian/eole/%(version)s
--- a/debian/rules
+++ b/debian/rules
@ -1,9 +0,0 @@
-#!/usr/bin/make -f
-# -*- makefile -*-
-
-# Uncomment this to turn on verbose mode.
-export DH_VERBOSE=1
-export DH_OPTIONS=-v
-
-%:
-	dh $@
--- a/debian/source/.format.un~
+++ b/debian/source/.format.un~
--- a/debian/source/format
+++ b/debian/source/format
@ -1 +0,0 @@
-3.0 (native)
--- a/dicos/70_lemonldap_ng.xml
+++ b/dicos/70_lemonldap_ng.xml
@ -9,6 +9,7 @@
        <file filelist='lemonldap-nginx' name='/etc/lemonldap-ng/manager-nginx.conf' mkdir='True' rm='True'/>
        <file filelist='lemonldap-nginx' name='/etc/lemonldap-ng/handler-nginx.conf' mkdir='True' rm='True'/>
        <file filelist='lemonldap-nginx' name='/etc/lemonldap-ng/portal-nginx.conf' mkdir='True' rm='True'/>
+        <file filelist='lemonldap-nginx' name='/etc/lemonldap-ng/nginx-lmlog.conf' mkdir='True' rm='True'/>

        <file filelist='lemonldap-apache' name='/etc/lemonldap-ng/manager-apache2.X.conf' mkdir='True' rm='True'/>
        <file filelist='lemonldap-apache' name='/etc/lemonldap-ng/handler-apache2.X.conf' mkdir='True' rm='True'/>
@ -98,6 +99,12 @@
            <variable name='llChangePassword' type='oui/non' description="Permettre aux utilisateurs de changer leurs mots de passe depuis LemonLDAP">
                <value>oui</value>
            </variable>
+            <variable name='llADPasswordMaxAge' type='number' description="Durée de vie des mots de passe (en secondes)" mode='expert'>
+                <value>5184000</value>
+            </variable>
+            <variable name='llADPasswordExpireWarn' type='number' description="Délai avant affichage d'un message d'alerte sur l'expiration du mot de passe (en secondes)">
+                <value>3456000</value>
+            </variable>
            <variable name='llResetExpiredPassword' type='oui/non' description="Autoriser le renouvellement des mots de passe expirés">
                <value>oui</value>
            </variable>
@ -157,6 +164,12 @@
            <slave>casLDAPAttribute</slave>
        </group>

+        <condition name='disabled_if_not_in' source='lemon_user_db'>
+            <param>AD</param>
+            <target type='variable'>llADPasswordMaxAge</target>
+            <target type='variable'>llADPasswordExpireWarn</target>
+        </condition>
+
        <condition name='disabled_if_in' source='activerLemon'>
            <param>non</param>
            <target type='filelist'>lemonldap</target>
--- a/dicos/71_lemonldap_ng_scribe.xml
+++ b/dicos/71_lemonldap_ng_scribe.xml
@ -24,9 +24,6 @@
            <target type='variable'>activer_sso</target>
        </condition>

-        <auto name='calc_val' target='ldapScheme'>
-            <param>ldaps</param>
-        </auto>

        <fill name='calc_val_first_value' target='eolesso_adresse'>
            <param type='eole' optional='True' hidden='False'>authWebName</param>
@ -34,37 +31,42 @@
            <param type='eole'>nom_domaine_machine</param>
        </fill>

-        <auto name='calc_val' target='ldap_port'>
-	    <param>636</param>
-	</auto>
-
        <condition name='frozen_if_in' source='activerLemon'>
            <param>oui</param>
            <target type='variable'>eolesso_adresse</target>
        </condition>

+        <auto name='calc_multi_condition' target='ldapScheme'>
+            <param>oui</param>
+            <param type='eole' name='condition_1'>ldap_tls</param>
+            <param name='match'>ldaps</param>
+            <param name='default_mismatch'>ldap</param>
+        </auto>
+
        <auto name='calc_val' target='ldapServer'>
-            <param type='eole'>ad_address</param>
+            <param type='eole'>adresse_ip_ldap</param>
        </auto>

