<divclass="noteclassic">This requires to configure <abbrtitle="LemonLDAP::NG">LL::NG</abbr> as an <ahref="idpsaml.html"class="wikilink1"title="documentation:1.9:idpsaml">SAML Identity Provider</a>.
...
...
@@ -224,8 +224,8 @@ Applications listed below are known to be easy to integrate in <abbr title="Lemo
<liclass="level1"><divclass="li"> Go to <ahref="https://your.portal.com/saml/metadata"class="urlextern"title="https://your.portal.com/saml/metadata"rel="nofollow">https://your.portal.com/saml/metadata</a> and save the resulting file locally.</div>
</li>
<liclass="level1"><divclass="li"> In each AWS account, go to IAM → Identity providers → Create Provider.</div>
<liclass="level1"><divclass="li"> In each AWS account, go to IAM -> Identity providers -> Create Provider.</div>
</li>
<liclass="level1"><divclass="li"> Select <code><abbrtitle="Security Assertion Markup Language">SAML</abbr></code> as the provider type</div>
</li>
<liclass="level1"><divclass="li"> Choose a name (best if kept consistent between accounts), and then choose the metadata file you saved above.</div>
</li>
<liclass="level1"><divclass="li"> Looking again at the links on the left side of the page, go to Roles → Create role</div>
<liclass="level1"><divclass="li"> Looking again at the links on the left side of the page, go to Roles -> Create role</div>
<liclass="level1"><divclass="li"> Assuming you use the web interface to manage lemonldap, go to General Parameters → Authentication parameters → LDAP parameters → Exported variables. Here set the key to the LDAP attribute and the value to something sensible. I keep them the same to make it easy.</div>
<liclass="level1"><divclass="li"> Assuming you use the web interface to manage lemonldap, go to General Parameters -> Authentication parameters -> LDAP parameters -> Exported variables. Here set the key to the LDAP attribute and the value to something sensible. I keep them the same to make it easy.</div>
</li>
<liclass="level1"><divclass="li"> Now go to *Variables → Macros*. Here set up variables which will be computed based on the attributes you exported above. You will need to emit strings in this format <code>arn:aws:iam::account-number:role/role-name1,arn:aws:iam::account-number:saml-provider/provider-name</code>. The parts you need to change are <code>account-number</code>, <code>role-name1</code> and <code>provier-name</code>. The last two will be the provider name and role names you just set up in AWS.</div>
<liclass="level1"><divclass="li"> Now go to *Variables -> Macros*. Here set up variables which will be computed based on the attributes you exported above. You will need to emit strings in this format <code>arn:aws:iam::account-number:role/role-name1,arn:aws:iam::account-number:saml-provider/provider-name</code>. The parts you need to change are <code>account-number</code>, <code>role-name1</code> and <code>provier-name</code>. The last two will be the provider name and role names you just set up in AWS.</div>
</li>
<liclass="level1"><divclass="li"> Perl works in here, so something like this is valid: <code>aws_eu_role</code>→ <code>$ou =~ sysadmin ? “arn:aws…” : “arn:…”</code></div>
<liclass="level1"><divclass="li"> Perl works in here, so something like this is valid: <code>aws_eu_role</code>-><code>$ou =~ sysadmin ? “arn:aws...” : “arn:...”</code></div>
</li>
<liclass="level1"><divclass="li"> If it easier, split multiple roles into different macros. Then tie all the variables you define together into one string concatenating them with whatever is in General Parameters → Advanced Parameters → Separator. Actually click into this field and move around with the arrow keys to see if there is a space, since spaces can be part of the separator.</div>
<liclass="level1"><divclass="li"> If it easier, split multiple roles into different macros. Then tie all the variables you define together into one string concatenating them with whatever is in General Parameters -> Advanced Parameters -> Separator. Actually click into this field and move around with the arrow keys to see if there is a space, since spaces can be part of the separator.</div>
</li>
<liclass="level1"><divclass="li"> Remember macros are defined alphanumerically, so you want one right at the end, like <code>z_aws_roles</code>→ <code>join(“; ”, $role_name1, $role_name2, …)</code></div>
<liclass="level1"><divclass="li"> Remember macros are defined alphanumerically, so you want one right at the end, like <code>z_aws_roles</code>-><code>join(“; ”, $role_name1, $role_name2, ...)</code></div>
</li>
<liclass="level1"><divclass="li"> On the left again, click <code><abbrtitle="Security Assertion Markup Language">SAML</abbr> service providers</code>, then <code>Add <abbrtitle="Security Assertion Markup Language">SAML</abbr> SP</code>.</div>
</li>
...
...
