Commit b1fbb9cc authored by Yadd's avatar Yadd
Browse files

0.9.4 was missing in tags...

git-svn-id: svn://svn.forge.objectweb.org/svnroot/lemonldap/tags/lemonldap-ng_version_0_9_4@708 1dbb9719-a921-0410-b57f-c3a383c2c641
parents
The "Artistic License"
Preamble
The intent of this document is to state the conditions under which a
Package may be copied, such that the Copyright Holder maintains some
semblance of artistic control over the development of the package,
while giving the users of the package the right to use and distribute
the Package in a more-or-less customary fashion, plus the right to make
reasonable modifications.
Definitions:
"Package" refers to the collection of files distributed by the
Copyright Holder, and derivatives of that collection of files
created through textual modification.
"Standard Version" refers to such a Package if it has not been
modified, or has been modified in accordance with the wishes
of the Copyright Holder as specified below.
"Copyright Holder" is whoever is named in the copyright or
copyrights for the package.
"You" is you, if you're thinking about copying or distributing
this Package.
"Reasonable copying fee" is whatever you can justify on the
basis of media cost, duplication charges, time of people involved,
and so on. (You will not be required to justify it to the
Copyright Holder, but only to the computing community at large
as a market that must bear the fee.)
"Freely Available" means that no fee is charged for the item
itself, though there may be fees involved in handling the item.
It also means that recipients of the item may redistribute it
under the same conditions they received it.
1. You may make and give away verbatim copies of the source form of the
Standard Version of this Package without restriction, provided that you
duplicate all of the original copyright notices and associated disclaimers.
2. You may apply bug fixes, portability fixes and other modifications
derived from the Public Domain or from the Copyright Holder. A Package
modified in such a way shall still be considered the Standard Version.
3. You may otherwise modify your copy of this Package in any way, provided
that you insert a prominent notice in each changed file stating how and
when you changed that file, and provided that you do at least ONE of the
following:
a) place your modifications in the Public Domain or otherwise make them
Freely Available, such as by posting said modifications to Usenet or
an equivalent medium, or placing the modifications on a major archive
site such as uunet.uu.net, or by allowing the Copyright Holder to include
your modifications in the Standard Version of the Package.
b) use the modified Package only within your corporation or organization.
c) rename any non-standard executables so the names do not conflict
with standard executables, which must also be provided, and provide
a separate manual page for each non-standard executable that clearly
documents how it differs from the Standard Version.
d) make other distribution arrangements with the Copyright Holder.
4. You may distribute the programs of this Package in object code or
executable form, provided that you do at least ONE of the following:
a) distribute a Standard Version of the executables and library files,
together with instructions (in the manual page or equivalent) on where
to get the Standard Version.
b) accompany the distribution with the machine-readable source of
the Package with your modifications.
c) give non-standard executables non-standard names, and clearly
document the differences in manual pages (or equivalent), together
with instructions on where to get the Standard Version.
d) make other distribution arrangements with the Copyright Holder.
5. You may charge a reasonable copying fee for any distribution of this
Package. You may charge any fee you choose for support of this
Package. You may not charge a fee for this Package itself. However,
you may distribute this Package in aggregate with other (possibly
commercial) programs as part of a larger (possibly commercial) software
distribution provided that you do not advertise this Package as a
product of your own. You may embed this Package's interpreter within
an executable of yours (by linking); this shall be construed as a mere
form of aggregation, provided that the complete Standard Version of the
interpreter is so embedded.
6. The scripts and library files supplied as input to or produced as
output from the programs of this Package do not automatically fall
under the copyright of this Package, but belong to whoever generated
them, and may be sold commercially, and may be aggregated with this
Package. If such scripts or library files are aggregated with this
Package via the so-called "undump" or "unexec" methods of producing a
binary executable image, then distribution of such an image shall
neither be construed as a distribution of this Package nor shall it
fall under the restrictions of Paragraphs 3 and 4, provided that you do
not represent such an executable image as a Standard Version of this
Package.
7. C subroutines (or comparably compiled subroutines in other
languages) supplied by you and linked into this Package in order to
emulate subroutines and variables of the language defined by this
Package shall not be considered part of this Package, but are the
equivalent of input as in Paragraph 6, provided these subroutines do
not change the language in any way that would cause it to fail the
regression tests for the language.
8. Aggregation of this Package with a commercial distribution is always
permitted provided that the use of this Package is embedded; that is,
when no overt attempt is made to make this Package's interfaces visible
to the end user of the commercial distribution. Such use shall not be
construed as a distribution of this Package.
