Merge branch '2.8.0/master' into dist/eole/2.8.0/master

set default openldap
2020-12-14 14:04:25 +01:00 · 2020-12-14 14:04:09 +01:00 · 2020-12-14 10:25:13 +01:00 · 2020-12-14 10:24:17 +01:00 · 2020-12-11 09:25:49 +01:00 · 2020-12-11 09:25:41 +01:00
18 changed files with 57 additions and 540 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1,4 +0,0 @@
-# Backup and swap files
-*~
-*#
-*.swp
--- a/6
+++ b/6
@ -3,9 +3,9 @@
 ################################

 SOURCE=eole-lemonldap
-VERSION=0.1
-EOLE_VERSION=2.7
-EOLE_RELEASE=2.7.2
+VERSION=2.8.0
+EOLE_VERSION=2.8
+EOLE_RELEASE=2.8.0
 PKGAPPS=non
 #FLASK_MODULE=<APPLICATION>

--- a/README.md
+++ b/README.md
@ -4,27 +4,6 @@ LemonLDAP::NG EOLE integration

 ## Howto

-### Repository configuration
-
-* Add the lemonldap-ng deb respository we need the last version of LemonLDAP.
-
-GenConfig -> Mode Expert -> Dépôts tiers -> Libellé du dépôt
-
-#### LemonLDAP::NG repository (if you use EOLE 2.7.2 this is not needed anymore)
- 
-* deb     https://lemonldap-ng.org/deb stable main
-* deb-src https://lemonldap-ng.org/deb stable main
-* Key URL : https://lemonldap-ng.org/_media/rpm-gpg-key-ow2 
-
-#### Cadoles Repository
-* deb [ arch=all  ] https://vulcain.cadoles.com 2.7.2-dev main
-* Key URL : https://vulcain.cadoles.com/cadoles.gpg
-
-### Install packages
-
-apt update
-apt install eole-lemonldap
-
 ### Configure LemonLDAP in GenConfig

 * Enable lemonldap in "Services" tab
--- a/debian/compat
+++ b/debian/compat
@ -1 +0,0 @@
-10
--- a/debian/control
+++ b/debian/control
@ -1,16 +1,16 @@
-Source: eole-lemonldap
+Source: eole-lemonldap-ng
 Section: web
 Priority: optional
 Maintainer: Équipe EOLE <eole@ac-dijon.fr>
-Build-Depends: debhelper (>= 9)
-Standards-Version: 3.9.3
+Build-Depends: debhelper-compat (= 12)
+Standards-Version: 4.5.0
 Homepage: https://dev-eole.ac-dijon.fr/projects/sso
 Vcs-Git: https://dev-eole.ac-dijon.fr/git/eole-lemonldap-ng.git
 Vcs-Browser: https://dev-eole.ac-dijon.fr/projects/sso/repository

-Package: eole-lemonldap
+Package: eole-lemonldap-ng
 Architecture: all
-Depends: eole-lemonldap-pkg,
+Depends: eole-lemonldap-ng-pkg,
         ${misc:Depends}
 Description: Dictionnaires et templates pour la configuration d'un serveur LemonLDAP::NG
 Pour toute information complémentaire, veuillez vous rendre sur le
@ -19,7 +19,7 @@ Description: Dictionnaires et templates pour la configuration d'un serveur Lemon
 Package: eole-lemonldap-ng-scribe
 Architecture: all
 Depends: eole-scribe,
-         eole-lemonldap,
+         eole-lemonldap-ng,
 	 libapache2-mod-perl2,
         ${misc:Depends}
 Description: Dictionnaire pour calculer les valeurs automatiquement sur Scribe
@ -27,7 +27,7 @@ Description: Dictionnaire pour calculer les valeurs automatiquement sur Scribe
 Pour toute information complémentaire, veuillez vous rendre sur le
 site du projet EOLE.

-Package: eole-lemonldap-pkg
+Package: eole-lemonldap-ng-pkg
 Architecture: all
 Section: metapackages
 Depends: lemonldap-ng,
@ -44,6 +44,9 @@ Depends: lemonldap-ng,
         libimage-magick-perl,
         libio-string-perl,
         liblasso-perl,
+         libnet-ldap-perl,
+         libunicode-string-perl,
+         libmime-tools-perl,
         libnet-openid-server-perl,
         ${misc:Depends}
 Description: Paquet de dépendances pour eole-lemonldap.
--- a/debian/copyright
+++ b/debian/copyright
@ -1,6 +1,6 @@
 Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
-Upstream-Name: {PROJECT}
-Source: ${URL}
+Upstream-Name: eole-lemonldap-ng
+Source: http://dev-eole.ac-dijon.fr/projects/sso

 Files: *
 Copyright: 2020 Équipe EOLE <eole@ac-dijon.fr>
--- a/debian/eole-lemonldap-ng.install
+++ b/debian/eole-lemonldap-ng.install
--- a/debian/rules
+++ b/debian/rules
@ -2,8 +2,8 @@
 # -*- makefile -*-

