<h1><aname="writing_rules_and_headers"id="writing_rules_and_headers">Writing rules and headers</a></h1>
<divclass="level1">
<p>
Lemonldap::NG manage applications by their hostname (Apache's virtualHosts). Rules are used to protect applications, headers are <acronymtitle="Hyper Text Transfer Protocol">HTTP</acronym> headers added to the request to give datas to the application (for logs, profiles,…).
<p><divclass="noteimportant">Note that variables designed by $xx correspond to the name of the <ahref="../../documentation/2.0/exportedvars.html"class="wikilink1"title="documentation:2.0:exportedvars">exported variables</a> or <ahref="../../documentation/2.0/performances.html#macros_and_groups"class="wikilink1"title="documentation:2.0:performances">macro names</a>.
<!-- SECTION "Writing rules and headers" [1-440] -->
<h2><aname="rules"id="rules">Rules</a></h2>
<divclass="level2">
<p>
A rule associates a <ahref="http://en.wikipedia.org/wiki/Perl_Compatible_Regular_Expressions"class="urlextern"title="http://en.wikipedia.org/wiki/Perl_Compatible_Regular_Expressions"rel="nofollow">regular expression</a> to a <acronymtitle="Practical Extraction and Report Language">Perl</acronym> boolean expression or a keyword.
<tdclass="col0 leftalign"> Do not restrict /public/ </td><tdclass="col1 centeralign"> ^/public/ </td><tdclass="col2 centeralign"> skip </td>
</tr>
<trclass="row5 rowodd">
<tdclass="col0 leftalign"> Makes authentication optional, but authenticated users are seen as such (that is, user data are sent to the app through <acronymtitle="Hyper Text Transfer Protocol">HTTP</acronym> headers) </td><tdclass="col1 centeralign"> ^/forum/ </td><tdclass="col2 centeralign"> unprotect </td>
</tr>
<trclass="row6 roweven">
<tdclass="col0 leftalign"> Restrict access to the whole site to users that have the <acronymtitle="Lightweight Directory Access Protocol">LDAP</acronym> description field set to “<acronymtitle="Lightweight Directory Access Protocol">LDAP</acronym> administrator” (must be set in exported variables) </td><tdclass="col1 centeralign"> default </td><tdclass="col2 centeralign"> $description eq "LDAP administrator" </td>
</tr>
</table>
<p>
The “<strong>default</strong>” access rule is used if no other access rule match the current <acronymtitle="Uniform Resource Locator">URL</acronym>.
<liclass="level1"><divclass="li"> Comments can be used to order your rules: rules are applied in the alphabetical order of comment (or regexp in there is no comment). See <strong><ahref="../../documentation/2.0/security.html#write_good_rules"class="wikilink1"title="documentation:2.0:security">security chapter</a></strong> to learn more about writing good rules.</div>
<liclass="level1"><divclass="li"> See <ahref="../../documentation/2.0/performances.html#handler_performance"class="wikilink1"title="documentation:2.0:performances">performances</a> to know how to use macros and groups in rules.</div>
<tdclass="col0 leftalign"> Logout user from Lemonldap::NG and redirect it to http://intranet/ </td><tdclass="col1 centeralign"> ^/index.php\?logout </td><tdclass="col2 centeralign"> logout_sso http://intranet/ </td>
</tr>
<trclass="row2 roweven">
<tdclass="col0 leftalign"> Logout user from current application and redirect it to the menu </td><tdclass="col1 centeralign"> ^/index.php\?logout </td><tdclass="col2 centeralign"> logout_app https://auth.example.com/ </td>
</tr>
<trclass="row3 rowodd">
<tdclass="col0 leftalign"> Logout user from current application and from Lemonldap::NG and redirect it to http://intranet/ </td><tdclass="col1 centeralign"> ^/index.php\?logout </td><tdclass="col2 centeralign"> logout_app_sso http://intranet/ </td>
</tr>
</table>
<p>
<p><divclass="notetip">By default, user will be redirected on portal if no <acronymtitle="Uniform Resource Locator">URL</acronym> defined, or on the specified <acronymtitle="Uniform Resource Locator">URL</acronym> if any.
</div></p>
</p>
<p>
<p><divclass="noteimportant">Only current application is concerned by logout_app* targets. Be careful with some applications which doesn't verify Lemonldap::NG headers after having created their own cookies. If so, you can redirect users to a <acronymtitle="HyperText Markup Language">HTML</acronym> page that explain that it is safe to close browser after disconnect.
</div></p>
</p>
</div>
<!-- SECTION "Rules" [441-3040] -->
<h2><aname="headers"id="headers">Headers</a></h2>
<divclass="level2">
<p>
Headers are associations between an header name and a perl expression that returns a string. Headers are used to give user datas to the application.
</p>
<p>
Examples:
</p>
<tableclass="inline">
<trclass="row0 roweven">
<thclass="col0 centeralign"> Goal </th><thclass="col1 centeralign"> Header name </th><thclass="col2 centeralign"> Header value </th>
</tr>
<trclass="row1 rowodd">
<tdclass="col0 leftalign"> Give the uid (for accounting) </td><tdclass="col1 centeralign"> Auth-User </td><tdclass="col2 centeralign"> $uid </td>
</tr>
<trclass="row2 roweven">
<tdclass="col0 leftalign"> Give a static value </td><tdclass="col1 centeralign"> Some-Thing </td><tdclass="col2 centeralign"> “static-value” </td>
</tr>
<trclass="row3 rowodd">
<tdclass="col0 leftalign"> Give display name </td><tdclass="col1 centeralign"> Display-Name </td><tdclass="col2 centeralign"> $givenName.” ”.$surName </td>
</tr>
<trclass="row4 roweven">
<tdclass="col0 leftalign"> Give a non ascii data </td><tdclass="col1 centeralign"> Display-Name </td><tdclass="col2 centeralign"> encode_base64($givenName." ".$surName) </td>
As described in <ahref="../../documentation/2.0/performances.html#handler_performance"class="wikilink1"title="documentation:2.0:performances">performances chapter</a>, you can use macros, local macros,…
<liclass="level1"><divclass="li"> Since many <acronymtitle="Hyper Text Transfer Protocol">HTTP</acronym> servers refuse non ascii headers, it is recommended to use encode_base64() function to transmit those headers</div>
</li>
<liclass="level1"><divclass="li"> Header names must contain only letters and ”-” character</div>
</li>
</ul>
<p>
</div></p>
</p>
<p>
<p><divclass="notetip">By default, <acronymtitle="Single Sign On">SSO</acronym> cookie is hidden, so protected applications cannot get <acronymtitle="Single Sign On">SSO</acronym> session key. But you can forward this key if it is really needed: