0.9.4 was missing in tags...

git-svn-id: svn://svn.forge.objectweb.org/svnroot/lemonldap/tags/lemonldap-ng_version_0_9_4@708 1dbb9719-a921-0410-b57f-c3a383c2c641

COPYING

+
+
+
+
+			 The "Artistic License"
+
+				Preamble
+
+The intent of this document is to state the conditions under which a
+Package may be copied, such that the Copyright Holder maintains some
+semblance of artistic control over the development of the package,
+while giving the users of the package the right to use and distribute
+the Package in a more-or-less customary fashion, plus the right to make
+reasonable modifications.
+
+Definitions:
+
+	"Package" refers to the collection of files distributed by the
+	Copyright Holder, and derivatives of that collection of files
+	created through textual modification.
+
+	"Standard Version" refers to such a Package if it has not been
+	modified, or has been modified in accordance with the wishes
+	of the Copyright Holder as specified below.
+
+	"Copyright Holder" is whoever is named in the copyright or
+	copyrights for the package.
+
+	"You" is you, if you're thinking about copying or distributing
+	this Package.
+
+	"Reasonable copying fee" is whatever you can justify on the
+	basis of media cost, duplication charges, time of people involved,
+	and so on.  (You will not be required to justify it to the
+	Copyright Holder, but only to the computing community at large
+	as a market that must bear the fee.)
+
+	"Freely Available" means that no fee is charged for the item
+	itself, though there may be fees involved in handling the item.
+	It also means that recipients of the item may redistribute it
+	under the same conditions they received it.
+
+1. You may make and give away verbatim copies of the source form of the
+Standard Version of this Package without restriction, provided that you
+duplicate all of the original copyright notices and associated disclaimers.
+
+2. You may apply bug fixes, portability fixes and other modifications
+derived from the Public Domain or from the Copyright Holder.  A Package
+modified in such a way shall still be considered the Standard Version.
+
+3. You may otherwise modify your copy of this Package in any way, provided
+that you insert a prominent notice in each changed file stating how and
+when you changed that file, and provided that you do at least ONE of the
+following:
+
+    a) place your modifications in the Public Domain or otherwise make them
+    Freely Available, such as by posting said modifications to Usenet or
+    an equivalent medium, or placing the modifications on a major archive
+    site such as uunet.uu.net, or by allowing the Copyright Holder to include
+    your modifications in the Standard Version of the Package.
+
+    b) use the modified Package only within your corporation or organization.
+
+    c) rename any non-standard executables so the names do not conflict
+    with standard executables, which must also be provided, and provide
+    a separate manual page for each non-standard executable that clearly
+    documents how it differs from the Standard Version.
+
+    d) make other distribution arrangements with the Copyright Holder.
+
+4. You may distribute the programs of this Package in object code or
+executable form, provided that you do at least ONE of the following:
+
+    a) distribute a Standard Version of the executables and library files,
+    together with instructions (in the manual page or equivalent) on where
+    to get the Standard Version.
+
+    b) accompany the distribution with the machine-readable source of
+    the Package with your modifications.
+
+    c) give non-standard executables non-standard names, and clearly
+    document the differences in manual pages (or equivalent), together
+    with instructions on where to get the Standard Version.
+
+    d) make other distribution arrangements with the Copyright Holder.
+
+5. You may charge a reasonable copying fee for any distribution of this
+Package.  You may charge any fee you choose for support of this
+Package.  You may not charge a fee for this Package itself.  However,
+you may distribute this Package in aggregate with other (possibly
+commercial) programs as part of a larger (possibly commercial) software
+distribution provided that you do not advertise this Package as a
+product of your own.  You may embed this Package's interpreter within
+an executable of yours (by linking); this shall be construed as a mere
+form of aggregation, provided that the complete Standard Version of the
+interpreter is so embedded.
+
+6. The scripts and library files supplied as input to or produced as
+output from the programs of this Package do not automatically fall
+under the copyright of this Package, but belong to whoever generated
+them, and may be sold commercially, and may be aggregated with this
+Package.  If such scripts or library files are aggregated with this
+Package via the so-called "undump" or "unexec" methods of producing a
+binary executable image, then distribution of such an image shall
+neither be construed as a distribution of this Package nor shall it
+fall under the restrictions of Paragraphs 3 and 4, provided that you do
+not represent such an executable image as a Standard Version of this
+Package.