 # Uncomment this to turn on verbose mode.
-#export DH_VERBOSE=1
-#export DH_OPTIONS=-v
+export DH_VERBOSE=1
+export DH_OPTIONS=-v

 %:
 	dh $@
--- a/debian/source/.format.un~
+++ b/debian/source/.format.un~
--- a/dicos/70_lemonldap_ng.xml
+++ b/dicos/70_lemonldap_ng.xml
@ -9,6 +9,7 @@
        <file filelist='lemonldap-nginx' name='/etc/lemonldap-ng/manager-nginx.conf' mkdir='True' rm='True'/>
        <file filelist='lemonldap-nginx' name='/etc/lemonldap-ng/handler-nginx.conf' mkdir='True' rm='True'/>
        <file filelist='lemonldap-nginx' name='/etc/lemonldap-ng/portal-nginx.conf' mkdir='True' rm='True'/>
+        <file filelist='lemonldap-nginx' name='/etc/lemonldap-ng/nginx-lmlog.conf' mkdir='True' rm='True'/>

        <file filelist='lemonldap-apache' name='/etc/lemonldap-ng/manager-apache2.X.conf' mkdir='True' rm='True'/>
        <file filelist='lemonldap-apache' name='/etc/lemonldap-ng/handler-apache2.X.conf' mkdir='True' rm='True'/>
@ -98,6 +99,12 @@
            <variable name='llChangePassword' type='oui/non' description="Permettre aux utilisateurs de changer leurs mots de passe depuis LemonLDAP">
                <value>oui</value>
            </variable>
+            <variable name='llADPasswordMaxAge' type='number' description="Durée de vie des mots de passe (en secondes)" mode='expert'>
+                <value>5184000</value>
+            </variable>
+            <variable name='llADPasswordExpireWarn' type='number' description="Délai avant affichage d'un message d'alerte sur l'expiration du mot de passe (en secondes)">
+                <value>3456000</value>
+            </variable>
            <variable name='llResetExpiredPassword' type='oui/non' description="Autoriser le renouvellement des mots de passe expirés">
                <value>oui</value>
            </variable>
@ -157,6 +164,12 @@
            <slave>casLDAPAttribute</slave>
        </group>

+        <condition name='disabled_if_not_in' source='lemon_user_db'>
+            <param>AD</param>
+            <target type='variable'>llADPasswordMaxAge</target>
+            <target type='variable'>llADPasswordExpireWarn</target>
+        </condition>
+
        <condition name='disabled_if_in' source='activerLemon'>
            <param>non</param>
            <target type='filelist'>lemonldap</target>
--- a/dicos/71_lemonldap_ng_scribe.xml
+++ b/dicos/71_lemonldap_ng_scribe.xml
@ -35,8 +35,8 @@
        </fill>

        <auto name='calc_val' target='ldap_port'>
-	    <param>636</param>
-	</auto>
+	        <param>389</param>
+	    </auto>

        <condition name='frozen_if_in' source='activerLemon'>
            <param>oui</param>
@ -48,17 +48,19 @@
        </auto>

        <auto name='calc_val' target='ldapServerPort'>
-            <param type='number'>636</param>
+            <param type='number'>389</param>
        </auto>

        <auto name='calc_val' target='lemon_user_db'>
-            <param>AD</param>
+            <param>LDAP</param>
        </auto>

        <auto name='calc_val' target='llRegisterDB'>
-            <param>AD</param>
+            <param>LDAP</param>
+        </auto>
+        <auto name='calc_val' target='ldapUserBaseDN'>
+            <param type='eole'>ldap_base_dn</param>
        </auto>
-
        <auto name='calc_val' target='ldapBindUserDN'>
            <param type='eole'>sasl_ldap_reader</param>
        </auto>
--- a/postservice/99-lemonldap-ng
+++ b/postservice/99-lemonldap-ng
@ -1,12 +1,6 @@
 #!/bin/bash

-
-[[ $(CreoleGet activerLemon non) == "non" ]] && exit 0
-
-# Updating Configuration cache
-
-cmd="/usr/share/lemonldap-ng/bin/lemonldap-ng-cli update-cache"
-opt="update-cache"
+[ "$(CreoleGet activerLemon non)" = 'oui' ] || exit 0

 # Updating Configuration cache
 /usr/share/lemonldap-ng/bin/lemonldap-ng-cli update-cache 2>&1
--- a/tmpl/handler-nginx.conf
+++ b/tmpl/handler-nginx.conf
@ -23,8 +23,7 @@ server {
 }

 server {
-  listen 443;
-  ssl on;
+  listen 443 ssl;
 %if %%cert_type == "letsencrypt"
  ssl_certificate %%le_config_dir/live/%%managerWebName/cert.pem;
  ssl_certificate_key %%le_config_dir/live/%%managerWebName/privkey.pem;
@ -62,7 +61,7 @@ server {
    deny all;

    # Uncomment this if you use https only
-    #add_header Strict-Transport-Security "max-age=15768000";
+    add_header Strict-Transport-Security "max-age=15768000";
  }

