<h1class="sectionedit1"id="amazon_web_services">Amazon Web Services</h1>
<divclass="level1">
<p>
<ahref="https://aws.amazon.com"class="urlextern"title="https://aws.amazon.com"rel="nofollow">Amazon Web Services</a> allows to delegate authentication through SAML2.
</p>
</div>
<!-- EDIT1 SECTION "Amazon Web Services" [1-132] -->
<h2class="sectionedit2"id="saml">SAML</h2>
<divclass="level2">
<ul>
<liclass="level1"><divclass="li"> Make sure you have followed the steps <ahref="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-saml.html"class="urlextern"title="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-saml.html"rel="nofollow">here</a>.</div>
</li>
<liclass="level1"><divclass="li"> Go to <ahref="https://your.portal.com/saml/metadata"class="urlextern"title="https://your.portal.com/saml/metadata"rel="nofollow">https://your.portal.com/saml/metadata</a> and save the resulting file locally.</div>
</li>
<liclass="level1"><divclass="li"> In each AWS account, go to IAM → Identity providers → Create Provider.</div>
</li>
<liclass="level1"><divclass="li"> Select <code><abbrtitle="Security Assertion Markup Language">SAML</abbr></code> as the provider type</div>
</li>
<liclass="level1"><divclass="li"> Choose a name (best if kept consistent between accounts), and then choose the metadata file you saved above.</div>
</li>
<liclass="level1"><divclass="li"> Looking again at the links on the left side of the page, go to Roles → Create role</div>
<liclass="level1"><divclass="li"> Select the provider you just configured, click <code>Allow programmatic and AWSManagement Console access</code> which will fill in the rest of the form for you, then click next.</div>
</li>
<liclass="level1"><divclass="li"> Set whatever permissions you need to and then click <code>Review</code>.</div>
</li>
<liclass="level1"><divclass="li"> Choose a name for the role. These will shown to people when they log in, so make them descriptive. We have different accounts for different regions of the world, so I put the region into the role name so people know which account is which.</div>
</li>
</ul>
<divclass="noteclassic">If you have only one role, the configuration is simple. If you have multiple
roles for different people, it is a little trickier. As you will see, the <abbrtitle="Security Assertion Markup Language">SAML</abbr>
attributes are not dynamic, so you have to set them in the session when a user
logs in or use a custom function. In this example, I wanted to avoid managing
custom functions on all the servers, so the <abbrtitle="Security Assertion Markup Language">SAML</abbr> attributes are set in
the session. We also use LDAP for user information, so I will describe that.
In our LDAP tree, each user has attributes which are used quite heavily for
dynamic groups and authorisation. You will want something
similar, using whatever attribute makes sense to you. For example:<preclass="code file ldif"><spanclass="re0">dn</span>:<spanclass="re1"> uid=user,ou=people,dc=your,dc=com</span>
<liclass="level1"><divclass="li"> Assuming you use the web interface to manage lemonldap, go to General Parameters → Authentication parameters → LDAP parameters → Exported variables. Here set the key to the LDAP attribute and the value to something sensible. I keep them the same to make it easy.</div>
</li>
<liclass="level1"><divclass="li"> Now go to *Variables → Macros*. Here set up variables which will be computed based on the attributes you exported above. You will need to emit strings in this format <code>arn:aws:iam::account-number:role/role-name1,arn:aws:iam::account-number:saml-provider/provider-name</code>. The parts you need to change are <code>account-number</code>, <code>role-name1</code> and <code>provier-name</code>. The last two will be the provider name and role names you just set up in AWS.</div>
</li>
<liclass="level1"><divclass="li"> Perl works in here, so something like this is valid: <code>aws_eu_role</code> → <code>$ou =~ sysadmin ? “arn:aws…” : “arn:…”</code></div>
</li>
<liclass="level1"><divclass="li"> If it easier, split multiple roles into different macros. Then tie all the variables you define together into one string concatenating them with whatever is in General Parameters → Advanced Parameters → Separator. Actually click into this field and move around with the arrow keys to see if there is a space, since spaces can be part of the separator.</div>
</li>
<liclass="level1"><divclass="li"> Remember macros are defined alphanumerically, so you want one right at the end, like <code>z_aws_roles</code> → <code>join(“; ”, $role_name1, $role_name2, …)</code></div>