+
+7. C subroutines (or comparably compiled subroutines in other
+languages) supplied by you and linked into this Package in order to
+emulate subroutines and variables of the language defined by this
+Package shall not be considered part of this Package, but are the
+equivalent of input as in Paragraph 6, provided these subroutines do
+not change the language in any way that would cause it to fail the
+regression tests for the language.
+
+8. Aggregation of this Package with a commercial distribution is always
+permitted provided that the use of this Package is embedded; that is,
+when no overt attempt is made to make this Package's interfaces visible
+to the end user of the commercial distribution.  Such use shall not be
+construed as a distribution of this Package.
+
+9. The name of the Copyright Holder may not be used to endorse or promote
+products derived from this software without specific prior written permission.
+
+10. THIS PACKAGE IS PROVIDED "AS IS" AND WITHOUT ANY EXPRESS OR
+IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
+WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+
+				The End

INSTALL

+                          LEMONLDAP::NG INSTALLATION
+
+Lemonldap::NG is a modular Web-SSO based on Apache::Session modules. It
+simplifies the build of a protected area with a few changes in the application.
+It manages both authentication and authorization and provides headers for
+accounting. So you can have a full AAA protection.
+
+See README file to known how it works.
+
+----------------------
+I - QUICK INSTALLATION
+----------------------
+
+The proposed example use a protected site named test.example.com. Non
+authenticated users are redirected to auth.example.com.
+
+1.1 - PREREQ
+------------
+
+1.1.1 - Software
+
+To use Lemonldap::NG, you have to run a LDAP server and of course an Apache
+server compiled with mod-perl (version 1.3 or 2.x). Generaly, the version of
+Apache proposed with your Linux distribution match, but some distributions used
+an experimental version of mod_perl with Apache2 (mod_perl-1.99) which does
+not work with Lemonldap::NG. With such distributions (like Debian-3.1), you
+have to use Apache-1.3 or to use a mod_perl backport (www.backports.org
+package for Debian works fine).
+
+1.1.2 - Perl prereq
+
+Perl modules:
+  Apache::Session, Net::LDAP, MIME::Base64, CGI, LWP::UserAgent, Cache::Cache,
+  DBI, XML::Simple, SOAP::Lite, HTML::Template, XML::LibXML, XML::LibXSLT
+
+With Debian:
+  apt-get install libapache-session-perl libnet-ldap-perl libcache-cache-perl \
+                  libdbi-perl perl-modules libwww-perl libcache-cache-perl \
+                  libxml-simple-perl libhtml-template-perl libsoap-lite-perl \
+                  libxml-libxml-perl libxml-libxslt-perl
+
+1.2 - BUILDING
+--------------
+
+1.2.1 - Complete install
+
+  $ tar xzf lemonldap-ng-*.tar.gz
+  $ cd lemonldap-ng-*
+  $ make && make test
+  $ sudo make install
+
+By default, all is installed in /usr/local/lemonldap-ng except Perl libraries
+which are installed in a directory included in @INC.
+
+1.2.2 - Install on Debian
+
+  $ tar xzf lemonldap-ng-*.tar.gz
+  $ cd lemonldap-ng-*
+  $ debuild
+  $ sudo dpkg -i ../*lemonldap-ng*.deb
+
+Here, all is installed in /var/lib/lemonldap-ng, /etc/lemonldap-ng except Perl
+libraries which are installed in /usr/share/perl5/Lemonldap/NG/
+
+1.3 - EXAMPLE CONFIGURATION
+---------------------------
+
+If you have build Debian packages, configuration is done by Debconf. See
+/usr/share/doc/liblemonldap-ng-conf/README.Debian to use it.
+
+After build, you have a new file named example/apache.conf. You just have to
+include this file in Apache configuration:
+
+  # in httpd.conf (with Apache1)
+  include /path/to/lemonldap-ng/source/example/apache.conf
+  # or in apache2.conf (with Apache2)
+  include /path/to/lemonldap-ng/source/example/apache2.conf
+
+Modify your /etc/hosts file to include:
+
+  127.0.0.1 auth.example.com test1.example.com manager.example.com test2.example.com
+
+Use a browser to connect to http://manager.example.com/ and specify your LDAP
+settings. If you don't set managerDn and managerPassword, Lemonldap::NG will
+use an anonymous bind to find user dn.