        <auto name='calc_val' target='ldapServerPort'>
-            <param type='number'>636</param>
+            <param type='eole'>ldap_port</param>
        </auto>

        <auto name='calc_val' target='lemon_user_db'>
-            <param>AD</param>
+            <param>LDAP</param>
        </auto>

        <auto name='calc_val' target='llRegisterDB'>
-            <param>AD</param>
+            <param>LDAP</param>
+        </auto>
+        <auto name='calc_val' target='ldapUserBaseDN'>
+            <param type='eole'>ldap_base_dn</param>
        </auto>
-
        <auto name='calc_val' target='ldapBindUserDN'>
-            <param type='eole'>sasl_ldap_reader</param>
+            <param type='eole'>ldap_reader</param>
        </auto>

        <auto name='calc_val' target='ldapBindUserPassword'>
-	    <param>/etc/eole/private/sasl-reader.password</param>
+	        <param type='eole'>ldap_reader_passfile</param>
        </auto>

        <auto name='calc_val' target='casFolder'>
--- a/tmpl/handler-nginx.conf
+++ b/tmpl/handler-nginx.conf
@ -23,8 +23,7 @@ server {
 }

 server {
-  listen 443;
-  ssl on;
+  listen 443 ssl;
 %if %%cert_type == "letsencrypt"
  ssl_certificate %%le_config_dir/live/%%managerWebName/cert.pem;
  ssl_certificate_key %%le_config_dir/live/%%managerWebName/privkey.pem;
@ -62,7 +61,7 @@ server {
    deny all;

    # Uncomment this if you use https only
-    #add_header Strict-Transport-Security "max-age=15768000";
+    add_header Strict-Transport-Security "max-age=15768000";
  }