</li>
<liclass="level1"><divclass="li"> On the left again, click <code><abbrtitle="Security Assertion Markup Language">SAML</abbr> service providers</code>, then <code>Add <abbrtitle="Security Assertion Markup Language">SAML</abbr> SP</code>.</div>
</li>
<liclass="level1"><divclass="li"> Enter a name, click ok, then select it on the left. Select <code>Metadata</code>, then enter `<ahref="https://signin.aws.amazon.com/static/saml-metadata.xml"class="urlextern"title="https://signin.aws.amazon.com/static/saml-metadata.xml"rel="nofollow">https://signin.aws.amazon.com/static/saml-metadata.xml</a>` in the <code><abbrtitle="Uniform Resource Locator">URL</abbr></code> field, then click load.</div>
</li>
<liclass="level1"><divclass="li"> Click <code>Exported attributes</code> on the left, then <code>Add attribute</code> twice to add two attributes. The first field is the name of a variable set in the user's session:</div>
<ul>
<liclass="level2"><divclass="li"><code>_whatToTrace</code> → <code><ahref="https://aws.amazon.com/SAML/Attributes/RoleSessionName"class="urlextern"title="https://aws.amazon.com/SAML/Attributes/RoleSessionName"rel="nofollow">https://aws.amazon.com/SAML/Attributes/RoleSessionName</a></code> (leave the rest)</div>
</li>
<liclass="level2"><divclass="li"><code>z_aws_roles</code> (the macro name you defined above) → <code><ahref="https://aws.amazon.com/SAML/Attributes/Role"class="urlextern"title="https://aws.amazon.com/SAML/Attributes/Role"rel="nofollow">https://aws.amazon.com/SAML/Attributes/Role</a></code> (leave the rest)</div>
</li>
</ul>
</li>
<liclass="level1"><divclass="li"> On the left, select Options → Security → Enable use of IDP initiated <abbrtitle="Uniform Resource Locator">URL</abbr> → On</div>
</li>
<liclass="level1"><divclass="li"> Select General Parameters → Portal → Menu → Categories and applications</div>
</li>
<liclass="level1"><divclass="li"> Select a category or create a new one if you need to. Then click <code>New application</code>. </div>
</li>
<liclass="level1"><divclass="li"> Enter a name etc. For the <abbrtitle="Uniform Resource Locator">URL</abbr>, use <code><ahref="https://your.portal.com/saml/singleSignOn?IDPInitiated=1&sp=urn:amazon:webservices"class="urlextern"title="https://your.portal.com/saml/singleSignOn?IDPInitiated=1&sp=urn:amazon:webservices"rel="nofollow">https://your.portal.com/saml/singleSignOn?IDPInitiated=1&sp=urn:amazon:webservices</a></code></div>
</li>
<liclass="level1"><divclass="li"> Display application should be set to <code>Enabled</code></div>
</li>
<liclass="level1"><divclass="li"> Go to your portal, click on the link, and check that it works!</div>
<liclass="level2"><divclass="li"><ahref="#dokuwiki_virtual_host_in_manager">Dokuwiki virtual host in Manager</a></div></li>
</ul></li>
...
...
@@ -79,46 +79,52 @@
</p>
<divclass="notetip">LemonLDAP::NG wiki uses Dokuwiki!
</div>
<p>
You will need to install a Dokuwiki plugin, available on <ahref="../download.html#contributions"class="wikilink1"title="download">download page</a>. The plugin will check the <code>REMOTE_USER</code> environment variable to get the connected user.
<ahref="../download.html#contributions"class="wikilink1"title="download">Download</a> the plugin and copy the files in dokuwiki <code>inc/auth/</code> directory:
You need to install a Dokuwiki plugin, available on <ahref="https://www.dokuwiki.org/plugins"class="urlextern"title="https://www.dokuwiki.org/plugins"rel="nofollow">Dokuwiki plugins registry</a>: <ahref="https://www.dokuwiki.org/plugin:authlemonldap"class="urlextern"title="https://www.dokuwiki.org/plugin:authlemonldap"rel="nofollow">https://www.dokuwiki.org/plugin:authlemonldap</a>
Install the plugin using the <ahref="https://www.dokuwiki.org/plugin:plugin"class="urlextern"title="https://www.dokuwiki.org/plugin:plugin"rel="nofollow">Plugin Manager</a>.
</p>
</div>
<!-- EDIT4 SECTION "Configuration" [978-1004] -->
<h3class="sectionedit5"id="dokuwiki_local_configuration">Dokuwiki local configuration</h3>
Configure Dokuwiki virtual host like other <ahref="../configvhost.html"class="wikilink1"title="documentation:2.0:configvhost">protected virtual host</a>.
</p>
<divclass="noteimportant">If you are protecting Dokuwiki with <abbrtitle="LemonLDAP::NG">LL::NG</abbr> as reverse proxy, <ahref="../header_remote_user_conversion.html"class="wikilink1"title="documentation:2.0:header_remote_user_conversion">convert header into REMOTE_USER environment variable</a>.