+
+Next, restart Apache use your prefered browser and try to connect to
+http://test1.example.com/. You'll be redirect to auth.example.com. Try
+to authenticate yourself with a valid account and the protected page will
+appear. You will find other explanations on this page.
+
+the file /usr/local/lemonldap-ng/etc/storage.conf
+(/etc/lemonldap-ng/storage.conf on Debian systems) can be modified to change
+configuration database.
+
+-------------------------
+2 - ADVANCED INSTALLATION
+-------------------------
+
+It is recommended to install the example first then to adapt it.
+
+2.1 - PREREQ
+
+2.1.1 - Apache
+
+To use Lemonldap::NG, you have to run a LDAP server and of course an Apache
+server compiled with mod-perl (version 1.3 or 2.x). Generaly, the version of
+Apache proposed with your Linux distribution match, but some distributions used
+an experimental version of mod_perl with Apache2 (mod_perl-1.99) which does
+not work with Lemonldap::NG. With such distributions (like Debian-3.1), you
+have to use Apache-1.3 or to use a mod_perl backport (www.backports.org
+package for Debian works fine).
+
+For Apache2, you can use both mpm-worker and mpm-prefork. Mpm-worker works
+faster and Lemonldap::NG use the thread system for best performance. If you
+have to use mpm-prefork (for example if you use PHP), Lemonldap::NG will work
+anyway.
+
+You can use Lemonldap::NG in an heterogene world: the authentication portal and
+the manager can work in any version of Apache 1.3 or more even if mod_perl is
+not compiled, with ModPerl::Registry or not... Only the handler (site protector)
+need mod_perl. The different handlers can run on different servers with
+different versions of Apache/mod_perl.
+
+2.1.2 - Perl prereq
+
+Warning: Handler and Portal parts both need Lemonldap::NG::Manager components
+to access to configuration.
+
+Manager:
+--------
+Apache::Session, MIME::Base64, CGI, LWP::UserAgent, DBI, XML::Simple,
+SOAP::Lite, XML::LibXML, XML::LibXSLT, Lemonldap::NG::Common
+
+With Debian:
+  apt-get install perl-modules libxml-simple-perl libdbi-perl libwww-perl
+  # If you want to use SOAP
+  apt-get install libsoap-lite-perl
+
+Portal:
+-------
+Apache::Session, Net::LDAP, MIME::Base64, CGI, Cache::Cache, DBI, XML::Simple,
+SOAP::Lite, HTML::Template, XML::LibXML, Lemonldap::NG::Common
+
+With Debian:
+  apt-get install libapache-session-perl libnet-ldap-perl perl-modules
+
+Handler:
+--------
+Apache::Session, MIME::Base64, CGI, LWP::UserAgent, Cache::Cache, DBI,
+XML::Simple, SOAP::Lite, Lemonldap::NG::Common
+
+With Debian:
+  apt-get install libapache-session-perl libwww-perl libcache-cache-perl
+
+2.2 - SOFTWARE INSTALLATION
+---------------------------
+
+If you just want to install a handler or a portal or a manager:
+
+  $ tar xzf lemonldap-ng-*.tar.gz
+  $ cd lemonldap-ng-*/Lemonldap-NG-(Portal|Handler|Manager)
+  $ perl Makefile.PL && make && make test
+  $ sudo make install
+
+else for a complete install:
+
+  $ tar xzf lemonldap-ng-*.tar.gz
+  $ cd lemonldap-ng-*
+  $ make && make test
+  $ sudo make install
+
+See prereq in §1.1.2
+
+2.3 - LEMONLDAP::NG INSTALLATION
+--------------------------------
+
+2.3.1 - Database configuration
+
+2.3.1.1 - Lemonldap::NG Configuration database
+
+If you use DBI or another system to share Lemonldap::NG configuration, you have
+to initialize the database. An example is given in example/lmConfig.mysql for
+MySQL.