 }
--- a/tmpl/lmConf-1.js
+++ b/tmpl/lmConf-1.js
@ -1,443 +0,0 @@
-%set %%ssoFilters = %%getSSOFilters
-{
-    "ldapGroupAttributeNameUser": "dn",
-    "cfgAuthorIP": "172.16.0.1",
-    "samlSPMetaDataXML": null,
-    "facebookAuthnLevel": 1,
-    "mailConfirmSubject": "[LemonLDAP::NG] Password reset confirmation",
-    "secureTokenAttribute": "uid",
-    "singleSession": 0,
-    "registerConfirmSubject": "[LemonLDAP::NG] Account register confirmation",
-    "CAS_pgtFile": "/tmp/pgt.txt",
-    "cookieName": "lemonldap",
-    "slaveExportedVars": {},
-    "whatToTrace": "_whatToTrace",
-    "oidcRPMetaDataOptions": {},
-    "notifyDeleted": 1,
-    "useRedirectOnError": 1,
-    "samlSPMetaDataExportedAttributes": null,
-    "ldapPwdEnc": "utf-8",
-    "openIdSPList": "0;",
-    "samlNameIDFormatMapEmail": "mail",
-    "samlSPMetaDataOptions": null,
-    "issuerDBOpenIDRule": 1,
-    "casStorageOptions": {},
-    "mailFrom": "noreply@%%nom_domaine_local",
-    "timeoutActivity": 0,
-    "oidcRPMetaDataExportedVars": {},
-    "issuerDBSAMLActivation": 0,
-    "issuerDBCASPath": "^/%%casFolder/",
-    "randomPasswordRegexp": "[A-Z]{3}[a-z]{5}.\\d{2}",
-    "samlIDPSSODescriptorSingleSignOnServiceSOAP": "urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/singleSignOnSOAP;",
-    "samlSPSSODescriptorSingleLogoutServiceHTTPPost": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST;#PORTAL#/saml/proxySingleLogout;#PORTAL#/saml/proxySingleLogoutReturn",
-    "exportedHeaders": {
-        "test1.%%nom_domaine_local": {
-            "Auth-User": "$uid"
-        },
-        "test2.%%nom_domaine_local": {
-            "Auth-User": "$uid"
-        },
-        "%%managerWebName": {}
-    },
-    "vhostOptions": {
-        "%%managerWebName": {
-            "vhostHttps" : "1"
-        },
-        "test1.%%nom_domaine_local": {},
-        "test2.%%nom_domaine_local": {}
-    },
-    "radiusAuthnLevel": 3,
-    "dbiAuthnLevel": 2,
-    "ldapPasswordResetAttribute": "pwdReset",
-    "ldapGroupObjectClass": "groupOfNames",
-    "apacheAuthnLevel": 4,
-    "samlNameIDFormatMapKerberos": "uid",
-    "groups": {},
-    "securedCookie": 0,
-    "httpOnly": 1,
-    "yubikeyAuthnLevel": 3,
-    "ADPwdMaxAge": 0,
-    "samlUseQueryStringSpecific": 0,
-    "loginHistoryEnabled": 1,
-    "samlSPSSODescriptorSingleLogoutServiceSOAP": "urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/proxySingleLogoutSOAP;",
-    "failedLoginNumber": 5,
-    "samlServicePrivateKeyEncPwd": "",
-    "portalForceAuthnInterval": 0,
-    "cfgLog": "",
-    "samlIDPSSODescriptorSingleLogoutServiceHTTPRedirect": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect;#PORTAL#/saml/singleLogout;#PORTAL#/saml/singleLogoutReturn",
-    "exportedVars": {
-        "UA": "HTTP_USER_AGENT",
-%for att in %%casAttribute
-        "%%att": "%%att",
-%end for
-%set %%idx = 0
-%set %%size = %%len(%%ssoFilters) - 1
-%for key,value in %%ssoFilters
-    %if %%idx == %%size
-        "%%key": "%%value"
-    %else
-        "%%key": "%%value",
-    %end if
-        %set %%idx += 1
-%end for
-    },
-    "notificationStorage": "File",
-    "applicationList": {
-        "1sample": {
-            "test2": {
-                "options": {
-                    "name": "Application Test 2",
-                    "logo": "thumbnail.png",
-                    "uri": "https://test2.%%nom_domaine_local/",
-                    "display": "auto",
-                    "description": "The same simple application displaying authenticated user"
-                },
-                "type": "application"
-            },
-            "type": "category",
-            "catname": "Sample applications",
-            "test1": {
-                "type": "application",