</div><ul>
<ul>
<liclass="level1"><divclass="li"> For Apache:</div>
</li>
</ul>
...
...
@@ -170,7 +176,7 @@ Configure Dokuwiki virtual host like other <a href="../configvhost.html" class="
<h3class="sectionedit7"id="dokuwiki_virtual_host_in_manager">Dokuwiki virtual host in Manager</h3>
<divclass="level3">
...
...
@@ -179,14 +185,25 @@ Go to the Manager and <a href="../configvhost.html#lemonldapng_configuration" cl
</p>
<p>
Just configure the <ahref="../writingrulesand_headers.html#rules"class="wikilink1"title="documentation:2.0:writingrulesand_headers">access rules</a>.
Configure the <ahref="../writingrulesand_headers.html#rules"class="wikilink1"title="documentation:2.0:writingrulesand_headers">access rules</a>.
</p>
<p>
If using <abbrtitle="LemonLDAP::NG">LL::NG</abbr> as reverse proxy, configure the <code>Auth-User</code><ahref="../writingrulesand_headers.html#headers"class="wikilink1"title="documentation:2.0:writingrulesand_headers">header</a>, else no headers are needed.
<divclass="noteimportant">To allow execution of encode_base64() method, you must deactivate the <ahref="../safejail.html"class="wikilink1"title="documentation:2.0:safejail">Safe jail</a>.
</div>
</div>
<!-- EDIT7 SECTION "Dokuwiki virtual host in Manager" [2631-] --></div>
<!-- EDIT7 SECTION "Dokuwiki virtual host in Manager" [2377-] --></div>
GRR has a <abbrtitle="Single Sign On">SSO</abbr> configuration page in its administration panel. You just need to choose if the authenticated user will be a “user” or a “guest”.
GRR has a <abbrtitle="Single Sign On">SSO</abbr> configuration page in its administration panel.
</p>
<p>
Do not use Lemonldap mode, which is for a very old Lemonldap version, but HTTP authentication.
</p>
<p>
Set the default profile of connected users and which headers contains surname, firstname and mail.
GRR will check the username in REMOTE_USER, so use <ahref="../header_remote_user_conversion.html"class="wikilink1"title="documentation:2.0:header_remote_user_conversion">remote header conversion</a> if you are in proxy mode.
</p>
</div>
<!-- EDIT4 SECTION "Configuration" [176-660] -->
<h3class="sectionedit5"id="grr_virtual_host_in_llng">GRR virtual host in LL::NG</h3>
<ahref="http://www.limesurvey.org"class="urlextern"title="http://www.limesurvey.org"rel="nofollow">LimeSurvey</a> is a web survey software written in PHP. LimeSurvey has a webserver authentication mode that allows one to integrate it directly into LemonLDAP::NG.
<ahref="http://www.limesurvey.org"class="urlextern"title="http://www.limesurvey.org"rel="nofollow">LimeSurvey</a> is a web survey software written in PHP.
To have a stronger integration, we will configure LimeSurvey to autocreate unknown users and use HTTP headers to fill name, mail and roles. For example, we will use 3 roles:
LimeSurvey has a webserver authentication mode that allows one to integrate it directly into LemonLDAP::NG.
</p>
<ul>
<liclass="level1"><divclass="li"> User: can answer to surveys</div>
</li>
<liclass="level1"><divclass="li"> Admin: can create surveys</div>
</li>
<liclass="level1"><divclass="li"> Superadmin: no one can stop him!</div>
<spanclass="co1">// debug: Set this to 1 if you are looking for errors. If you still get no errors after enabling this</span>
<spanclass="co1">// then please check your error-logs - either in your hosting provider admin panel or in some /logs directory</span>
<spanclass="co1">// on your webspace.</span>
<spanclass="co1">// LimeSurvey developers: Set this to 2 to additionally display STRICT PHP error messages and get full access to standard templates</span>
<spanclass="st_h">'debugsql'</span><spanclass="sy0">=></span><spanclass="nu0">0</span><spanclass="sy0">,</span><spanclass="co1">// Set this to 1 to enanble sql logging, only active when debug = 2</span>
See also <ahref="https://manual.limesurvey.org/Optional_settings#Authentication_delegation_with_automatic_user_import"class="urlextern"title="https://manual.limesurvey.org/Optional_settings#Authentication_delegation_with_automatic_user_import"rel="nofollow">https://manual.limesurvey.org/Optional_settings#Authentication_delegation_with_automatic_user_import</a>
Configure LimeSurvey virtual host like other <ahref="../configvhost.html"class="wikilink1"title="documentation:2.0:configvhost">protected virtual host</a>.
</p>
<ul>
<liclass="level1"><divclass="li"> For Apache:</div>
