Fr translation until openidconnect
This commit is contained in:
Xavier Guimard
parent
9d52bfbfa3
commit
006356104e
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
|
|
@ -1,11 +1,11 @@
|
|||
29/02/16 20:12
|
||||
29/02/16 21:36
|
||||
Données du projet
|
||||
|
||||
Segments Mots Caractères (sans espaces) Caractères (avec espaces)
|
||||
Total : 22587 113863 778216 853649
|
||||
Restants : 7098 39568 301730 324395
|
||||
Restants : 6910 37776 292244 313373
|
||||
Segments uniques : 7221 48519 312844 348331
|
||||
Segments uniques restants : 2621 17490 122652 133580
|
||||
Segments uniques restants : 2535 16637 118145 128338
|
||||
|
||||
|
||||
Statistiques par fichiers :
|
||||
|
|
@ -53,8 +53,8 @@ pages/documentation/1.9/authmulti.html 64
|
|||
pages/documentation/1.9/authnull.html 26 0 8 0 106 0 79 0 670 0 447 0 749 0 518 0
|
||||
pages/documentation/1.9/authopenid.html 59 8 30 4 272 24 215 12 1774 284 1257 132 1955 284 1427 132
|
||||
pages/documentation/1.9/authopenidconnect_franceconnect.html 48 17 32 11 306 89 267 66 2383 1124 1962 825 2556 1129 2133 830
|
||||
pages/documentation/1.9/authopenidconnect_google.html 60 38 29 29 342 263 229 229 2353 1878 1453 1453 2569 2045 1620 1620
|
||||
pages/documentation/1.9/authopenidconnect.html 217 149 134 124 947 836 791 759 6133 5401 4745 4556 6746 5983 5348 5137
|
||||
pages/documentation/1.9/authopenidconnect_google.html 60 21 29 12 342 61 229 27 2353 742 1453 317 2569 742 1620 317
|
||||
pages/documentation/1.9/authopenidconnect.html 217 80 134 55 947 185 791 108 6133 2030 4745 1185 6746 2044 5348 1198
|
||||
pages/documentation/1.9/authproxy.html 38 8 17 8 180 64 146 64 1134 437 877 437 1261 482 995 482
|
||||
pages/documentation/1.9/authradius.html 33 1 15 1 159 8 121 8 1018 43 737 43 1127 50 834 50
|
||||
pages/documentation/1.9/authremote.html 86 18 51 8 572 100 494 70 3604 884 2882 515 4032 925 3295 556
|
||||
|
|
@ -88,7 +88,7 @@ pages/documentation/1.9/header_remote_user_conversion.html 37
|
|||
pages/documentation/1.9/highavailability.html 23 3 14 3 128 37 110 37 956 276 810 276 1029 298 882 298
|
||||
pages/documentation/1.9/idpcas.html 63 16 28 8 416 107 325 79 2590 889 1719 573 2903 945 2003 629
|
||||
pages/documentation/1.9/idpopenid.html 89 24 41 4 536 98 358 22 3503 974 2033 215 3836 997 2316 224
|
||||
pages/documentation/1.9/idpopenidconnect.html 215 161 114 112 707 610 525 507 4884 4297 3521 3453 5343 4719 3931 3847
|
||||
pages/documentation/1.9/idpopenidconnect.html 215 155 114 112 707 574 525 507 4884 4105 3521 3453 5343 4499 3931 3847
|
||||
pages/documentation/1.9/idpsaml.html 128 44 39 18 783 309 442 216 5292 2512 2620 1470 5814 2666 2965 1615
|
||||
pages/documentation/1.9/installdeb.html 93 12 74 10 481 71 441 65 3189 544 2861 496 3501 582 3165 534
|
||||
pages/documentation/1.9/installrpm.html 105 21 47 12 572 132 294 98 3755 915 2018 631 4142 979 2234 688
|
||||
|
|
@ -110,7 +110,7 @@ pages/documentation/1.9/mrtg.html 15
|
|||
pages/documentation/1.9/mysqlminihowto.html 30 10 12 5 126 31 76 16 1004 430 585 239 1065 430 629 239
|
||||
pages/documentation/1.9/nosqlsessionbackend.html 33 3 7 1 150 12 60 6 1082 123 382 40 1151 126 426 43
|
||||
pages/documentation/1.9/notifications.html 143 34 103 28 1278 251 1163 233 7733 1625 6768 1396 8716 1819 7713 1590
|
||||
pages/documentation/1.9/openidconnectclaims.html 76 38 1 1 87 45 3 3 648 385 19 19 656 392 21 21
|
||||
pages/documentation/1.9/openidconnectclaims.html 76 36 1 1 87 38 3 3 648 341 19 19 656 343 21 21