+
+2.3.1.2 - Apache::Session database
+
+The choice of Apache::Session::* module is free. See Apache::Session::Store::*
+or Apache::Session::* to know how to configure the module. For example, if you
+want to use Apache::Session::MySQL, you can create the database like this:
+
+  CREATE DATABASE sessions (
+    id char(32),
+    a_session text
+  );
+
+2.3.2 - Manager configuration
+
+Copy example/manager.cgi and personalize it if you want (see
+Lemonldap::NG::Manager). You have to set in particular configStorage. For
+example with MySQL:
+
+  $my $manager = Lemonldap::NG::Manager->new ( {
+                        dbiChain   => "DBI:mysql:database=mybase;host=1.2.3.4",
+                        dbiUser    => "lemonldap-ng",
+                        dbiPassword => "mypass",
+                 } );
+
+Securise Manager access with Apache: Lemonldap::NG does not securise the manager
+itself yet:
+
+  SSLEngine On
+  Order Deny, Allow
+  Deny from all
+  Allow from admin-network/netmask
+  AuthType Basic
+  ...
+
+After configuration, you can also protect the manager with an Lemonldap::NG
+handler.
+
+2.3.3 - Configuration edition
+
+Connect to the manager with your browser start configure your Web-SSO. You have
+to set at least some parameters:
+
+a) General parameters :
+
+ * Authentication parameters -> portal : URL to access to the authentication
+                                         portal
+ * Domain : the cookie domain. All protected VirtualHosts have to be under it
+
+ * LDAP parameters -> LDAP Server
+
+ * LDAP parameters -> LDAP Accout and password : required only if anonymous
+                                                 binds are not accepted
+
+ * Session Storage -> Apache::Session module : how to store user sessions.
+                                               You can use all module that
+                                               inherit from Apache::Session
+                                               like Apache::Session::MySQL
+
+ * Session Storage -> Apache::Session Module parameters :
+                                        see Apache::Session::<Choosen module>
+
+b) User groups :
+
+Use the "New Group" button to add your first group. On the left, set the
+keyword which will be used later and set on the right the corresponding rule:
+you can use :
+
+ * an LDAP filter (it will be tested with the user uid)
+
+or
+
+ * a Perl condition enclosed with {}. All variables declared in "General
+   parameters -> LDAP attributes" can be used with a "$". For example:
+   MyGroup  /  { $uid eq "foo" or $uid eq "bar" }
+
+c) Virtual hosts
+
+You have to create a virtual host for each Apache host (virtual or real)
+protected by Lemonldap::NG even if just a sub-directory is protected. Else,
+user who want to access to the protected area will be rejected with a "500
+Internal Server Error" message and the apache logs will explain the problem.
+
+Each virtual host has 2 groups of parameters:
+
+ * Headers: the headers added to the apache request. Default :
+            Auth-User => $uid
+ * Rules: subdivised in 2 categories:
+          * default : the default rule
+          * personalized rules: association of a Perl regular expression and
+                                a condition. For example:
+                                ^/restricted.*$  /  $groups =~ /\bMyGroup\b/
+
+
+-------------
+3 - DEBUGGING
+-------------
+
+Lemonldap::NG uses simply the Apache log system. So use LogLevel to choose
+information to display.