 }
--- a/tmpl/lemonldap-ng.ini
+++ b/tmpl/lemonldap-ng.ini
@ -36,7 +36,7 @@
 ;
 ; 1 - Defined logging level
 ;   Set here one of error, warn, notice, info or debug
-logLevel     = %%lm_loglevel
+logLevel     = debug
 ; Note that this has no effect for Apache2 logging: Apache LogLevel is used
 ; instead
 ;
@ -65,9 +65,9 @@ logLevel     = %%lm_loglevel
 ; 2.1 - Using Syslog
 ;
 ;   For Syslog logging, you can also overwrite facilities. Default values:
-logger             = Lemonldap::NG::Common::Logger::Syslog
-syslogFacility     = daemon
-userSyslogFacility = auth
+;logger             = Lemonldap::NG::Common::Logger::Syslog
+;syslogFacility     = daemon
+;userSyslogFacility = auth
 ;
 ; 2.2 - Using Log4perl
 ;
--- a/tmpl/lmConf-1.js
+++ b/tmpl/lmConf-1.js
@ -1,443 +0,0 @@
-%set %%ssoFilters = %%getSSOFilters
-{
-    "ldapGroupAttributeNameUser": "dn",
-    "cfgAuthorIP": "172.16.0.1",
-    "samlSPMetaDataXML": null,
-    "facebookAuthnLevel": 1,
-    "mailConfirmSubject": "[LemonLDAP::NG] Password reset confirmation",
-    "secureTokenAttribute": "uid",
-    "singleSession": 0,
-    "registerConfirmSubject": "[LemonLDAP::NG] Account register confirmation",
-    "CAS_pgtFile": "/tmp/pgt.txt",
-    "cookieName": "lemonldap",
-    "slaveExportedVars": {},
-    "whatToTrace": "_whatToTrace",
-    "oidcRPMetaDataOptions": {},
-    "notifyDeleted": 1,
-    "useRedirectOnError": 1,
-    "samlSPMetaDataExportedAttributes": null,
-    "ldapPwdEnc": "utf-8",
-    "openIdSPList": "0;",
-    "samlNameIDFormatMapEmail": "mail",
-    "samlSPMetaDataOptions": null,
-    "issuerDBOpenIDRule": 1,
-    "casStorageOptions": {},
-    "mailFrom": "noreply@%%nom_domaine_local",
-    "timeoutActivity": 0,
-    "oidcRPMetaDataExportedVars": {},
-    "issuerDBSAMLActivation": 0,
-    "issuerDBCASPath": "^/%%casFolder/",
-    "randomPasswordRegexp": "[A-Z]{3}[a-z]{5}.\\d{2}",
-    "samlIDPSSODescriptorSingleSignOnServiceSOAP": "urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/singleSignOnSOAP;",
-    "samlSPSSODescriptorSingleLogoutServiceHTTPPost": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST;#PORTAL#/saml/proxySingleLogout;#PORTAL#/saml/proxySingleLogoutReturn",
-    "exportedHeaders": {
-        "test1.%%nom_domaine_local": {
-            "Auth-User": "$uid"
-        },
-        "test2.%%nom_domaine_local": {
-            "Auth-User": "$uid"
-        },
-        "%%managerWebName": {}
-    },
-    "vhostOptions": {
-        "%%managerWebName": {
-            "vhostHttps" : "1"
-        },
-        "test1.%%nom_domaine_local": {},
-        "test2.%%nom_domaine_local": {}
-    },
-    "radiusAuthnLevel": 3,
-    "dbiAuthnLevel": 2,
-    "ldapPasswordResetAttribute": "pwdReset",
-    "ldapGroupObjectClass": "groupOfNames",
-    "apacheAuthnLevel": 4,
-    "samlNameIDFormatMapKerberos": "uid",
-    "groups": {},
-    "securedCookie": 0,
-    "httpOnly": 1,
-    "yubikeyAuthnLevel": 3,
-    "ADPwdMaxAge": 0,
-    "samlUseQueryStringSpecific": 0,
-    "loginHistoryEnabled": 1,
-    "samlSPSSODescriptorSingleLogoutServiceSOAP": "urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/proxySingleLogoutSOAP;",
-    "failedLoginNumber": 5,
-    "samlServicePrivateKeyEncPwd": "",
-    "portalForceAuthnInterval": 0,
-    "cfgLog": "",
-    "samlIDPSSODescriptorSingleLogoutServiceHTTPRedirect": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect;#PORTAL#/saml/singleLogout;#PORTAL#/saml/singleLogoutReturn",
-    "exportedVars": {
-        "UA": "HTTP_USER_AGENT",
-%for att in %%casAttribute
-        "%%att": "%%att",
-%end for
-%set %%idx = 0
-%set %%size = %%len(%%ssoFilters) - 1
-%for key,value in %%ssoFilters
-    %if %%idx == %%size
-        "%%key": "%%value"
-    %else
-        "%%key": "%%value",
-    %end if
-        %set %%idx += 1
-%end for
-    },
-    "notificationStorage": "File",
-    "applicationList": {
-        "1sample": {