-                "options": {
-                    "description": "A simple application displaying authenticated user",
-                    "uri": "https://test1.%%nom_domaine_local/",
-                    "logo": "demo.png",
-                    "display": "auto",
-                    "name": "Application Test 1"
-                }
-            }
-        },
-        "2administration": {
-            "notifications": {
-                "options": {
-                    "name": "Notifications explorer",
-                    "display": "auto",
-                    "description": "Explore WebSSO notifications",
-                    "uri": "https://%%managerWebName/notifications.pl",
-                    "logo": "database.png"
-                },
-                "type": "application"
-            },
-            "manager": {
-                "options": {
-                    "uri": "https://%%managerWebName/",
-                    "display": "auto",
-                    "description": "Configure LemonLDAP::NG WebSSO",
-                    "logo": "configure.png",
-                    "name": "WebSSO Manager"
-                },
-                "type": "application"
-            },
-            "type": "category",
-            "sessions": {
-                "type": "application",
-                "options": {
-                    "description": "Explore WebSSO sessions",
-                    "uri": "https://%%managerWebName/sessions.pl",
-                    "logo": "database.png",
-                    "display": "auto",
-                    "name": "Sessions explorer"
-                }
-            },
-            "catname": "Administration"
-        },
-        "3documentation": {
-            "catname": "Documentation",
-            "officialwebsite": {
-                "type": "application",
-                "options": {
-                    "name": "Offical Website",
-                    "description": "Official LemonLDAP::NG Website",
-                    "logo": "network.png",
-                    "display": "on",
-                    "uri": "http://lemonldap-ng.org/"
-                }
-            },
-            "type": "category",
-            "localdoc": {
-                "options": {
-                    "logo": "help.png",
-                    "description": "Documentation supplied with LemonLDAP::NG",
-                    "display": "on",
-                    "uri": "https://%%managerWebName/doc/",
-                    "name": "Local documentation"
-                },
-                "type": "application"
-            }
-        }
-    },
-    "userControl": "^[\\w\\.\\-@]+$",
-    "timeout": 72000,
-    "portalAntiFrame": 1,
-    "SMTPServer": "",
-    "ldapTimeout": 120,
-    "samlAuthnContextMapPasswordProtectedTransport": 3,
-    "ldapUsePasswordResetAttribute": 1,
-    "ldapPpolicyControl": 0,
-    "casAttributes": {
-%for att in %%casAttribute
-        "%%att": "%%att.casLDAPAttribute",
-%end for
-%set %%idx = 0
-%set %%size = %%len(%%ssoFilters) - 1
-%for key,value in %%ssoFilters
-    %if %%idx == %%size
-        "%%key": "%%key"
-    %else
-        "%%key": "%%key",
-    %end if
-        %set %%idx += 1
-%end for
-    },
-    "issuerDBSAMLPath": "^/saml/",
-    "samlAttributeAuthorityDescriptorAttributeServiceSOAP": "urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/AA/SOAP;",
-    "portalDisplayAppslist": 1,
-    "confirmFormMethod": "post",
-    "domain": "%%nom_domaine_local",
-    "cfgNum": "1",
-    "authentication": "LDAP",
-    "samlNameIDFormatMapWindows": "uid",
-    "authChoiceModules": {},
-    "ldapGroupAttributeName": "member",
-    "samlServicePrivateKeySigPwd": "",
-    "googleAuthnLevel": 1,
-    "successLoginNumber": 5,