|
||||
pages/documentation/1.9/openidconnectservice.html 81 58 51 48 495 454 421 417 3054 2730 2387 2346 3414 3082 2730 2688
|
||||
pages/documentation/1.9/parameterlist.html 690 53 386 44 1098 196 881 169 8827 1337 6713 999 9406 1459 7194 1121
|
||||
pages/documentation/1.9/passwordstore.html 27 5 14 3 166 31 144 25 940 201 748 138 1070 219 877 156
|
||||
|
|
@ -181,8 +181,8 @@ pages/documentation/current/authmulti.html 64
|
|||
pages/documentation/current/authnull.html 26 0 0 0 106 0 0 0 670 0 0 0 749 0 0 0
|
||||
pages/documentation/current/authopenid.html 59 8 0 0 272 24 0 0 1774 284 0 0 1955 284 0 0
|
||||
pages/documentation/current/authopenidconnect_franceconnect.html 48 17 0 0 306 89 0 0 2383 1124 0 0 2556 1129 0 0
|
||||
pages/documentation/current/authopenidconnect_google.html 60 38 0 0 342 263 0 0 2353 1878 0 0 2569 2045 0 0
|
||||
pages/documentation/current/authopenidconnect.html 217 149 0 0 947 836 0 0 6133 5401 0 0 6746 5983 0 0
|
||||
pages/documentation/current/authopenidconnect_google.html 60 21 0 0 342 61 0 0 2353 742 0 0 2569 742 0 0
|
||||
pages/documentation/current/authopenidconnect.html 217 80 0 0 947 185 0 0 6133 2030 0 0 6746 2044 0 0
|
||||
pages/documentation/current/authproxy.html 38 8 0 0 180 64 0 0 1134 437 0 0 1261 482 0 0
|
||||
pages/documentation/current/authradius.html 33 1 0 0 159 8 0 0 1018 43 0 0 1127 50 0 0
|
||||
pages/documentation/current/authremote.html 86 18 0 0 572 100 0 0 3604 884 0 0 4032 925 0 0
|
||||
|
|
@ -216,7 +216,7 @@ pages/documentation/current/header_remote_user_conversion.html 37
|
|||
pages/documentation/current/highavailability.html 23 3 0 0 128 37 0 0 956 276 0 0 1029 298 0 0
|
||||
pages/documentation/current/idpcas.html 63 16 0 0 416 107 0 0 2590 889 0 0 2903 945 0 0
|
||||
pages/documentation/current/idpopenid.html 89 24 0 0 536 98 0 0 3503 974 0 0 3836 997 0 0
|
||||
pages/documentation/current/idpopenidconnect.html 215 161 0 0 707 610 0 0 4884 4297 0 0 5343 4719 0 0
|
||||
pages/documentation/current/idpopenidconnect.html 215 155 0 0 707 574 0 0 4884 4105 0 0 5343 4499 0 0
|
||||
pages/documentation/current/idpsaml.html 128 44 0 0 783 309 0 0 5292 2512 0 0 5814 2666 0 0
|
||||
pages/documentation/current/installdeb.html 93 12 0 0 481 71 0 0 3189 544 0 0 3501 582 0 0
|
||||
pages/documentation/current/installrpm.html 105 21 0 0 572 132 0 0 3755 915 0 0 4142 979 0 0
|
||||
|
|
@ -238,7 +238,7 @@ pages/documentation/current/mrtg.html 15
|
|||
pages/documentation/current/mysqlminihowto.html 30 10 0 0 126 31 0 0 1004 430 0 0 1065 430 0 0
|
||||
pages/documentation/current/nosqlsessionbackend.html 33 3 0 0 150 12 0 0 1082 123 0 0 1151 126 0 0
|
||||
pages/documentation/current/notifications.html 143 34 0 0 1278 251 0 0 7733 1625 0 0 8716 1819 0 0
|
||||
pages/documentation/current/openidconnectclaims.html 76 38 0 0 87 45 0 0 648 385 0 0 656 392 0 0
|
||||
pages/documentation/current/openidconnectclaims.html 76 36 0 0 87 38 0 0 648 341 0 0 656 343 0 0
|
||||
pages/documentation/current/openidconnectservice.html 81 58 0 0 495 454 0 0 3054 2730 0 0 3414 3082 0 0
|
||||
pages/documentation/current/parameterlist.html 690 53 0 0 1098 196 0 0 8827 1337 0 0 9406 1459 0 0
|
||||
pages/documentation/current/passwordstore.html 27 5 0 0 166 31 0 0 940 201 0 0 1070 219 0 0
|
||||
|
|
|
|||
|
|
@ -39,42 +39,36 @@
|
|||
<div class="level2">
|
||||
|
||||
<p>
|
||||