-            "test2": {
-                "options": {
-                    "name": "Application Test 2",
-                    "logo": "thumbnail.png",
-                    "uri": "https://test2.%%nom_domaine_local/",
-                    "display": "auto",
-                    "description": "The same simple application displaying authenticated user"
-                },
-                "type": "application"
-            },
-            "type": "category",
-            "catname": "Sample applications",
-            "test1": {
-                "type": "application",
-                "options": {
-                    "description": "A simple application displaying authenticated user",
-                    "uri": "https://test1.%%nom_domaine_local/",
-                    "logo": "demo.png",
-                    "display": "auto",
-                    "name": "Application Test 1"
-                }
-            }
-        },
-        "2administration": {
-            "notifications": {
-                "options": {
-                    "name": "Notifications explorer",
-                    "display": "auto",
-                    "description": "Explore WebSSO notifications",
-                    "uri": "https://%%managerWebName/notifications.pl",
-                    "logo": "database.png"
-                },
-                "type": "application"
-            },
-            "manager": {
-                "options": {
-                    "uri": "https://%%managerWebName/",
-                    "display": "auto",
-                    "description": "Configure LemonLDAP::NG WebSSO",
-                    "logo": "configure.png",
-                    "name": "WebSSO Manager"
-                },
-                "type": "application"
-            },
-            "type": "category",
-            "sessions": {
-                "type": "application",
-                "options": {
-                    "description": "Explore WebSSO sessions",
-                    "uri": "https://%%managerWebName/sessions.pl",
-                    "logo": "database.png",
-                    "display": "auto",
-                    "name": "Sessions explorer"
-                }
-            },
-            "catname": "Administration"
-        },
-        "3documentation": {
-            "catname": "Documentation",
-            "officialwebsite": {
-                "type": "application",
-                "options": {
-                    "name": "Offical Website",
-                    "description": "Official LemonLDAP::NG Website",
-                    "logo": "network.png",
-                    "display": "on",
-                    "uri": "http://lemonldap-ng.org/"
-                }
-            },
-            "type": "category",
-            "localdoc": {
-                "options": {
-                    "logo": "help.png",
-                    "description": "Documentation supplied with LemonLDAP::NG",
-                    "display": "on",
-                    "uri": "https://%%managerWebName/doc/",
-                    "name": "Local documentation"
-                },
-                "type": "application"
-            }
-        }
-    },
-    "userControl": "^[\\w\\.\\-@]+$",
-    "timeout": 72000,
-    "portalAntiFrame": 1,
-    "SMTPServer": "",
-    "ldapTimeout": 120,
-    "samlAuthnContextMapPasswordProtectedTransport": 3,
-    "ldapUsePasswordResetAttribute": 1,
-    "ldapPpolicyControl": 0,
-    "casAttributes": {
-%for att in %%casAttribute
-        "%%att": "%%att.casLDAPAttribute",
-%end for
-%set %%idx = 0
-%set %%size = %%len(%%ssoFilters) - 1
-%for key,value in %%ssoFilters
-    %if %%idx == %%size
-        "%%key": "%%key"
-    %else
-        "%%key": "%%key",
-    %end if
-        %set %%idx += 1
-%end for
-    },
-    "issuerDBSAMLPath": "^/saml/",
-    "samlAttributeAuthorityDescriptorAttributeServiceSOAP": "urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/AA/SOAP;",