-    "localSessionStorageOptions": {
-        "cache_root": "/tmp",
-        "namespace": "lemonldap-ng-sessions",
-        "default_expires_in": 600,
-        "directory_umask": "007",
-        "cache_depth": 3
-    },
-    "samlSPSSODescriptorArtifactResolutionServiceArtifact": "1;0;urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/artifact",
-    "portalRequireOldPassword": 1,
-    "samlIDPSSODescriptorSingleSignOnServiceHTTPArtifact": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact;#PORTAL#/saml/singleSignOnArtifact;",
-    "ADPwdExpireWarning": 0,
-    "yubikeyPublicIDSize": 12,
-    "ldapGroupAttributeNameGroup": "dn",
-    "oidcRPMetaDataOptionsExtraClaims": null,
-    "ldapGroupRecursive": 0,
-    "mailSubject": "[LemonLDAP::NG] Your new password",
-    "nginxCustomHandlers": {},
-    "samlSPSSODescriptorAuthnRequestsSigned": 1,
-%if %%llResetPassword == "oui"
-    "portalDisplayResetPassword": 1,
-%else
-    "portalDisplayResetPassword": 0,
-%end if
-    "openIdSreg_timezone": "_timezone",
-    "infoFormMethod": "get",
-    "openIdAuthnLevel": 1,
-    "openIdSreg_nickname": "uid",
-    "samlServicePublicKeyEnc": "",
-    "userDB": "LDAP",
-    "grantSessionRules": {},
-    "remoteGlobalStorage": "Lemonldap::NG::Common::Apache::Session::SOAP",
-    "reloadUrls": {
-        "%%reloadWebName": "https://%%reloadWebName/reload"
-    },
-    "registerTimeout": 0,
-    "samlIDPSSODescriptorSingleSignOnServiceHTTPPost": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST;#PORTAL#/saml/singleSignOn;",
-    "slaveAuthnLevel": 2,
-    "samlIDPSSODescriptorSingleLogoutServiceHTTPPost": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST;#PORTAL#/saml/singleLogout;#PORTAL#/saml/singleLogoutReturn",
-    "Soap": 1,
-%set %%RegisterDB=%%getVar('llRegisterDB', 'Demo')
-%if %%RegisterDB == "Custom"
-    "registerDB": "Null",
-%else
-    "registerDB": "%%RegisterDB",
-%end if
-    "locationRules": {
-        "%%managerWebName": {
-            "default": "$uid eq \"%%lemonAdmin\""
-        },
-        "test1.%%nom_domaine_local": {
-            "default": "accept",
-            "^/logout": "logout_sso"
-        },
-        "test2.%%nom_domaine_local": {
-            "default": "accept",
-            "^/logout": "logout_sso"
-        }
-    },
-    "portalDisplayChangePassword": "$_auth =~ /^(LDAP|DBI|Demo)$/",
-    "hideOldPassword": 0,
-%if %%is_file(%%ldapBindUserPassword)
-    "managerPassword": "%%readPass("", %%ldapBindUserPassword)",
-%else
-    "managerPassword": "%%ldapBindUserPassword",
-%end if
-    "authChoiceParam": "lmAuth",
-    "lwpSslOpts": {},
-    "portalSkinRules": {},
-    "issuerDBOpenIDPath": "^/openidserver/",
-    "redirectFormMethod": "get",
-    "portalDisplayRegister": 1,
-    "secureTokenMemcachedServers": "127.0.0.1:11211",
-    "notificationStorageOptions": {
-        "dirName": "/var/lib/lemonldap-ng/notifications"
-    },
-    "browserIdAuthnLevel": 1,
-    "portalUserAttr": "_user",
-    "ldapVersion": 3,
-    "sessionDataToRemember": {},
-    "samlNameIDFormatMapX509": "mail",
-    "managerDn": "%%ldapBindUserDN",
-    "mailSessionKey": "mail",
-    "openIdSreg_email": "mail",
-    "localSessionStorage": "Cache::FileCache",
-    "persistentStorage": "Apache::Session::File",
-    "mailOnPasswordChange": 0,
-    "captchaStorage": "Apache::Session::File",
-    "remoteGlobalStorageOptions": {
-        "proxy": "https://%%authWebName/index.pl/sessions",
-        "ns": "https://%%authWebName/Lemonldap/NG/Common/CGI/SOAPService"
-    },
-    "passwordDB": "LDAP",
-    "captcha_size": 6,
-    "mailCharset": "utf-8",
-    "facebookExportedVars": {},
-    "nullAuthnLevel": 2,
-    "singleIP": 0,
-    "dbiExportedVars": {},
-    "portalSkin": "bootstrap",
-    "storePassword": 0,
-    "hiddenAttributes": "_password",
-    "samlServicePrivateKeySig": "",
-    "globalStorage": "Apache::Session::File",
-    "notificationWildcard": "allusers",
-    "portalForceAuthn": 0,
-    "samlMetadataForceUTF8": 1,
-    "secureTokenUrls": ".*",
-    "secureTokenAllowOnError": 1,
-    "samlAuthnContextMapTLSClient": 5,
-    "ldapAllowResetExpiredPassword": 0,
-    "oidcOPMetaDataExportedVars": {},
-    "notifyOther": 0,
-    "secureTokenExpiration": 60,
-    "captcha_mail_enabled": 0,
-    "samlStorageOptions": {},
-    "samlOrganizationDisplayName": "Example",
-    "trustedProxies": "",
-    "secureTokenHeader": "Auth-Token",
-    "issuerDBCASActivation": 1,
-    "samlIDPSSODescriptorSingleSignOnServiceHTTPRedirect": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect;#PORTAL#/saml/singleSignOn;",
-    "samlSPSSODescriptorSingleLogoutServiceHTTPRedirect": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect;#PORTAL#/saml/proxySingleLogout;#PORTAL#/saml/proxySingleLogoutReturn",
-    "samlIDPMetaDataXML": {},
-    "oidcStorageOptions": {},
-    "cfgDate": 1519998069,
-    "samlAuthnContextMapPassword": 2,
-    "portalDisplayLoginHistory": 1,
-    "ldapPasswordResetAttributeValue": "TRUE",
-    "ldapServer": "%%ldapScheme://%%ldapServer",
-    "samlIDPSSODescriptorSingleLogoutServiceSOAP": "urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/singleLogoutSOAP;",
-    "samlIDPMetaDataExportedAttributes": null,
-    "samlServicePrivateKeyEnc": "",
-    "useRedirectOnForbidden": 0,
-    "captcha_login_enabled": 0,
-    "https": 0,
-    "checkXSS": 1,
-    "ldapSetPassword": 0,
-    "portalPingInterval": 60000,
-    "captchaStorageOptions": {
-        "Directory": "/var/lib/lemonldap-ng/captcha/"
-    },
-    "useSafeJail": 1,
-    "registerDoneSubject": "[LemonLDAP::NG] Your new account",
-    "issuerDBCASRule": 1,
-    "samlAuthnContextMapKerberos": 4,
-    "ldapGroupAttributeNameSearch": "cn",
-    "logoutServices": {},
-    "samlIDPSSODescriptorWantAuthnRequestsSigned": 1,
-    "portalDisplayLogout": 1,
-    "issuerDBGetParameters": {},
-    "googleExportedVars": {},
-    "openIdSreg_fullname": "cn",
-    "samlSPSSODescriptorAssertionConsumerServiceHTTPArtifact": "1;0;urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact;#PORTAL#/saml/proxySingleSignOnArtifact",
-    "demoExportedVars": {
-        "mail": "mail",
-        "uid": "uid",
-        "cn": "cn"
-    },
-    "oidcOPMetaDataJSON": null,
-    "samlIdPResolveCookie": "lemonldapidp",
-    "samlRelayStateTimeout": 600,
-    "samlOrganizationURL": "https://auth.%%nom_domaine_local",
-    "globalStorageOptions": {
-        "Directory": "/var/lib/lemonldap-ng/sessions",
-        "LockDirectory": "/var/lib/lemonldap-ng/sessions/lock"
-    },
-    "ldapExportedVars": {
-        "mail": "mail",
-        "cn": "cn",
-        "uid": "uid"
-    },
-    "webIDExportedVars": {},
-    "activeTimer": 1,
-    "cda": 0,
-    "samlServicePublicKeySig": "",
-%if %%llCheckLogins == "oui"
-    "portalCheckLogins": 1,
-%else
-    "portalCheckLogins": 0,
-%end if
-    "CAS_authnLevel": 1,
-    "macros": {
-        "_whatToTrace": "$_auth eq 'SAML' ? \"$_user\\@$_idpConfKey\" : \"$_user\""
-    },
-    "samlIDPMetaDataOptions": null,
-    "twitterAuthnLevel": 1,
-    "openIdExportedVars": {},
-    "captcha_register_enabled": 1,
-    "oidcOPMetaDataJWKS": null,
-    "webIDAuthnLevel": 1,
-    "issuerDBOpenIDActivation": "1",
-%if %%llResetPassword == "oui"
-  %if %%is_empty(%%llResetUrl)    
-    "mailUrl": "https://%%authWebName/mail.pl",
-  %else
-    "mailUrl": "%%llResetUrl",
-  %end if
-%end if
-    "maintenance": 0,
-    "jsRedirect": 0,
-    "cfgAuthor": "Cadoles",