</p><p></p><div class="noteclassic">OpenID Connect is a protocol based on REST, OAuth 2.0 and JOSE stacks. It is described here: <a href="http://openid.net/connect/" class="urlextern" title="http://openid.net/connect/" rel="nofollow">http://openid.net/connect/</a>.
|
||||
|
||||
</p><p></p><div class="noteclassic">OpenID Connect est un protocole basé sur les piles REST, OAuth 2.0 et JOSE. Il est décrit ici : <a href="http://openid.net/connect/" class="urlextern" title="http://openid.net/connect/" rel="nofollow">http://openid.net/connect/</a>.
|
||||
</div></p>
|
||||
</p>
|
||||
|
||||
<p>
|
||||
<abbr title="LemonLDAP::NG">LL::NG</abbr> can act as an OpenID Connect Relying Party (RP) towards multiple OpenID Connect Providers (OP). It will get the user identity trough an ID Token, and grab user attributes trough UserInfo endpoint.
|
||||
|
||||
<abbr title="LemonLDAP::NG">LL::NG</abbr> peut agir comme un serveur « OpenID-Connect Relying Party » (RP), ce qui permet de fédérer <a1>LL::NG</a1> avec : L'identité utilisateur sera récupérée via in jeton d'identification, et les attributs utilisateurs via le point d'accès UserInfo.
|
||||
</p>
|
||||
|
||||
<p>
|
||||
|
||||
As an RP, <abbr title="LemonLDAP::NG">LL::NG</abbr> supports a lot of OpenID Connect features:
|
||||
|
||||
Comme RP, <abbr title="LemonLDAP::NG">LL::NG</abbr> supporte de nombreuses fonctionnalités OpenID-Connect :
|
||||
</p>
|
||||
<ul>
|
||||
<li class="level1"><div class="li"> Authorization Code flow</div>
|
||||
<li class="level1"><div class="li"> Débit de code d'autorisation</div>
|
||||
</li>
|
||||
<li class="level1"><div class="li"> Automatic download of JWKS</div>
|
||||
<li class="level1"><div class="li"> Téléchargement automatique de JWKS</div>
|
||||
</li>
|
||||
<li class="level1"><div class="li"> JWT signature verification</div>
|
||||
<li class="level1"><div class="li"> Vérification de signature JWT</div>
|
||||
</li>
|
||||
<li class="level1"><div class="li"> Access Token Hash verification</div>
|
||||
<li class="level1"><div class="li"> Vérification de hashage des jetons d'accès</div>
|
||||
</li>
|
||||
<li class="level1"><div class="li"> ID Token validation</div>
|
||||
<li class="level1"><div class="li"> Validation de jeton d'identité</div>
|
||||
</li>
|
||||
<li class="level1"><div class="li"> Get UserInfo as JSON or as JWT</div>
|
||||
<li class="level1"><div class="li"> Récupérer UserInfo au format JSON ou JWT</div>
|
||||
</li>
|
||||
<li class="level1"><div class="li"> Logout on EndSession end point</div>
|
||||
<li class="level1"><div class="li"> Déconnexion via point d'accès EndSession</div>
|
||||
</li>
|
||||
</ul>
|
||||
|
||||
<p>
|
||||
|
||||
You can use this authentication module to link your <abbr title="LemonLDAP::NG">LL::NG</abbr> server to any OpenID Connect Provider. Here are some examples, witch their specific documentation:
|
||||
|
||||
On peut utiliser ce module d'authentification pour lier un serveur <abbr title="LemonLDAP::NG">LL::NG</abbr> à n'importe quel fournisseur OpenID-Connect. Quelques exemples, avec leur documentation :
|
||||
</p>
|
||||
<div class="table sectionedit4"><table class="inline">
|
||||
<thead>
|
||||
|
|
@ -94,13 +88,11 @@ You can use this authentication module to link your <abbr title="LemonLDAP::NG">
|
|||
|
||||
</div><!-- EDIT5 SECTION "Configuration" [1107-1133] -->
|
||||
|
||||
<h3 class="sectionedit6" id="openid_connect_service">OpenID Connect Service</h3>
|
||||
<h3 class="sectionedit6" id="openid_connect_service">Service OpenID-Connect</h3>
|
||||
<div class="level3">
|
||||
|
||||
