Free lemonldap sso software for linux

Lemonldap::Portal::Authntsso is a Perl extension for the Lemonldap SSO system.

SYNOPSIS

use Lemonldap::Portal::Authntsso;
sub my_method {
my $self = shift;
my $user = $self->{user};
$user.="-cp" if $user !~ /-cp$/;
$self->{user} = $user;
return ;
}

my $message = ;
my %params =Vars;
my $stack_user=Lemonldap::Portal::Authntsso->new(formateUser => &my_method);
my $urlc;
my $urldc;
$retour=$stack_user->process(param => %params,
server => $ReverseProxyConfig::ldap_serveur,
port => $ReverseProxyConfig::ldap_port,
DnManager => $ReverseProxyConfig::ldap_admin_dn,
passwordManager => $ReverseProxyConfig::ldap_admin_pd,
branch => $ReverseProxyConfig::ldap_branch_people,
BDC => $ReverseProxyConfig::BDC,
BDC_secours => $ReverseProxyConfig::BDC_secours,
ntdomain => $ReverseProxyConfig::ntdomain,

);
if ($retour) {
$message=$retour->message;
$erreur=$retour->error;
}

Lemonldap::Portal::Cda is a Cross Domain Authentification Perl extension for Lemonldap SSO.

SYNOPSIS

use Lemonldap::Portal::Cda;
my $stack_user= Lemonldap::Portal::Cda->new(type=> master);
or my $stack_user= Lemonldap::Portal::Cda->new(type=> slave);

Lemonldap is a SSO system under GPL. Sometimes you have two or more domains (.bar.foo and .bar.foo2) The CDA :Cross Domain Authentification manages and centralize all credentials on all domains . CDA works with redirection in order to catch the credential cookie.

You may use an objet "master" domain with a "slave" domain . All authentification needed for the "slave" domain will be redirected on the "master" domain

METHODS

new (type => master|slave);

process (param => %params, bar => foo );

The process method alway return an error 8 (message = CDA requested) .

The master CDA just do a redirection with the id_session in the params of url GET . The slave CDA uses the id_session send by master for put on fly a cookie on slave domain.
see directory examples.

(url_encoded,url_decoded) : getAllRedirection

return the initial request encoded in Base64 and plaintext url

string : getSession

return the id_session or false .

string : message() ;

return the text of error

int : error() ;

return the number of error

Lemonldap::NG::Manager is a Perl extension for managing Lemonldap::NG Web-SSO system.

SYNOPSIS

use Lemonldap::NG::Manager;
my $h=new Lemonldap::NG::Manager(
{
configStorage=>{
type=>File,
dirName=>"/tmp/",
},
dhtmlXTreeImageLocation=> "/devel/img/",
# uncomment this only if lemonldap-ng-manager.js is not in the same
# directory than your script.
# jsFile => /path/to/lemonldap-ng-manager.js,
}
) or die "Unable to start, see Apache logs";
# Simple
$h->doall();

You can also peersonalize the HTML code instead of using doall():

print $self->header_public;
print $self->start_html ( # See CGI(3) for more about start_html
-style => "/location/to/my.css",
-title => "Example.com SSO configuration",
);
# optional HTML code for the top of the page
print print $self->main;
# optional HTML code for the footer of the page
print
print $self->end_html;

Lemonldap::NG::Handler is a Perl extension for building a Lemonldap compatible handler.

SYNOPSIS

Create your own package:

package My::Package;
use Lemonldap::NG::Handler;

our @ISA = qw(Lemonldap::NG::Handler);

__PACKAGE__->init ({locationRules => { default => $ou =~ /brh/},
globalStorage => Apache::Session::MySQL,
globalStorageOptions => {
DataSource => dbi:mysql:database=dbname;host=127.0.0.1,
UserName => db_user,
Password => db_password,
TableName => sessions,
LockDataSource => dbi:mysql:database=dbname;host=127.0.0.1,
LockUserName => db_user,
LockPassword => db_password,
},
localStorage => Cache::DBFile,
localStorageOptions => {},
portal => https://portal/,
});

More complete example
package My::Package;
use Lemonldap::NG::Handler;

our @ISA = qw(Lemonldap::NG::Handler);