+

Makefile

+#!/usr/bin/make
+
+# Prefix for packaging
+DESTDIR=
+
+PERL=$$(which perl)
+# Perl options
+#PERLOPTIONS="INSTALLDIRS=vendor"
+PERLOPTIONS=
+
+# Default directories install
+PREFIX=/usr/local
+LMPREFIX=$(PREFIX)/lemonldap-ng
+RLMPREFIX=$(DESTDIR)/$(LMPREFIX)
+# BIN dirs
+BINDIR=$(LMPREFIX)/bin
+RBINDIR=$(DESTDIR)/$(BINDIR)
+DATADIR=$(LMPREFIX)/data
+RDATADIR=$(DESTDIR)/$(DATADIR)
+
+
+EXAMPLEROOT=`pwd`/example
+
+# Document roots for Apache VirtualHosts
+DOCUMENTROOT=$(LMPREFIX)/htdocs
+PORTALDIR=$(DOCUMENTROOT)/portal
+RPORTALDIR=$(DESTDIR)/$(PORTALDIR)
+PORTALSKINSDIR=$(PORTALDIR)/skins
+RPORTALSKINSDIR=$(DESTDIR)/$(PORTALSKINSDIR)
+LASPPORTALDIR=$(DOCUMENTROOT)/liberty-alliance-sp-portal
+RLASPPORTALDIR=$(DESTDIR)/$(LASPPORTALDIR)
+MANAGERDIR=$(DOCUMENTROOT)/manager
+RMANAGERDIR=$(DESTDIR)/$(MANAGERDIR)
+MANAGERDATADIR=$(MANAGERDIR)/imgs
+RMANAGERDATADIR=$(DESTDIR)/$(MANAGERDATADIR)
+SESSIONSEXPLORERDIR=$(MANAGERDIR)
+RSESSIONSEXPLORERDIR=$(DESTDIR)/$(SESSIONSEXPLORERDIR)
+SESSIONSEXPLORERDATADIR=$(SESSIONSEXPLORERDIR)/images
+RSESSIONSEXPLORERDATADIR=$(DESTDIR)/$(SESSIONSEXPLORERDATADIR)
+DOCDIR=$(DOCUMENTROOT)/doc
+RDOCDIR=$(DESTDIR)/$(DOCDIR)
+TESTDIR=$(DOCUMENTROOT)/test
+RTESTDIR=$(DESTDIR)/$(TESTDIR)
+EXAMPLESDIR=$(LMPREFIX)/examples
+REXAMPLESDIR=$(DESTDIR)/$(EXAMPLESDIR)
+TOOLSDIR=$(LMPREFIX)/tools
+RTOOLSDIR=$(DESTDIR)/$(TOOLSDIR)
+
+# Handler dir
+HANDLERDIR=$(LMPREFIX)/handler
+RHANDLERDIR=$(DESTDIR)/$(HANDLERDIR)
+
+# Configuration dir
+CONFDIR=$(LMPREFIX)/etc
+RCONFDIR=$(DESTDIR)/$(CONFDIR)
+CRONDIR=$(LMPREFIX)/etc/cron.d
+RCRONDIR=$(DESTDIR)/$(CRONDIR)
+STORAGECONFFILE=$(CONFDIR)/storage.conf
+
+# Lemonldap-ng configuration storage dir
+FILECONFIGDIR=$(DATADIR)/conf
+RFILECONFIGDIR=$(DESTDIR)/$(FILECONFIGDIR)
+
+# Apache::Session::File storage dir
+APACHESESSIONFILEDIR=$(DATADIR)/sessions
+RAPACHESESSIONFILEDIR=$(DESTDIR)/$(APACHESESSIONFILEDIR)
+APACHESESSIONFILELOCKDIR=$(APACHESESSIONFILEDIR)/lock
+RAPACHESESSIONFILELOCKDIR=$(DESTDIR)/$(APACHESESSIONFILELOCKDIR)
+APACHEUSER=
+APACHEGROUP=
+
+# DNS Domain for cookie and virtual hosts
+DNSDOMAIN=example.com
+
+# LDAP parameters
+LDAPHOST=localhost
+LDAPPORT=389
+LDAPSUFFIX=dc=example,dc=com
+
+# Other
+VERSION=`head -n1 changelog |sed -e 's/lemonldap-ng (//' -e 's/).*$$//'`
+SRCCOMMONDIR=lemonldap-ng-common
+SRCHANDLERDIR=lemonldap-ng-handler
+SRCPORTALDIR=lemonldap-ng-portal
+SRCMANAGERDIR=lemonldap-ng-manager
+EXAMPLELANG=en # For static Manager example only
+ERASECONFIG=1 # Set to 0 if you do not want to replace your configuration
+
+all:	configure common handler manager portal
+	@echo
+	@echo "Building succeed. Now run :"
+	@echo " - make test to verify your installation"
+	@echo " - make install to install all"
+	@echo
+	@echo 'Other targets :'
+	@echo " * Partial build :"
+	@echo "   - portal, manager, handler"
+	@echo " * Doxygen documentation"
+	@echo "   - doxygen (to build Doxygen documentation in doc/devel/)"
+	@echo
+	@echo 'Other targets launched by "make install" :'
+	@echo " * Perl libraries install :"