<p>
|
||||
|
||||
See <a href="../../documentation/1.9/openidconnectservice.html" class="wikilink1" title="documentation:1.9:openidconnectservice">OpenIDConnect service</a> configuration chapter.
|
||||
|
||||
Voir le chapître de configuration du <a href="../../documentation/1.9/openidconnectservice.html" class="wikilink1" title="documentation:1.9:openidconnectservice">service OpenID-Connect</a>.
|
||||
</p>
|
||||
|
||||
</div><!-- EDIT6 SECTION "OpenID Connect Service" [1134-1242] -->
|
||||
|
|
@ -112,9 +104,9 @@ See <a href="../../documentation/1.9/openidconnectservice.html" class="wikilink1
|
|||
Dans <code>Paramètres généraux</code> > <code>Modules d'authentification</code>, choisir :
|
||||
</p>
|
||||
<ul>
|
||||
<li class="level1"><div class="li"> <strong>Authentication module</strong>: OpenID Connect</div>
|
||||
<li class="level1"><div class="li"> <strong>Module d'authentication</strong> : OpenID-Connect</div>
|
||||
</li>
|
||||
<li class="level1"><div class="li"> <strong>Users module</strong>: OpenID Connect</div>
|
||||
<li class="level1"><div class="li"> <strong>Module utilisateurs</strong> : OpenID-Connect</div>
|
||||
</li>
|
||||
</ul>
|
||||
|
||||
|
|
@ -124,34 +116,28 @@ Dans <code>Paramètres généraux</code> > <code>Modules d'authentification</
|
|||
</p>
|
||||
|
||||
<p>
|
||||
|
||||
Then in <code>General Parameters</code> > <code>Authentication modules</code> > <code>OpenID Connect parameters</code>, you can set:
|
||||
|
||||
Ensuite dans <code>Paramètres généraux</code> > <code>Paramètres d'authentification</code> > <code>Paramètres OpenID-Connect </code>, on peut indiquer :
|
||||
</p>
|
||||
<ul>
|
||||
<li class="level1"><div class="li"> <strong>Authentication level</strong>: level of authentication to associate to this module</div>
|
||||
<li class="level1"><div class="li"> <strong>Niveau d'authentification</strong> : niveau d'authentification associé à ce module</div>
|
||||
</li>
|
||||
<li class="level1"><div class="li"> <strong>Callback GET parameter</strong>: name of GET parameter used to intercept callback (default: openidconnectcallback)</div>
|
||||
<li class="level1"><div class="li"> <strong>Paramètres GET de rappel</strong> : nom du paramètre GET utilisé pour intercepter le rappel (défaut: openidconnectcallback)</div>
|
||||
</li>
|
||||
<li class="level1"><div class="li"> <strong>State session timeout</strong>: duration of a state session (used to keep state information between autentication request and authentication response) in seconds (default: 600)</div>
|
||||
<li class="level1"><div class="li"> <strong>Durée de vie de la session d'état</strong> : délai durant lequel la session d'état (utilisée pour conserver l'état entre la requête d'authentification et la réponse) en secondes (défaut : 600)</div>
|
||||
</li>
|
||||
</ul>
|
||||
|
||||
</div><!-- EDIT7 SECTION "Authentication and UserDB" [1243-2033] -->
|
||||
|
||||
<h3 class="sectionedit8" id="register_llng_to_an_openid_connect_provider">Register LL::NG to an OpenID Connect Provider</h3>
|
||||
<h3 class="sectionedit8" id="register_llng_to_an_openid_connect_provider">Enregistrer LL::NG dans un fournisseur d'identité OpenID-Connect</h3>
|
||||
<div class="level3">
|
||||
|
||||
<p>
|
||||
|
||||
To register <abbr title="LemonLDAP::NG">LL::NG</abbr>, you will need to give some information like application name or logo. One of mandatory information is the redirect <abbr title="Uniform Resource Locator">URL</abbr> (one or many).