9. The name of the Copyright Holder may not be used to endorse or promote
products derived from this software without specific prior written permission.
10. THIS PACKAGE IS PROVIDED "AS IS" AND WITHOUT ANY EXPRESS OR
IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
The End
This diff is collapsed.
LEMONLDAP::NG INSTALLATION
Lemonldap::NG is a modular Web-SSO based on Apache::Session modules. It
simplifies the build of a protected area with a few changes in the application.
It manages both authentication and authorization and provides headers for
accounting. So you can have a full AAA protection.
See README file to known how it works.
----------------------
I - QUICK INSTALLATION
----------------------
The proposed example use a protected site named test.example.com. Non
authenticated users are redirected to auth.example.com.
1.1 - PREREQ
------------
1.1.1 - Software
To use Lemonldap::NG, you have to run a LDAP server and of course an Apache
server compiled with mod-perl (version 1.3 or 2.x). Generaly, the version of
Apache proposed with your Linux distribution match, but some distributions used
an experimental version of mod_perl with Apache2 (mod_perl-1.99) which does
not work with Lemonldap::NG. With such distributions (like Debian-3.1), you
have to use Apache-1.3 or to use a mod_perl backport (www.backports.org
package for Debian works fine).
1.1.2 - Perl prereq
Perl modules:
Apache::Session, Net::LDAP, MIME::Base64, CGI, LWP::UserAgent, Cache::Cache,
DBI, XML::Simple, SOAP::Lite, HTML::Template, XML::LibXML, XML::LibXSLT
With Debian:
apt-get install libapache-session-perl libnet-ldap-perl libcache-cache-perl \
libdbi-perl perl-modules libwww-perl libcache-cache-perl \
libxml-simple-perl libhtml-template-perl libsoap-lite-perl \
libxml-libxml-perl libxml-libxslt-perl
1.2 - BUILDING
--------------
1.2.1 - Complete install
$ tar xzf lemonldap-ng-*.tar.gz
$ cd lemonldap-ng-*
$ make && make test
$ sudo make install
By default, all is installed in /usr/local/lemonldap-ng except Perl libraries
which are installed in a directory included in @INC.
1.2.2 - Install on Debian
$ tar xzf lemonldap-ng-*.tar.gz
$ cd lemonldap-ng-*
$ debuild
$ sudo dpkg -i ../*lemonldap-ng*.deb
Here, all is installed in /var/lib/lemonldap-ng, /etc/lemonldap-ng except Perl
libraries which are installed in /usr/share/perl5/Lemonldap/NG/
1.3 - EXAMPLE CONFIGURATION
---------------------------
If you have build Debian packages, configuration is done by Debconf. See
/usr/share/doc/liblemonldap-ng-conf/README.Debian to use it.
After build, you have a new file named example/apache.conf. You just have to
include this file in Apache configuration:
# in httpd.conf (with Apache1)
include /path/to/lemonldap-ng/source/example/apache.conf
# or in apache2.conf (with Apache2)
include /path/to/lemonldap-ng/source/example/apache2.conf
Modify your /etc/hosts file to include:
127.0.0.1 auth.example.com test1.example.com manager.example.com test2.example.com
Use a browser to connect to http://manager.example.com/ and specify your LDAP
settings. If you don't set managerDn and managerPassword, Lemonldap::NG will
use an anonymous bind to find user dn.
Next, restart Apache use your prefered browser and try to connect to
http://test1.example.com/. You'll be redirect to auth.example.com. Try
to authenticate yourself with a valid account and the protected page will
appear. You will find other explanations on this page.
the file /usr/local/lemonldap-ng/etc/storage.conf
(/etc/lemonldap-ng/storage.conf on Debian systems) can be modified to change
configuration database.
-------------------------
2 - ADVANCED INSTALLATION
-------------------------
It is recommended to install the example first then to adapt it.
2.1 - PREREQ
2.1.1 - Apache
To use Lemonldap::NG, you have to run a LDAP server and of course an Apache
server compiled with mod-perl (version 1.3 or 2.x). Generaly, the version of
Apache proposed with your Linux distribution match, but some distributions used
an experimental version of mod_perl with Apache2 (mod_perl-1.99) which does
not work with Lemonldap::NG. With such distributions (like Debian-3.1), you
have to use Apache-1.3 or to use a mod_perl backport (www.backports.org
package for Debian works fine).
For Apache2, you can use both mpm-worker and mpm-prefork. Mpm-worker works
faster and Lemonldap::NG use the thread system for best performance. If you
have to use mpm-prefork (for example if you use PHP), Lemonldap::NG will work
anyway.