-    "persistentStorageOptions": {
-        "LockDirectory": "/var/lib/lemonldap-ng/psessions/lock",
-        "Directory": "/var/lib/lemonldap-ng/psessions"
-    },
-    "SSLAuthnLevel": 5,
-    "oidcServiceMetaDataAuthnContext": {},
-    "samlIDPSSODescriptorArtifactResolutionServiceArtifact": "1;0;urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/artifact",
-    "notification": 1,
-    "ldapChangePasswordAsUser": 0,
-    "CAS_proxiedServices": {},
-    "key": "e\"bTCt3*eU9^\\V%b",
-    "portal": "https://%%authWebName/",
-    "singleSessionUserByIP": 0,
-    "portalOpenLinkInNewWindow": 0,
-    "post": {
-        "test2.%%nom_domaine_local": {},
-        "test1.%%nom_domaine_local": {},
-        "%%managerWebName": {}
-    },
-    "samlSPSSODescriptorAssertionConsumerServiceHTTPPost": "0;1;urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST;#PORTAL#/saml/proxySingleSignOnPost",
-    "issuerDBSAMLRule": 1,
-    "samlCommonDomainCookieActivation": 0,
-    "syslog": "",
-    "ldapBase": "%%ldapUserBaseDN",
-    "ldapAuthnLevel": 2,
-    "mailTimeout": 0,
-    "samlEntityID": "#PORTAL#/saml/metadata",
-    "oidcOPMetaDataOptions": null,
-    "samlSPSSODescriptorWantAssertionsSigned": 1,
-    "samlOrganizationName": "%%samlOrganizationName",
-%if %%RegisterDB == "Custom"
-    "registerUrl": "%%llRegisterURL",
-%else
-    "registerUrl": "https://%%authWebName/register.pl",
-%end if
-    "casAccessControlPolicy": "none",
-    "multiValuesSeparator": ";",
-    "ldapPort": %%ldapServerPort
-}
--- a/tmpl/lmConf-1.json
+++ b/tmpl/lmConf-1.json
@ -13,8 +13,10 @@
 %silent %%exported_vars.sort()
 %silent %%cas_attributes.sort()
 {
-    "ADPwdExpireWarning": 0,
-    "ADPwdMaxAge": 0,
+%if %%lemon_user_db == "AD"
+    "ADPwdExpireWarning": %%llADPasswordExpireWarn,
+    "ADPwdMaxAge": %%llADPasswordMaxAge,
+%end if
    "CAS_authnLevel": 1,
    "CAS_pgtFile": "/tmp/pgt.txt",
    "CAS_proxiedServices": {},
@ -169,19 +171,6 @@
 %end if
    "ldapAuthnLevel": 2,
    "ldapSearchDeref": "find",
-%if %%eole_module == "scribe"
-    "ldapBase": "cn=Users,dc=%echo ",dc=".join(%%ad_domain.split('.')) + '",'
-    "ldapExportedVars": {
-        "cn": "cn",
-        "mail": "mail",
-        "uid": "cn"
-    },
-    "ldapGroupAttributeName": "memberUid",
-    "ldapGroupAttributeNameGroup": "dn",
-    "ldapGroupAttributeNameSearch": "cn",
-    "ldapGroupAttributeNameUser": "cn",
-    "ldapGroupObjectClass": "group",
-%else
    "ldapBase": "%%ldapUserBaseDN",
    "ldapExportedVars": {
        "cn": "cn",
@ -193,7 +182,6 @@
    "ldapGroupAttributeNameSearch": "cn",
    "ldapGroupAttributeNameUser": "uid",
    "ldapGroupObjectClass": "eolegroupe",
-%end if
    "ldapGroupRecursive": 0,
    "ldapPasswordResetAttribute": "pwdReset",
    "ldapPasswordResetAttributeValue": "TRUE",
@ -230,13 +218,6 @@
    "macros": {
        "_whatToTrace": "$_auth eq 'SAML' ? \"$_user\\@$_idpConfKey\" : \"$_user\""
    },
-    "samlIDPMetaDataOptions": null,
-    "twitterAuthnLevel": 1,
-    "openIdExportedVars": {},
-    "captcha_register_enabled": 1,
-    "oidcOPMetaDataJWKS": null,
-    "webIDAuthnLevel": 1,
-    "issuerDBOpenIDActivation": "1",
    "mailCharset": "utf-8",
    "mailConfirmSubject": "[LemonLDAP::NG] Password reset confirmation",
    "mailFrom": "noreply@%%nom_domaine_local",
@ -252,11 +233,7 @@
    %end if
 %end if
    "maintenance": 0,
-%if %%eole_module == "scribe"
-    "managerDn": "cn=%%ldapBindUserDN,cn=Users,dc=%echo ",dc=".join(%%ad_domain.split('.')) + '",'
-%else
    "managerDn": "%%ldapBindUserDN",
-%end if
 %if %%is_file(%%ldapBindUserPassword)
    "managerPassword": "%%readPass("", %%ldapBindUserPassword)",
 %else
--- a/tmpl/manager-nginx.conf
+++ b/tmpl/manager-nginx.conf
@ -5,8 +5,7 @@ server {
 }