-    "portalDisplayAppslist": 1,
-    "confirmFormMethod": "post",
-    "domain": "%%nom_domaine_local",
-    "cfgNum": "1",
-    "authentication": "LDAP",
-    "samlNameIDFormatMapWindows": "uid",
-    "authChoiceModules": {},
-    "ldapGroupAttributeName": "member",
-    "samlServicePrivateKeySigPwd": "",
-    "googleAuthnLevel": 1,
-    "successLoginNumber": 5,
-    "localSessionStorageOptions": {
-        "cache_root": "/tmp",
-        "namespace": "lemonldap-ng-sessions",
-        "default_expires_in": 600,
-        "directory_umask": "007",
-        "cache_depth": 3
-    },
-    "samlSPSSODescriptorArtifactResolutionServiceArtifact": "1;0;urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/artifact",
-    "portalRequireOldPassword": 1,
-    "samlIDPSSODescriptorSingleSignOnServiceHTTPArtifact": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact;#PORTAL#/saml/singleSignOnArtifact;",
-    "ADPwdExpireWarning": 0,
-    "yubikeyPublicIDSize": 12,
-    "ldapGroupAttributeNameGroup": "dn",
-    "oidcRPMetaDataOptionsExtraClaims": null,
-    "ldapGroupRecursive": 0,
-    "mailSubject": "[LemonLDAP::NG] Your new password",
-    "nginxCustomHandlers": {},
-    "samlSPSSODescriptorAuthnRequestsSigned": 1,
-%if %%llResetPassword == "oui"
-    "portalDisplayResetPassword": 1,
-%else
-    "portalDisplayResetPassword": 0,
-%end if
-    "openIdSreg_timezone": "_timezone",
-    "infoFormMethod": "get",
-    "openIdAuthnLevel": 1,
-    "openIdSreg_nickname": "uid",
-    "samlServicePublicKeyEnc": "",
-    "userDB": "LDAP",
-    "grantSessionRules": {},
-    "remoteGlobalStorage": "Lemonldap::NG::Common::Apache::Session::SOAP",
-    "reloadUrls": {
-        "%%reloadWebName": "https://%%reloadWebName/reload"
-    },
-    "registerTimeout": 0,
-    "samlIDPSSODescriptorSingleSignOnServiceHTTPPost": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST;#PORTAL#/saml/singleSignOn;",
-    "slaveAuthnLevel": 2,
-    "samlIDPSSODescriptorSingleLogoutServiceHTTPPost": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST;#PORTAL#/saml/singleLogout;#PORTAL#/saml/singleLogoutReturn",
-    "Soap": 1,
-%set %%RegisterDB=%%getVar('llRegisterDB', 'Demo')
-%if %%RegisterDB == "Custom"
-    "registerDB": "Null",
-%else
-    "registerDB": "%%RegisterDB",
-%end if
-    "locationRules": {
-        "%%managerWebName": {
-            "default": "$uid eq \"%%lemonAdmin\""
-        },
-        "test1.%%nom_domaine_local": {
-            "default": "accept",
-            "^/logout": "logout_sso"
-        },
-        "test2.%%nom_domaine_local": {
-            "default": "accept",
-            "^/logout": "logout_sso"
-        }
-    },
-    "portalDisplayChangePassword": "$_auth =~ /^(LDAP|DBI|Demo)$/",
-    "hideOldPassword": 0,
-%if %%is_file(%%ldapBindUserPassword)
-    "managerPassword": "%%readPass("", %%ldapBindUserPassword)",
-%else
-    "managerPassword": "%%ldapBindUserPassword",
-%end if
-    "authChoiceParam": "lmAuth",
-    "lwpSslOpts": {},
-    "portalSkinRules": {},
-    "issuerDBOpenIDPath": "^/openidserver/",
-    "redirectFormMethod": "get",
-    "portalDisplayRegister": 1,
-    "secureTokenMemcachedServers": "127.0.0.1:11211",
-    "notificationStorageOptions": {
-        "dirName": "/var/lib/lemonldap-ng/notifications"
-    },
-    "browserIdAuthnLevel": 1,
-    "portalUserAttr": "_user",
-    "ldapVersion": 3,
-    "sessionDataToRemember": {},
-    "samlNameIDFormatMapX509": "mail",
-    "managerDn": "%%ldapBindUserDN",
-    "mailSessionKey": "mail",
-    "openIdSreg_email": "mail",
-    "localSessionStorage": "Cache::FileCache",
-    "persistentStorage": "Apache::Session::File",
-    "mailOnPasswordChange": 0,
-    "captchaStorage": "Apache::Session::File",
-    "remoteGlobalStorageOptions": {
-        "proxy": "https://%%authWebName/index.pl/sessions",