You can use Lemonldap::NG in an heterogene world: the authentication portal and
the manager can work in any version of Apache 1.3 or more even if mod_perl is
not compiled, with ModPerl::Registry or not... Only the handler (site protector)
need mod_perl. The different handlers can run on different servers with
different versions of Apache/mod_perl.
2.1.2 - Perl prereq
Warning: Handler and Portal parts both need Lemonldap::NG::Manager components
to access to configuration.
Manager:
--------
Apache::Session, MIME::Base64, CGI, LWP::UserAgent, DBI, XML::Simple,
SOAP::Lite, XML::LibXML, XML::LibXSLT, Lemonldap::NG::Common
With Debian:
apt-get install perl-modules libxml-simple-perl libdbi-perl libwww-perl
# If you want to use SOAP
apt-get install libsoap-lite-perl
Portal:
-------
Apache::Session, Net::LDAP, MIME::Base64, CGI, Cache::Cache, DBI, XML::Simple,
SOAP::Lite, HTML::Template, XML::LibXML, Lemonldap::NG::Common
With Debian:
apt-get install libapache-session-perl libnet-ldap-perl perl-modules
Handler:
--------
Apache::Session, MIME::Base64, CGI, LWP::UserAgent, Cache::Cache, DBI,
XML::Simple, SOAP::Lite, Lemonldap::NG::Common
With Debian:
apt-get install libapache-session-perl libwww-perl libcache-cache-perl
2.2 - SOFTWARE INSTALLATION
---------------------------
If you just want to install a handler or a portal or a manager:
$ tar xzf lemonldap-ng-*.tar.gz
$ cd lemonldap-ng-*/Lemonldap-NG-(Portal|Handler|Manager)
$ perl Makefile.PL && make && make test
$ sudo make install
else for a complete install:
$ tar xzf lemonldap-ng-*.tar.gz
$ cd lemonldap-ng-*
$ make && make test
$ sudo make install
See prereq in §1.1.2
2.3 - LEMONLDAP::NG INSTALLATION
--------------------------------
2.3.1 - Database configuration
2.3.1.1 - Lemonldap::NG Configuration database
If you use DBI or another system to share Lemonldap::NG configuration, you have
to initialize the database. An example is given in example/lmConfig.mysql for
MySQL.
2.3.1.2 - Apache::Session database
The choice of Apache::Session::* module is free. See Apache::Session::Store::*
or Apache::Session::* to know how to configure the module. For example, if you
want to use Apache::Session::MySQL, you can create the database like this:
CREATE DATABASE sessions (
id char(32),
a_session text
);
2.3.2 - Manager configuration
Copy example/manager.cgi and personalize it if you want (see
Lemonldap::NG::Manager). You have to set in particular configStorage. For
example with MySQL:
$my $manager = Lemonldap::NG::Manager->new ( {
dbiChain => "DBI:mysql:database=mybase;host=1.2.3.4",
dbiUser => "lemonldap-ng",
dbiPassword => "mypass",
} );
Securise Manager access with Apache: Lemonldap::NG does not securise the manager
itself yet:
SSLEngine On
Order Deny, Allow
Deny from all
Allow from admin-network/netmask
AuthType Basic
...
After configuration, you can also protect the manager with an Lemonldap::NG
handler.
2.3.3 - Configuration edition
Connect to the manager with your browser start configure your Web-SSO. You have
to set at least some parameters:
a) General parameters :
* Authentication parameters -> portal : URL to access to the authentication
portal
* Domain : the cookie domain. All protected VirtualHosts have to be under it
* LDAP parameters -> LDAP Server
* LDAP parameters -> LDAP Accout and password : required only if anonymous
binds are not accepted
* Session Storage -> Apache::Session module : how to store user sessions.
You can use all module that
inherit from Apache::Session
like Apache::Session::MySQL
* Session Storage -> Apache::Session Module parameters :
see Apache::Session::<Choosen module>
b) User groups :
Use the "New Group" button to add your first group. On the left, set the
keyword which will be used later and set on the right the corresponding rule:
you can use :
* an LDAP filter (it will be tested with the user uid)
or
* a Perl condition enclosed with {}. All variables declared in "General
parameters -> LDAP attributes" can be used with a "$". For example:
MyGroup / { $uid eq "foo" or $uid eq "bar" }
c) Virtual hosts
You have to create a virtual host for each Apache host (virtual or real)
protected by Lemonldap::NG even if just a sub-directory is protected. Else,
user who want to access to the protected area will be rejected with a "500
Internal Server Error" message and the apache logs will explain the problem.