 server {
-  listen 443;
-  ssl on;
+  listen 443 ssl;
  %if %%cert_type == "letsencrypt"
  ssl_certificate %%le_config_dir/live/%%managerWebName/cert.pem;
  ssl_certificate_key %%le_config_dir/live/%%managerWebName/privkey.pem;
@ -70,8 +69,8 @@ server {

  # DEBIAN
  # If install was made with USEDEBIANLIBS (official releases), uncomment this
-  #location /javascript/ {
-  #  alias /usr/share/javascript/;
-  #}
+  location /javascript/ {
+    alias /usr/share/javascript/;
+  }

 }
--- a/tmpl/portal-nginx.conf
+++ b/tmpl/portal-nginx.conf
@ -15,8 +15,7 @@ server {
 }

 server {
-  listen 443;
-  ssl on;
+  listen 443 ssl;
 %if %%cert_type == "letsencrypt"
  ssl_certificate %%le_config_dir/live/%%authWebName/cert.pem;
  ssl_certificate_key %%le_config_dir/live/%%authWebName/privkey.pem;
@ -83,7 +82,7 @@ server {

  # DEBIAN
  # If install was made with USEDEBIANLIBS (official releases), uncomment this
-  #location /javascript/ {
-  #  alias /usr/share/javascript/;
-  #}
+  location /javascript/ {
+    alias /usr/share/javascript/;
+  }
 }
Author	SHA1	Message	Date
Philippe Caseiro	cc9a5e20ce	Merge remote-tracking branch 'eole/master' into develop	2020-12-18 16:53:36 +01:00
Matthieu Lamalle	5512f64aab	Merge branch '2.8.0/master'	2020-12-16 10:31:04 +01:00
Matthieu Lamalle	569e0caab8	set correct openldap conf	2020-12-16 10:30:33 +01:00
Matthieu Lamalle	bb18f68a54	Merge branch '2.8.0/master'	2020-12-14 14:04:43 +01:00
Matthieu Lamalle	20e382934c	set default openldap	2020-12-14 14:04:09 +01:00
Matthieu Lamalle	cf5d9485ca	Merge branch '2.8.0/master'	2020-12-14 10:25:37 +01:00
Matthieu Lamalle	cf82616454	correction on condition	2020-12-14 10:24:17 +01:00
Philippe Caseiro	e423388795	Merge branch '2.8.0/master'	2020-12-11 09:26:06 +01:00
Philippe Caseiro	e810740ba9	Adding AD password warning support	2020-12-11 09:25:41 +01:00
Philippe Caseiro	140cc084a3	Merge branch '2.8.0/master'	2020-12-09 17:17:56 +01:00
Philippe Caseiro	3753625b20	Updating nginx configuration for 2.8	2020-12-09 17:17:30 +01:00
Philippe Caseiro	df5dabbcf4	Merge branch '2.8.0/master'	2020-12-09 16:48:35 +01:00
Philippe Caseiro	47e822f9b9	Updating lmlog file for nginx mode	2020-12-09 16:48:14 +01:00
Philippe Caseiro	87818bd6f0	Activer la possibilité de changer son mot de passe depuis LemonLDAP ref #31347	2020-12-07 16:07:34 +01:00
Philippe Caseiro	bf94e74916	Using Active Directory (samba4) instead of OpenLDAP Moving to Active Directory the actual auth LDAP server The password is updated in the Samba4 directory so we need to use this one and not the OpenLDAP one	2020-12-03 16:50:55 +01:00
Philippe Caseiro	0f3ff07b5f	Merge last evolutions from master branch	2020-12-02 10:20:42 +01:00
Philippe Caseiro	74fb92fb55	Make eole-lemonldap-ng compatible with eolebase	2020-11-24 15:51:43 +01:00