@@ -108,15 +108,15 @@ similar, using whatever attribute makes sense to you. For example:<pre class="c
</li>
<liclass="level1"><divclass="li"> Click <code>Exported attributes</code> on the left, then <code>Add attribute</code> twice to add two attributes. The first field is the name of a variable set in the user's session:</div>
<ul>
<liclass="level2"><divclass="li"><code>_whatToTrace</code>→<code><ahref="https://aws.amazon.com/SAML/Attributes/RoleSessionName"class="urlextern"title="https://aws.amazon.com/SAML/Attributes/RoleSessionName"rel="nofollow">https://aws.amazon.com/SAML/Attributes/RoleSessionName</a></code> (leave the rest)</div>
<liclass="level2"><divclass="li"><code>_whatToTrace</code>-><code><ahref="https://aws.amazon.com/SAML/Attributes/RoleSessionName"class="urlextern"title="https://aws.amazon.com/SAML/Attributes/RoleSessionName"rel="nofollow">https://aws.amazon.com/SAML/Attributes/RoleSessionName</a></code> (leave the rest)</div>
</li>
<liclass="level2"><divclass="li"><code>z_aws_roles</code> (the macro name you defined above) →<code><ahref="https://aws.amazon.com/SAML/Attributes/Role"class="urlextern"title="https://aws.amazon.com/SAML/Attributes/Role"rel="nofollow">https://aws.amazon.com/SAML/Attributes/Role</a></code> (leave the rest)</div>
<liclass="level2"><divclass="li"><code>z_aws_roles</code> (the macro name you defined above) -><code><ahref="https://aws.amazon.com/SAML/Attributes/Role"class="urlextern"title="https://aws.amazon.com/SAML/Attributes/Role"rel="nofollow">https://aws.amazon.com/SAML/Attributes/Role</a></code> (leave the rest)</div>
</li>
</ul>
</li>
<liclass="level1"><divclass="li"> On the left, select Options → Security → Enable use of IDP initiated <abbrtitle="Uniform Resource Locator">URL</abbr> → On</div>
<liclass="level1"><divclass="li"> On the left, select Options -> Security -> Enable use of IDP initiated <abbrtitle="Uniform Resource Locator">URL</abbr> -> On</div>
</li>
<liclass="level1"><divclass="li"> Select General Parameters → Portal → Menu → Categories and applications</div>
<liclass="level1"><divclass="li"> Select General Parameters -> Portal -> Menu -> Categories and applications</div>
</li>
<liclass="level1"><divclass="li"> Select a category or create a new one if you need to. Then click <code>New application</code>. </div>
<divclass="noteimportant">The value from <abbrtitle="LemonLDAP::NG">LL::NG</abbr> mail session attribute must be the email of the user in Gitlab database, in order to associate accounts.
...
...
@@ -182,7 +182,7 @@ You can pass groups to Gitlab. For this, declare groups attribute in gitlab.rb:
And in <abbrtitle="LemonLDAP::NG">LL::NG</abbr>, export the groups attribute:
</p>
<ul>
<liclass="level1"><divclass="li"> groups ⇒ groups</div>
<liclass="level1"><divclass="li"> groups => groups</div>
<ahref="http://www.glpi-project.org"class="urlextern"title="http://www.glpi-project.org"rel="nofollow">GLPI</a> is the Information Resource-Manager with an additional Administration- Interface. You can use it to build up a database with an inventory for your company (computer, software, printers…). It has enhanced functions to make the daily life for the administrators easier, like a job-tracking-system with mail-notification and methods to build a database with basic information about your network-topology.
<ahref="http://www.glpi-project.org"class="urlextern"title="http://www.glpi-project.org"rel="nofollow">GLPI</a> is the Information Resource-Manager with an additional Administration- Interface. You can use it to build up a database with an inventory for your company (computer, software, printers...). It has enhanced functions to make the daily life for the administrators easier, like a job-tracking-system with mail-notification and methods to build a database with basic information about your network-topology.
<divclass="notewarning">In last version of Auth_remoteuser and Mediawiki, auto-provisioning requires REMOTE_USER to match the normalized mediawiki username (for example: john_doe → john doe), so you may need to patch the extension code if you get the error:
<divclass="notewarning">In last version of Auth_remoteuser and Mediawiki, auto-provisioning requires REMOTE_USER to match the normalized mediawiki username (for example: john_doe -> john doe), so you may need to patch the extension code if you get the error:
Symfony provides many methods conventions to authenticate users (basic, ldap,…) and to load external user sources (ldap, database). The method presented here relies on the “remote_user” method. (in security firewall)
Symfony provides many methods conventions to authenticate users (basic, ldap,...) and to load external user sources (ldap, database). The method presented here relies on the “remote_user” method. (in security firewall)
XWiki is a free wiki software platform written in Java with a design emphasis on extensibility. XWiki is an enterprise wiki. It includes <abbrtitle="What You See Is What You Get">WYSIWYG</abbr> editing, OpenDocument based document import/export, semantic annotations and tagging, and advanced permissions management.
You will configure Xwiki virtual host like other <ahref="../configvhost.html"class="wikilink1"title="documentation:1.9:configvhost">protected virtual host</a>.
</p>
<p>
This is an example, with https and speaking to xwiki via AJP.