Each virtual host has 2 groups of parameters:
* Headers: the headers added to the apache request. Default :
Auth-User => $uid
* Rules: subdivised in 2 categories:
* default : the default rule
* personalized rules: association of a Perl regular expression and
a condition. For example:
^/restricted.*$ / $groups =~ /\bMyGroup\b/
-------------
3 - DEBUGGING
-------------
Lemonldap::NG uses simply the Apache log system. So use LogLevel to choose
information to display.
#!/usr/bin/make
# Prefix for packaging
DESTDIR=
PERL=$$(which perl)
# Perl options
#PERLOPTIONS="INSTALLDIRS=vendor"
PERLOPTIONS=
# Default directories install
PREFIX=/usr/local
LMPREFIX=$(PREFIX)/lemonldap-ng
RLMPREFIX=$(DESTDIR)/$(LMPREFIX)
# BIN dirs
BINDIR=$(LMPREFIX)/bin
RBINDIR=$(DESTDIR)/$(BINDIR)
DATADIR=$(LMPREFIX)/data
RDATADIR=$(DESTDIR)/$(DATADIR)
EXAMPLEROOT=`pwd`/example
# Document roots for Apache VirtualHosts
DOCUMENTROOT=$(LMPREFIX)/htdocs
PORTALDIR=$(DOCUMENTROOT)/portal
RPORTALDIR=$(DESTDIR)/$(PORTALDIR)
PORTALSKINSDIR=$(PORTALDIR)/skins
RPORTALSKINSDIR=$(DESTDIR)/$(PORTALSKINSDIR)
LASPPORTALDIR=$(DOCUMENTROOT)/liberty-alliance-sp-portal
RLASPPORTALDIR=$(DESTDIR)/$(LASPPORTALDIR)
MANAGERDIR=$(DOCUMENTROOT)/manager
RMANAGERDIR=$(DESTDIR)/$(MANAGERDIR)
MANAGERDATADIR=$(MANAGERDIR)/imgs
RMANAGERDATADIR=$(DESTDIR)/$(MANAGERDATADIR)
SESSIONSEXPLORERDIR=$(MANAGERDIR)
RSESSIONSEXPLORERDIR=$(DESTDIR)/$(SESSIONSEXPLORERDIR)
SESSIONSEXPLORERDATADIR=$(SESSIONSEXPLORERDIR)/images
RSESSIONSEXPLORERDATADIR=$(DESTDIR)/$(SESSIONSEXPLORERDATADIR)
DOCDIR=$(DOCUMENTROOT)/doc
RDOCDIR=$(DESTDIR)/$(DOCDIR)
TESTDIR=$(DOCUMENTROOT)/test
RTESTDIR=$(DESTDIR)/$(TESTDIR)
EXAMPLESDIR=$(LMPREFIX)/examples
REXAMPLESDIR=$(DESTDIR)/$(EXAMPLESDIR)
TOOLSDIR=$(LMPREFIX)/tools
RTOOLSDIR=$(DESTDIR)/$(TOOLSDIR)
# Handler dir
HANDLERDIR=$(LMPREFIX)/handler
RHANDLERDIR=$(DESTDIR)/$(HANDLERDIR)
# Configuration dir
CONFDIR=$(LMPREFIX)/etc
RCONFDIR=$(DESTDIR)/$(CONFDIR)
CRONDIR=$(LMPREFIX)/etc/cron.d
RCRONDIR=$(DESTDIR)/$(CRONDIR)
STORAGECONFFILE=$(CONFDIR)/storage.conf
# Lemonldap-ng configuration storage dir
FILECONFIGDIR=$(DATADIR)/conf
RFILECONFIGDIR=$(DESTDIR)/$(FILECONFIGDIR)
# Apache::Session::File storage dir
APACHESESSIONFILEDIR=$(DATADIR)/sessions
RAPACHESESSIONFILEDIR=$(DESTDIR)/$(APACHESESSIONFILEDIR)
APACHESESSIONFILELOCKDIR=$(APACHESESSIONFILEDIR)/lock
RAPACHESESSIONFILELOCKDIR=$(DESTDIR)/$(APACHESESSIONFILELOCKDIR)
APACHEUSER=
APACHEGROUP=
# DNS Domain for cookie and virtual hosts
DNSDOMAIN=example.com
# LDAP parameters
LDAPHOST=localhost
LDAPPORT=389
LDAPSUFFIX=dc=example,dc=com
# Other
VERSION=`head -n1 changelog |sed -e 's/lemonldap-ng (//' -e 's/).*$$//'`
SRCCOMMONDIR=lemonldap-ng-common
SRCHANDLERDIR=lemonldap-ng-handler
SRCPORTALDIR=lemonldap-ng-portal
SRCMANAGERDIR=lemonldap-ng-manager
EXAMPLELANG=en # For static Manager example only
ERASECONFIG=1 # Set to 0 if you do not want to replace your configuration
all: configure common handler manager portal
@echo
@echo "Building succeed. Now run :"
@echo " - make test to verify your installation"
@echo " - make install to install all"
@echo