-        "ns": "https://%%authWebName/Lemonldap/NG/Common/CGI/SOAPService"
-    },
-    "passwordDB": "LDAP",
-    "captcha_size": 6,
-    "mailCharset": "utf-8",
-    "facebookExportedVars": {},
-    "nullAuthnLevel": 2,
-    "singleIP": 0,
-    "dbiExportedVars": {},
-    "portalSkin": "bootstrap",
-    "storePassword": 0,
-    "hiddenAttributes": "_password",
-    "samlServicePrivateKeySig": "",
-    "globalStorage": "Apache::Session::File",
-    "notificationWildcard": "allusers",
-    "portalForceAuthn": 0,
-    "samlMetadataForceUTF8": 1,
-    "secureTokenUrls": ".*",
-    "secureTokenAllowOnError": 1,
-    "samlAuthnContextMapTLSClient": 5,
-    "ldapAllowResetExpiredPassword": 0,
-    "oidcOPMetaDataExportedVars": {},
-    "notifyOther": 0,
-    "secureTokenExpiration": 60,
-    "captcha_mail_enabled": 0,
-    "samlStorageOptions": {},
-    "samlOrganizationDisplayName": "Example",
-    "trustedProxies": "",
-    "secureTokenHeader": "Auth-Token",
-    "issuerDBCASActivation": 1,
-    "samlIDPSSODescriptorSingleSignOnServiceHTTPRedirect": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect;#PORTAL#/saml/singleSignOn;",
-    "samlSPSSODescriptorSingleLogoutServiceHTTPRedirect": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect;#PORTAL#/saml/proxySingleLogout;#PORTAL#/saml/proxySingleLogoutReturn",
-    "samlIDPMetaDataXML": {},
-    "oidcStorageOptions": {},
-    "cfgDate": 1519998069,
-    "samlAuthnContextMapPassword": 2,
-    "portalDisplayLoginHistory": 1,
-    "ldapPasswordResetAttributeValue": "TRUE",
-    "ldapServer": "%%ldapScheme://%%ldapServer",
-    "samlIDPSSODescriptorSingleLogoutServiceSOAP": "urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/singleLogoutSOAP;",
-    "samlIDPMetaDataExportedAttributes": null,
-    "samlServicePrivateKeyEnc": "",
-    "useRedirectOnForbidden": 0,
-    "captcha_login_enabled": 0,
-    "https": 0,
-    "checkXSS": 1,
-    "ldapSetPassword": 0,
-    "portalPingInterval": 60000,
-    "captchaStorageOptions": {
-        "Directory": "/var/lib/lemonldap-ng/captcha/"
-    },
-    "useSafeJail": 1,
-    "registerDoneSubject": "[LemonLDAP::NG] Your new account",
-    "issuerDBCASRule": 1,
-    "samlAuthnContextMapKerberos": 4,
-    "ldapGroupAttributeNameSearch": "cn",
-    "logoutServices": {},
-    "samlIDPSSODescriptorWantAuthnRequestsSigned": 1,
-    "portalDisplayLogout": 1,
-    "issuerDBGetParameters": {},
-    "googleExportedVars": {},
-    "openIdSreg_fullname": "cn",
-    "samlSPSSODescriptorAssertionConsumerServiceHTTPArtifact": "1;0;urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact;#PORTAL#/saml/proxySingleSignOnArtifact",
-    "demoExportedVars": {
-        "mail": "mail",
-        "uid": "uid",
-        "cn": "cn"
-    },
-    "oidcOPMetaDataJSON": null,
-    "samlIdPResolveCookie": "lemonldapidp",
-    "samlRelayStateTimeout": 600,
-    "samlOrganizationURL": "https://auth.%%nom_domaine_local",
-    "globalStorageOptions": {
-        "Directory": "/var/lib/lemonldap-ng/sessions",
-        "LockDirectory": "/var/lib/lemonldap-ng/sessions/lock"
-    },
-    "ldapExportedVars": {
-        "mail": "mail",
-        "cn": "cn",
-        "uid": "uid"
-    },
-    "webIDExportedVars": {},
-    "activeTimer": 1,
-    "cda": 0,
-    "samlServicePublicKeySig": "",
-%if %%llCheckLogins == "oui"
-    "portalCheckLogins": 1,
-%else
-    "portalCheckLogins": 0,
-%end if
-    "CAS_authnLevel": 1,
-    "macros": {
-        "_whatToTrace": "$_auth eq 'SAML' ? \"$_user\\@$_idpConfKey\" : \"$_user\""
-    },
-    "samlIDPMetaDataOptions": null,
-    "twitterAuthnLevel": 1,
-    "openIdExportedVars": {},
-    "captcha_register_enabled": 1,
-    "oidcOPMetaDataJWKS": null,
-    "webIDAuthnLevel": 1,
-    "issuerDBOpenIDActivation": "1",
-%if %%llResetPassword == "oui"
-  %if %%is_empty(%%llResetUrl)    
-    "mailUrl": "https://%%authWebName/mail.pl",
