Lemonldap::NG is a modular Web-SSO based on Apache::Session modules. It simplifies the build of a protected area with a few changes in the application. It manages both authentication and authorization and provides headers for accounting. So you can have a full AAA protection.
See README file to known how it works.
The proposed example use a protected site named test.example.com. Non authenticated users are redirected to auth.example.com.
To use Lemonldap::NG, you have to run a LDAP server and of course an Apache server compiled with mod-perl (version 1.3 or 2.x). Generaly, the version of Apache proposed with your Linux distribution match, but some distributions used an experimental version of mod_perl with Apache2 (mod_perl-1.99) which does not work with Lemonldap::NG. With such distributions (like Debian-3.1), you have to use Apache-1.3 or to use a mod_perl backport (www.backports.org package for Debian works fine).
Apache::Session, Net::LDAP, MIME::Base64, CGI, LWP::UserAgent, Cache::Cache, DBI, XML::Simple, SOAP::Lite (only if you want to use SOAP with the manager)
apt-get install libapache-session-perl libnet-ldap-perl libcache-cache-perl \
libdbi-perl perl-modules libwww-perl libcache-cache-perl \
libxml-simple-perl
If you want to use SOAP with the manager :
apt-get install libsoap-lite-perl
$ tar xzf lemonldap-ng-*.tar.gz
$ cd lemonldap-ng-*
$ make && make test
$ sudo make install
$ make example
$ tar xzf lemonldap-ng-*.tar.gz
$ cd lemonldap-ng-*
$ debuild # or fakeroot dpkg-buildpackage
$ sudo dpkg -i ../*lemonldap-ng*.deb
After build, you have new files in the example/ directory
(/usr/share/doc/lemonldap-ng/example with Debian). You just have
to include this file in Apache configuration :
include /path/to/lemonldap-ng/source/example/apache.conf
include /path/to/lemonldap-ng/source/example/apache2.conf
Modify your /etc/hosts file to include :
127.0.0.2 auth.example.com
127.0.0.3 test.example.com
127.0.0.4 manager.example.com
and restart Apache.
Before the example works, you have to set your LDAP settings. There are two ways to do it :
/path/to/lemonldap-ng/source/example/conf/lmConfig-1 and
specify your LDAP settings.If you don't set managerDn and managerPassword, Lemonldap::NG will use an anonymous bind to find user dn.
WARNINGS :
Next, try to connect to http://test.example.com/. You'll be redirect to auth.example.com. Try to authenticate yourself with a valid account and the protected page will appear. You will find other explanations on this page.
To use Lemonldap::NG, you have to run a LDAP server and of course an Apache server compiled with mod-perl (version 1.3 or 2.x). Generaly, the version of Apache proposed with your Linux distribution match, but some distributions used an experimental version of mod_perl with Apache2 (mod_perl-1.99) which does not work with Lemonldap::NG. With such distributions (like Debian-3.1), you have to use Apache-1.3 or to use a mod_perl backport (www.backports.org package for Debian works fine).
For Apache2, you can use both mpm-worker and mpm-prefork. Mpm-worker works faster and Lemonldap::NG use the thread system for best performance. If you have to use mpm-prefork (for example if you use PHP), Lemonldap::NG will work anyway.
You can use Lemonldap::NG in an heterogene world : the authentication portal and the manager can work in any version of Apache 1.3 or more even if mod_perl is not compiled, with ModPerl::Registry or not... Only the handler (site protector) need mod_perl. The different handlers can run on different servers with different versions of Apache/mod_perl.
Warning : Handler and Portal parts both need Lemonldap::NG::Manager components to access to configuration.
CGI, XML::Simple, DBI, LWP::UserAgent (and SOAP::Lite if you want to use SOAP)
With Debian :
# apt-get install perl-modules libxml-simple-perl libdbi-perl libwww-perl
And if you want to use SOAP :
# apt-get install libsoap-lite-perl
Apache::Session, Net::LDAP, CGI, Lemonldap::NG::Manager
With Debian :
# apt-get install libapache-session-perl libnet-ldap-perl perl-modules
Apache::Session, LWP::UserAgent, Cache::Cache, Lemonldap::NG::Manager
With Debian :
# apt-get install libapache-session-perl libwww-perl libcache-cache-perl
If you just want to install a handler or a portal or a manager :
$ tar xzf lemonldap-ng-*.tar.gz
$ cd lemonldap-ng-*/Lemonldap-NG-(Portal|Handler|Manager)
$ perl Makefile.PL && make && make test
$ sudo make install
else for a complete install :
$ tar xzf lemonldap-ng-*.tar.gz
$ cd lemonldap-ng-*
$ make && make test
$ sudo make install
See prereq in Exeample installation
If you use DBI or another system to share Lemonldap::NG configuration, you have to initialize the database. An example is given in example/lmConfig.mysql for MySQL.
The choice of Apache::Session::* module is free. See Apache::Session::Store::* or Apache::Session::* to know how to configure the module. For example, if you want to use Apache::Session::MySQL, you can create the database like this :
CREATE DATABASE sessions (
id char(32),
a_session text
);
Copy example/manager.cgi and personalize it if you want (see Lemonldap::NG::Manager). You have to set in particular configStorage. For example with MySQL :
$my $manager = Lemonldap::NG::Manager->new ( {
dbiChain => "DBI:mysql:database=mybase;host=1.2.3.4",
dbiUser => "lemonldap-ng",
dbiPassword => "mypass",
} );
You can securise Manager access with Lemonldap::NG like any other site (after configuring it) or with Apache. Example :
SSLEngine On
Order Deny, Allow
Deny from all
Allow from admin-network/netmask
AuthType Basic
...
Connect to the manager with your browser start configure your Web-SSO. You have to set at least some parameters :
Main parameters :
Use the "New Group" button to add your first group. On the left, set the keyword which will be used later and set on the right the corresponding rule. you can use :
MyGroup => { $uid eq "foo" or $uid eq "bar" }
You have to create a virtual host for each Apache host (virtual or real) protected by Lemonldap::NG even if just a sub-directory is protected. Else, user who want to access to the protected area will be rejected with a "500 Internal Server Error" message and the apache logs will explain the problem.
Each virtual host has 2 groups of parameters :
Auth-User => $uid
^/restricted.*$ / $groups =~ /\bMyGroup\b/