@echo 'Other targets :'
@echo " * Partial build :"
@echo " - portal, manager, handler"
@echo " * Doxygen documentation"
@echo " - doxygen (to build Doxygen documentation in doc/devel/)"
@echo
@echo 'Other targets launched by "make install" :'
@echo " * Perl libraries install :"
@echo " - install_libs (all Perl libraries)"
@echo " - install_portal_libs"
@echo " - install_manager_libs"
@echo " - install_handler_libs"
@echo " * Binaries install :"
@echo " - install_bin ($(BINDIR))"
@echo " * Web sites install :"
@echo " - install_site (all sites including install_doc_site)"
@echo " - install_portal_site ($(PORTALDIR))"
@echo " - install_manager_site ($(MANAGERDIR))"
@echo " - install_handler_site ($(HANDLERDIR))"
@echo " * Documentation install :"
@echo " - install_doc_site ($(DOCDIR))"
@echo " - install_examples_site ($(EXAMPLESDIR))"
@echo
#
# Perl libraries configuration
#
configure: common_conf handler_conf portal_conf manager_conf
common_conf:
@cd ${SRCCOMMONDIR}; LMNGCONFFILE=$(STORAGECONFFILE) perl Makefile.PL $(PERLOPTIONS)
@touch common_conf
handler_conf:
@cd ${SRCHANDLERDIR}; perl Makefile.PL $(PERLOPTIONS)
@touch handler_conf
portal_conf:
@cd ${SRCPORTALDIR}; perl Makefile.PL $(PERLOPTIONS)
@touch portal_conf
manager_conf:
@cd ${SRCMANAGERDIR}; perl Makefile.PL $(PERLOPTIONS)
@touch manager_conf
#
# Perl libraries make
#
common: common_conf
@$(MAKE) -C ${SRCCOMMONDIR}
@touch common
handler: handler_conf
@$(MAKE) -C ${SRCHANDLERDIR}
@touch handler
portal: portal_conf
@$(MAKE) -C ${SRCPORTALDIR}
@touch portal
manager: manager_conf
@$(MAKE) -C ${SRCMANAGERDIR}
@touch manager
test: common handler portal manager common_test handler_test portal_test manager_test
common_test: common
@$(MAKE) -C ${SRCCOMMONDIR} test
handler_test: handler common_test
@$(MAKE) -C ${SRCHANDLERDIR} test FULLPERL="$(PERL) -I../${SRCCOMMONDIR}/blib/lib/"
portal_test: portal handler_test common_test
@$(MAKE) -C ${SRCPORTALDIR} test FULLPERL="$(PERL) -I../${SRCCOMMONDIR}/blib/lib/ -I../${SRCHANDLERDIR}/blib/lib/"
manager_test: manager handler_test common_test
@$(MAKE) -C ${SRCMANAGERDIR} test FULLPERL="$(PERL) -I../${SRCCOMMONDIR}/blib/lib/ -I../${SRCHANDLERDIR}/blib/lib/"
#
# INSTALL
#
install: install_libs install_bin install_site
#
# Perl libraires install
#
install_libs: common_install_libs install_handler_libs install_portal_libs install_manager_libs
common_install_libs: common
@$(MAKE) -C ${SRCCOMMONDIR} install
install_handler_libs: handler
@$(MAKE) -C ${SRCHANDLERDIR} install
install_portal_libs: portal
@$(MAKE) -C ${SRCPORTALDIR} install
install_manager_libs: manager
@$(MAKE) -C ${SRCMANAGERDIR} install
example:
$(MAKE) install_site LMPREFIX=$(EXAMPLEROOT)
install_bin: install_libs install_conf_dir
# Binary install
@install -v -d $(RBINDIR)
@cp --preserve=mode --remove-destination \
${SRCPORTALDIR}/example/scripts/purgeCentralCache \
${SRCPORTALDIR}/example/scripts/buildPortalWSDL \
${SRCCOMMONDIR}/scripts/lmConfig_File2MySQL \
${SRCCOMMONDIR}/scripts/lmConfig_File2LDIF \
${SRCMANAGERDIR}/example/scripts/lmConfigEditor \
$(RBINDIR)
chmod +x $(RBINDIR)/*