-  %else
-    "mailUrl": "%%llResetUrl",
-  %end if
-%end if
-    "maintenance": 0,
-    "jsRedirect": 0,
-    "cfgAuthor": "Cadoles",
-    "persistentStorageOptions": {
-        "LockDirectory": "/var/lib/lemonldap-ng/psessions/lock",
-        "Directory": "/var/lib/lemonldap-ng/psessions"
-    },
-    "SSLAuthnLevel": 5,
-    "oidcServiceMetaDataAuthnContext": {},
-    "samlIDPSSODescriptorArtifactResolutionServiceArtifact": "1;0;urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/artifact",
-    "notification": 1,
-    "ldapChangePasswordAsUser": 0,
-    "CAS_proxiedServices": {},
-    "key": "e\"bTCt3*eU9^\\V%b",
-    "portal": "https://%%authWebName/",
-    "singleSessionUserByIP": 0,
-    "portalOpenLinkInNewWindow": 0,
-    "post": {
-        "test2.%%nom_domaine_local": {},
-        "test1.%%nom_domaine_local": {},
-        "%%managerWebName": {}
-    },
-    "samlSPSSODescriptorAssertionConsumerServiceHTTPPost": "0;1;urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST;#PORTAL#/saml/proxySingleSignOnPost",
-    "issuerDBSAMLRule": 1,
-    "samlCommonDomainCookieActivation": 0,
-    "syslog": "",
-    "ldapBase": "%%ldapUserBaseDN",
-    "ldapAuthnLevel": 2,
-    "mailTimeout": 0,
-    "samlEntityID": "#PORTAL#/saml/metadata",
-    "oidcOPMetaDataOptions": null,
-    "samlSPSSODescriptorWantAssertionsSigned": 1,
-    "samlOrganizationName": "%%samlOrganizationName",
-%if %%RegisterDB == "Custom"
-    "registerUrl": "%%llRegisterURL",
-%else
-    "registerUrl": "https://%%authWebName/register.pl",
-%end if
-    "casAccessControlPolicy": "none",
-    "multiValuesSeparator": ";",
-    "ldapPort": %%ldapServerPort
-}
--- a/tmpl/lmConf-1.json
+++ b/tmpl/lmConf-1.json
@ -13,8 +13,10 @@
 %silent %%exported_vars.sort()
 %silent %%cas_attributes.sort()
 {
-    "ADPwdExpireWarning": 0,
-    "ADPwdMaxAge": 0,
+%if %%lemon_user_db == "AD"
+    "ADPwdExpireWarning": %%llADPasswordExpireWarn,
+    "ADPwdMaxAge": %%llADPasswordMaxAge,
+%end if
    "CAS_authnLevel": 1,
    "CAS_pgtFile": "/tmp/pgt.txt",
    "CAS_proxiedServices": {},
@ -169,19 +171,6 @@
 %end if
    "ldapAuthnLevel": 2,
    "ldapSearchDeref": "find",
-%if %%eole_module == "scribe"
-    "ldapBase": "cn=Users,dc=%echo ",dc=".join(%%ad_domain.split('.')) + '",'
-    "ldapExportedVars": {
-        "cn": "cn",
-        "mail": "mail",
-        "uid": "cn"
-    },
-    "ldapGroupAttributeName": "memberUid",
-    "ldapGroupAttributeNameGroup": "dn",
-    "ldapGroupAttributeNameSearch": "cn",
-    "ldapGroupAttributeNameUser": "cn",
-    "ldapGroupObjectClass": "group",
-%else
    "ldapBase": "%%ldapUserBaseDN",
    "ldapExportedVars": {
        "cn": "cn",
@ -193,7 +182,6 @@
    "ldapGroupAttributeNameSearch": "cn",
    "ldapGroupAttributeNameUser": "uid",
    "ldapGroupObjectClass": "eolegroupe",
-%end if
    "ldapGroupRecursive": 0,
    "ldapPasswordResetAttribute": "pwdReset",
    "ldapPasswordResetAttributeValue": "TRUE",
@ -230,13 +218,6 @@
    "macros": {
        "_whatToTrace": "$_auth eq 'SAML' ? \"$_user\\@$_idpConfKey\" : \"$_user\""
    },
-    "samlIDPMetaDataOptions": null,
-    "twitterAuthnLevel": 1,
-    "openIdExportedVars": {},
-    "captcha_register_enabled": 1,
-    "oidcOPMetaDataJWKS": null,
-    "webIDAuthnLevel": 1,
-    "issuerDBOpenIDActivation": "1",
    "mailCharset": "utf-8",
    "mailConfirmSubject": "[LemonLDAP::NG] Password reset confirmation",
    "mailFrom": "noreply@%%nom_domaine_local",
@ -252,11 +233,7 @@
    %end if
 %end if
    "maintenance": 0,
-%if %%eole_module == "scribe"
-    "managerDn": "cn=%%ldapBindUserDN,cn=Users,dc=%echo ",dc=".join(%%ad_domain.split('.')) + '",'
-%else
    "managerDn": "%%ldapBindUserDN",
-%end if
 %if %%is_file(%%ldapBindUserPassword)
    "managerPassword": "%%readPass("", %%ldapBindUserPassword)",
 %else
--- a/tmpl/manager-nginx.conf
+++ b/tmpl/manager-nginx.conf
@ -5,8 +5,7 @@ server {
 }

 server {
-  listen 443;
-  ssl on;
+  listen 443 ssl;
  %if %%cert_type == "letsencrypt"
  ssl_certificate %%le_config_dir/live/%%managerWebName/cert.pem;
  ssl_certificate_key %%le_config_dir/live/%%managerWebName/privkey.pem;
@ -70,8 +69,8 @@ server {

  # DEBIAN
  # If install was made with USEDEBIANLIBS (official releases), uncomment this
-  #location /javascript/ {
-  #  alias /usr/share/javascript/;
-  #}
+  location /javascript/ {
+    alias /usr/share/javascript/;
+  }

 }
--- a/tmpl/portal-nginx.conf
+++ b/tmpl/portal-nginx.conf
@ -15,8 +15,7 @@ server {
 }

 server {
-  listen 443;
-  ssl on;
+  listen 443 ssl;
 %if %%cert_type == "letsencrypt"
  ssl_certificate %%le_config_dir/live/%%authWebName/cert.pem;
  ssl_certificate_key %%le_config_dir/live/%%authWebName/privkey.pem;
@ -83,7 +82,7 @@ server {

  # DEBIAN
  # If install was made with USEDEBIANLIBS (official releases), uncomment this
-  #location /javascript/ {
-  #  alias /usr/share/javascript/;
-  #}
+  location /javascript/ {
+    alias /usr/share/javascript/;
+  }
 }
Author	SHA1	Message	Date
Matthieu Lamalle	283da1353a	Merge branch '2.8.0/master' into dist/eole/2.8.0/master	2020-12-14 14:04:25 +01:00
Matthieu Lamalle	20e382934c	set default openldap	2020-12-14 14:04:09 +01:00
Matthieu Lamalle	95b8facd7e	Merge branch '2.8.0/master' into dist/eole/2.8.0/master	2020-12-14 10:25:13 +01:00
Matthieu Lamalle	cf82616454	correction on condition	2020-12-14 10:24:17 +01:00
Philippe Caseiro	f3af0400d9	Merge branch '2.8.0/master' into dist/eole/2.8.0/master	2020-12-11 09:25:49 +01:00
Philippe Caseiro	e810740ba9	Adding AD password warning support	2020-12-11 09:25:41 +01:00
Philippe Caseiro	1535f7c8ef	Merge branch '2.8.0/master' into dist/eole/2.8.0/master	2020-12-09 17:17:45 +01:00
Philippe Caseiro	3753625b20	Updating nginx configuration for 2.8	2020-12-09 17:17:30 +01:00
Philippe Caseiro	ae88bb7602	Adding missing perl lib deps	2020-12-09 17:05:23 +01:00
Philippe Caseiro	195484f1fb	Adding missing libnet-ldap-perl dep	2020-12-09 16:56:23 +01:00
Philippe Caseiro	cc637b2c7e	Merge branch '2.8.0/master' into dist/eole/2.8.0/master	2020-12-09 16:48:20 +01:00
Philippe Caseiro	47e822f9b9	Updating lmlog file for nginx mode	2020-12-09 16:48:14 +01:00
Philippe Caseiro	1c91addc6d	Merge branch '2.8.0/master' into dist/eole/2.8.0/master	2020-12-07 16:07:42 +01:00
Philippe Caseiro	87818bd6f0	Activer la possibilité de changer son mot de passe depuis LemonLDAP ref #31347	2020-12-07 16:07:34 +01:00
Philippe Caseiro	e5afd4ccff	Adding missing dep for smtp auth support ref #31346	2020-12-07 11:18:42 +01:00
Philippe Caseiro	34239e8ce5	Merge branch '2.8.0/master' into dist/eole/2.8.0/master	2020-12-03 16:51:40 +01:00
Philippe Caseiro	bf94e74916	Using Active Directory (samba4) instead of OpenLDAP Moving to Active Directory the actual auth LDAP server The password is updated in the Samba4 directory so we need to use this one and not the OpenLDAP one	2020-12-03 16:50:55 +01:00
Philippe Caseiro	ad8e4a69a9	Merge branch '2.8.0/master' into dist/eole/2.8.0/master	2020-12-02 10:20:52 +01:00
Philippe Caseiro	0f3ff07b5f	Merge last evolutions from master branch	2020-12-02 10:20:42 +01:00
Philippe Caseiro	74fb92fb55	Make eole-lemonldap-ng compatible with eolebase	2020-11-24 15:51:43 +01:00
Joël Cuissinat	5c7a9f9894	Merge branch '2.8.0/master' into dist/eole/2.8.0/master	2020-11-16 15:45:55 +01:00
Daniel Dehennin	8d3f12de72	Merge branch '2.8.0/master' into dist/eole/2.8.0/master	2020-10-16 09:51:42 +02:00
Daniel Dehennin	c7d4949fb7	Merge branch 'master' into dist/eole/2.8.0/master	2020-10-15 09:10:44 +02:00
Daniel Dehennin	6890500d5b	Merge branch 'master' into dist/eole/2.8.0/master	2020-10-14 15:55:00 +02:00
Daniel Dehennin	2355b20c7d	Merge branch 'master' into dist/eole/2.8.0/master	2020-10-14 15:47:17 +02:00
Daniel Dehennin	2ac6c9158f	Clean garbage file Ref: #30852	2020-10-14 15:08:57 +02:00
Daniel Dehennin	c9c23aaa69	Copyright on the good project Ref: #30852	2020-10-14 15:08:32 +02:00
Daniel Dehennin	26ddf79a97	Scribe requires the libapache2-mod-perl2 Ref: #30852	2020-10-14 14:36:22 +02:00
Daniel Dehennin	11c83c8d92	Wrong dependency on the -pkg Ref: #30852	2020-10-14 14:18:03 +02:00
Daniel Dehennin	dd242a3c5a	Package for EOLE builders Build 3 packages: - eole-lemonldap-ng: the base dictionary, templates and scripts - eole-lemonldap-ng-scribe: for running LemLDAP::NG on Scribe - eole-lemonldap-ng-pkg: for package dependencies Ref: #30852	2020-10-14 14:05:51 +02:00
Daniel Dehennin	bd8403b610	Merge branch 'master' into dist/eole/2.8.0/master	2020-10-14 13:54:16 +02:00