+	@echo "   - install_libs          (all Perl libraries)"
+	@echo "   - install_portal_libs"
+	@echo "   - install_manager_libs"
+	@echo "   - install_handler_libs"
+	@echo " * Binaries install :"
+	@echo "   - install_bin           ($(BINDIR))"
+	@echo " * Web sites install :"
+	@echo "   - install_site          (all sites including install_doc_site)"
+	@echo "   - install_portal_site   ($(PORTALDIR))"
+	@echo "   - install_manager_site  ($(MANAGERDIR))"
+	@echo "   - install_handler_site  ($(HANDLERDIR))"
+	@echo " * Documentation install :"
+	@echo "   - install_doc_site      ($(DOCDIR))"
+	@echo "   - install_examples_site ($(EXAMPLESDIR))"
+	@echo
+
+#
+# Perl libraries configuration
+#
+configure:	common_conf handler_conf portal_conf manager_conf
+
+common_conf:
+	@cd ${SRCCOMMONDIR}; LMNGCONFFILE=$(STORAGECONFFILE) perl Makefile.PL $(PERLOPTIONS)
+	@touch common_conf
+
+handler_conf:
+	@cd ${SRCHANDLERDIR}; perl Makefile.PL $(PERLOPTIONS)
+	@touch handler_conf
+
+portal_conf:
+	@cd ${SRCPORTALDIR}; perl Makefile.PL $(PERLOPTIONS)
+	@touch portal_conf
+
+manager_conf:
+	@cd ${SRCMANAGERDIR}; perl Makefile.PL $(PERLOPTIONS)
+	@touch manager_conf
+
+#
+# Perl libraries make
+#
+common:		common_conf
+	@$(MAKE) -C ${SRCCOMMONDIR}
+	@touch common
+
+handler:	handler_conf
+	@$(MAKE) -C ${SRCHANDLERDIR}
+	@touch handler
+
+portal:		portal_conf
+	@$(MAKE) -C ${SRCPORTALDIR}
+	@touch portal
+
+manager:	manager_conf
+	@$(MAKE) -C ${SRCMANAGERDIR}
+	@touch manager
+
+test:		common handler portal manager common_test handler_test portal_test manager_test
+
+common_test:	common
+	@$(MAKE) -C ${SRCCOMMONDIR} test
+
+handler_test:	handler common_test
+	@$(MAKE) -C ${SRCHANDLERDIR} test FULLPERL="$(PERL) -I../${SRCCOMMONDIR}/blib/lib/"
+
+portal_test:	portal handler_test common_test
+	@$(MAKE) -C ${SRCPORTALDIR} test FULLPERL="$(PERL) -I../${SRCCOMMONDIR}/blib/lib/ -I../${SRCHANDLERDIR}/blib/lib/"
+
+manager_test:	manager handler_test common_test
+	@$(MAKE) -C ${SRCMANAGERDIR} test FULLPERL="$(PERL) -I../${SRCCOMMONDIR}/blib/lib/ -I../${SRCHANDLERDIR}/blib/lib/"
+
+#
+# INSTALL
+#
+install:	install_libs install_bin install_site
+
+#
+# Perl libraires install
+#
+install_libs:	common_install_libs install_handler_libs install_portal_libs install_manager_libs
+
+common_install_libs:		common
+	@$(MAKE) -C ${SRCCOMMONDIR} install
+
+install_handler_libs:	handler
+	@$(MAKE) -C ${SRCHANDLERDIR} install
+
+install_portal_libs:		portal
+	@$(MAKE) -C ${SRCPORTALDIR} install
+
+install_manager_libs:	manager
+	@$(MAKE) -C ${SRCMANAGERDIR} install
+
+example:
+	$(MAKE) install_site LMPREFIX=$(EXAMPLEROOT)
+
+install_bin:	install_libs install_conf_dir
+	# Binary install
+	@install -v -d $(RBINDIR)
+	@cp --preserve=mode --remove-destination \
+		${SRCPORTALDIR}/example/scripts/purgeCentralCache \
+		${SRCPORTALDIR}/example/scripts/buildPortalWSDL \
+		${SRCCOMMONDIR}/scripts/lmConfig_File2MySQL \
+		${SRCCOMMONDIR}/scripts/lmConfig_File2LDIF \
+		${SRCMANAGERDIR}/example/scripts/lmConfigEditor \
+			$(RBINDIR)
+	chmod +x $(RBINDIR)/*
+