#====================================================================
# Apache configuration for LemonLDAP::NG Portal
#====================================================================

# Uncomment this if no previous NameVirtualHost declaration
#NameVirtualHost "*:80"

# Portal Virtual Host (auth.example.com)
<VirtualHost "*:443">
    ServerName %%authWebName

    # DocumentRoot
    DocumentRoot /var/lib/lemonldap-ng/portal/
    <Directory /var/lib/lemonldap-ng/portal/>
        <IfVersion >= 2.3>
            Require all granted
        </IfVersion>
        <IfVersion < 2.3>
            Order Deny,Allow
            Allow from all
        </IfVersion>
        Options +ExecCGI +FollowSymLinks
    </Directory>
    SSLEngine on
    SSLCertificateFile    %%apache_cert
    SSLCertificateKeyFile %%server_key
    SSLProtocol all -SSLv3 -SSLv2

    # Perl script
    <Files *.pl>
        SetHandler perl-script
        PerlResponseHandler ModPerl::Registry
        #CGIPassAuth on
    </Files>

    <IfModule mod_dir.c>
        DirectoryIndex index.pl index.html
    </IfModule>

    # SOAP functions for sessions management (disabled by default)
    <Location /index.pl/adminSessions>
        <IfVersion >= 2.3>
            Require all denied
        </IfVersion>
        <IfVersion < 2.3>
            Order Deny,Allow
            Deny from all
        </IfVersion>
    </Location>

    # SOAP functions for sessions access (disabled by default)
    <Location /index.pl/sessions>
        <IfVersion >= 2.3>
            Require all denied
        </IfVersion>
        <IfVersion < 2.3>
            Order Deny,Allow
            Deny from all
        </IfVersion>
    </Location>

    # SOAP functions for configuration access (disabled by default)
    <Location /index.pl/config>
        <IfVersion >= 2.3>
            Require all denied
        </IfVersion>
        <IfVersion < 2.3>
            Order Deny,Allow
            Deny from all
        </IfVersion>
    </Location>

    # SOAP functions for notification insertion (disabled by default)
    <Location /index.pl/notification>
        <IfVersion >= 2.3>
            Require all denied
        </IfVersion>
        <IfVersion < 2.3>
            Order Deny,Allow
            Deny from all
        </IfVersion>
    </Location>

    # SAML2 Issuer
    <IfModule mod_rewrite.c>
        RewriteEngine On
        RewriteRule ^/saml/metadata /metadata.pl
        RewriteRule ^/saml/.* /index.pl
    </IfModule>

    # CAS Issuer
    <IfModule mod_rewrite.c>
        RewriteEngine On
        RewriteRule ^/cas/.* /index.pl
    </IfModule>

    # OpenID Issuer
    <IfModule mod_rewrite.c>
        RewriteEngine On
        RewriteRule ^/openidserver/.* /index.pl
    </IfModule>

    # OpenID Connect Issuer
    <IfModule mod_rewrite.c>
        RewriteEngine On
        #RewriteCond %{HTTP:Authorization} .
        #RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
        RewriteRule ^/oauth2/.* /index.pl
        RewriteRule ^/.well-known/openid-configuration$ /openid-configuration.pl
    </IfModule>

    # Get Issuer
    <IfModule mod_rewrite.c>
        RewriteEngine On
        RewriteRule ^/get/.* /index.pl
    </IfModule>

    # Public pages
    <IfModule mod_rewrite.c>
        RewriteEngine On
        RewriteRule ^/public* /public.pl
    </IfModule>

    <Location />
        <IfModule mod_deflate.c>
                AddOutputFilterByType DEFLATE text/html text/plain text/xml text/javascript text/css
                SetOutputFilter DEFLATE
                BrowserMatch ^Mozilla/4 gzip-only-text/html
                BrowserMatch ^Mozilla/4\.0[678] no-gzip
                BrowserMatch \bMSIE !no-gzip !gzip-only-text/html
                SetEnvIfNoCase Request_URI \.(?:gif|jpe?g|png)$ no-gzip dont-vary
        </IfModule>
        <IfModule mod_headers.c>
                Header append Vary User-Agent env=!dont-vary
        </IfModule>
    </Location>
    <Location /skins/>
        <IfModule mod_expires.c>
                ExpiresActive On
                ExpiresDefault "access plus 1 month"
        </IfModule>
    </Location>

    # Uncomment this if site if you use SSL only
    #Header set Strict-Transport-Security 15768000
</VirtualHost>

##############################################
## Best performance under ModPerl::Registry ##
##############################################

# Uncomment this to increase performance of Portal:
<Perl>
    #require Lemonldap::NG::Portal::SharedConf;
    #Lemonldap::NG::Portal::SharedConf->compile(
    #    qw(delete header cache read_from_client cookie redirect unescapeHTML));
    # Uncomment this line if you use Lemonldap::NG menu
    #require Lemonldap::NG::Portal::Menu;
    # Uncomment this line if you use portal SOAP capabilities
    #require SOAP::Lite;
</Perl>