__PACKAGE__->init ( { locationRules => {
^/pj/.*$ => q($qualif="opj"),
^/rh/.*$ => q($ou=~/brh/),
^/rh_or_opj.*$ => q($qualif="opj or $ou=~/brh/),
default => accept, # means that all authenticated users are greanted
},
globalStorage => Apache::Session::MySQL,
globalStorageOptions => {
DataSource => dbi:mysql:database=dbname;host=127.0.0.1,
UserName => db_user,
Password => db_password,
TableName => sessions,
LockDataSource => dbi:mysql:database=dbname;host=127.0.0.1,
LockUserName => db_user,
LockPassword => db_password,
},
localStorage => Cache::DBFile,
localStorageOptions => {},
cookieName => lemon,
portal => https://portal/,
whatToTrace => $uid,
exportedHeaders => {
Auth-User => $uid,
Unit => $ou,
https => 1,
}
);
Call your package in < apache-directory>/conf/httpd.conf
PerlRequire MyFile
# TOTAL PROTECTION
PerlInitHandler My::Package
# OR SELECTED AREA
< Location /protected-area >
PerlInitHandler My::Package
< /Location >

Lemonldap::NG::Portal::AuthSsl is a Perl extension for building Lemonldap compatible portals based on SSL v3 mechanisms.

SYNOPSIS

use Lemonldap::NG::Portal::AuthSsl;
my $portal = new Lemonldap::NG::Portal(
domain => gendarmerie.defense.gouv.fr,
storageModule => Apache::Session::MySQL,
storageOptions => {
DataSource => dbi:mysql:database,
UserName => db_user,
Password => db_password,
TableName => sessions,
},
ldapServer => ldap.domaine.com,
cookie_secure => 1,
);
# Example of overloading: choose the LDAP variables to store
$portal->{setSessionInfo} = sub {
my ($self) = @_;
foreach $_ qw(uid cn mail appli) {
$self->{sessionInfo}->{$_} = $entry->get_value($_);
}
PE_OK;
};

if($portal->process()) {
# Write here the menu with CGI methods. This page is displayed ONLY IF
# the user was not redirected here.
print $portal->header; # DONT FORGET THIS (see CGI(3))
print "...";

# or redirect the user to the menu
print $portal->redirect( -uri => https://portal/menu);
}
else {
# Write here the html form used to authenticate with CGI methods.
# $portal->error returns the error message if athentification failed
# Warning: by defaut, input names are "user" and "password"
print $portal->header; # DONT FORGET THIS (see CGI(3))
print "...";
print < form method="POST" >;
# In your form, the following value is required for redirection
print < input type="hidden" name="url" value=".$portal->param(url)." >;
# Next, login and password
print Login : < input name="user" >< br >;
print Password : < input name="pasword" type="password" autocomplete="off" >;
print < /form >;
}
Modify your httpd.conf:
< Location /My/File >
SSLVerifyClient require
SSLOptions +ExportCertData +CompatEnvVars +StdEnvVars
< /Location >

Lemonldap is a simple Web-SSO based on Apache::Session modules. It simplifies the build of a protected area with a few changes in the application (they just have to read some headers for accounting).

It manages both authentication and authorization and provides headers for accounting. So you can have a full AAA protection for your web space. There are two ways to build a cross domain authentication:

Cross domain authentication itself (Lemonldap::Portal::Cda (not yet implemented in Lemonldap::NG))

"Liberty Alliance" (Lemonldap::LibertyAlliance::*)

This library just overload few methods of Lemonldap::NG::Portal to use Apache SSLv3 mechanism: weve just to verify that $ENV{SSL_CLIENT_S_DN_Email} exists. So remenber to export SSL variables to CGI.

See Lemonldap::NG::Portal for usage and other methods.

emonldap::Config::Parameters is a Perl module as a Backend of configuration for lemonldap SSO system.

SYNOPSIS

#!/usr/bin/perl
use Lemonldap::Config::Parameters;
use Data::Dumper;
my $nconfig= Lemonldap::Config::Parameters->new(
file =>applications.xml,
cache => /tmp/CONF );
my $conf= $nconfig->getAllConfig;
my $cg=$nconfig->getDomain(appli.cp);
my $ligne= $cg;
print Dumper( $ligne);
my $e = $cg->{templates_options} ;
my $opt= "templates_dir";
my $va = $cg->{$opt};
my $ligne= $nconfig->formateLineHash($e,$opt,$va) ;

or by API :
Lemonldap::Config::Parameters::f_delete(/tmp/CONF);

or by command line
perl -e "use Lemonldap::Config::Parameters; Lemonldap::Config::Parameters::f_delete(/tmp/CONF);"

mod_auth_nufw is a Single Sign On Apache module which performs secure user identification and authentication, based on the Nufw firewalling suite. Nufw marks all connections of a network with a unique UserID.
This module takes advantage of that mark and uses it to transparently identify and authenticate users requiring access to an Apache server.
Main features:
- SSL encryption of SQL connections
- Support of the v2 SSO protocol, which is much lighter, as it avoids all LDAP connections to the module.
- Apache 2 support.
- Finer control on SQL requests.
- Control of server tokens, on Apache2.