Configuration overview

Connect to the manager with your browser (for example http://manager.example.com) to start configure your WebSSO.

You can now configure a default installation, with an LDAP directory.

General parameters

User groups

Use the "New Group" button to add your first group. On the left, set the keyword which will be used later and set on the right the corresponding rule. You can use a Perl condition enclosed with {}. All variables declared in "General parameters -> exported attributes" can be used with a "$".

For example:
MyGroup => { $uid eq "foo" or $uid eq "bar" }

Virtual hosts



You have to create a virtual host for each Apache host (virtual or real) protected by LemonLDAP::NG even if just a sub-directory is protected. Else, user who want to access to the protected area will be rejected with a "500 Internal Server Error" message and the apache logs will explain the problem.

Each virtual host has 2 groups of parameters: For example:
^/restricted.*$  =>  $groups =~ /\bMyGroup\b/


The VirtualHost in LemonLDAP::NG must match a VirtualHost in Apache configuration, like:
# Application Test
<VirtualHost *:80>
    ServerName test1.example.com
    ServerAlias test2.example.com

# SSO protection PerlHeaderParserHandler My::Package

# DocumentRoot DocumentRoot /usr/local/lemonldap-ng/htdocs/test/ <Directory /usr/local/lemonldap-ng/htdocs/test/> Order deny,allow Allow from all Options +ExecCGI </Directory>

# Configuration reload mechanism (only 1 per physical server is # needed): choose your URL to avoid restarting Apache when # configuration change <Location /reload> Order deny,allow Deny from all Allow from 127.0.0.0/8 PerlHeaderParserHandler My::Package->refresh </Location>

# Uncomment this to activate status module #<Location /status> # Order deny,allow # Deny from all # Allow from 127.0.0.0/8 # PerlHeaderParserHandler My::Package->status #</Location>

</VirtualHost>

Remarks: To transform your VirtualHost into a reverse proxy, use for example:
# Application Test
<VirtualHost *:80>
    ServerName test1.example.com
    ServerAlias test2.example.com

# SSO protection PerlHeaderParserHandler My::Package

ProxyPreserveHost on ProxyPass / http://APPLICATION_IP/ ProxyPassReverse / http://APPLICATION_IP/

</VirtualHost>

Remarks: Using the reverse proxy mode, you will not have the REMOTE_USER environment variable set. Indeed, this variable is set by the Handler on the physical server hosting the Handlers, and not on other servers where the Handler is not installed. But this magic Apache configuration will let you transform the Auth-User HTTP header in REMOTE_USER envronment varibale:

SetEnvIfNoCase Auth-User "(.*)" REMOTE_USER=$1

To go further



See the full parameters list.