|
||||
|
||||
Pour enregistrer <abbr title="LemonLDAP::NG">LL::NG</abbr>, il faut renseigner quelques informations telles le nom d'application ou le logo. Une des informations exigées est l'<abbr title="Uniform Resource Locator">URL</abbr> de redirection (une ou plusieurs).
|
||||
</p>
|
||||
|
||||
<p>
|
||||
|
||||
To know this information, just take the portal <abbr title="Uniform Resource Locator">URL</abbr> and the Callback GET parameter, for example:
|
||||
|
||||
Pour connaître cette information, prendre simplement l'<abbr title="Uniform Resource Locator">URL</abbr> et le paramètre GET de rappel, par exemple :
|
||||
</p>
|
||||
<ul>
|
||||
<li class="level1"><div class="li"> <a href="http://auth.example.com/?openidcallback=1" class="urlextern" title="http://auth.example.com/?openidcallback=1" rel="nofollow">http://auth.example.com/?openidcallback=1</a></div>
|
||||
|
|
@ -163,48 +149,38 @@ To know this information, just take the portal <abbr title="Uniform Resource Loc
|
|||
</ul>
|
||||
|
||||
<p>
|
||||
</p><p></p><div class="noteimportant">If you use the <a href="../../documentation/1.9/authchoice.html" class="wikilink1" title="documentation:1.9:authchoice">choice backend</a>, you need to add the choice parameter in redirect <abbr title="Uniform Resource Locator">URL</abbr>
|
||||
</p><p></p><div class="noteimportant">Si le <a href="../../documentation/1.9/authchoice.html" class="wikilink1" title="documentation:1.9:authchoice">backend choix</a> est utilisé, il faut ajouter le paramètre choix dans l'<abbr title="Uniform Resource Locator">URL</abbr> de redirection
|
||||
</div></p>
|
||||
</p>
|
||||
|
||||
<p>
|
||||
|
||||
After registration, the OP must give you a client ID and a client secret, that will be used to configure the OP in <abbr title="LemonLDAP::NG">LL::NG</abbr>.
|
||||
|
||||
Après enregistrement, l'OP doit donner un identifiant et un secret clients, qui seront utilisé pour configurer l'OP dans <abbr title="LemonLDAP::NG">LL::NG</abbr>.
|
||||
</p>
|
||||
|
||||
</div><!-- EDIT8 SECTION "Register LL::NG to an OpenID Connect Provider" [2034-2748] -->
|
||||
|
||||
<h3 class="sectionedit9" id="declare_the_openid_connect_provider_in_llng">Declare the OpenID Connect Provider in LL::NG</h3>
|
||||
<h3 class="sectionedit9" id="declare_the_openid_connect_provider_in_llng">Déclarer le fournisseur OpenID Connect dans LL::NG</h3>
|
||||
<div class="level3">
|
||||
|
||||
<p>
|
||||
|
||||
In the Manager, select node <code>OpenID Connect Providers</code> and click on <code>Add OpenID Connect Provider</code>. Give a technical name (no spaces, no special characters), like “sample-op”;
|
||||
|
||||
Dans le manager, choisir <code>Fournisseurs OpenID-Connect</code> et cliquer sur <code>Ajouter un fournisseur OpenID-Connect</code>. Donner un nom technique (sans espaces ni caratères speciaux), tel “sample-op” ;
|
||||
</p>
|
||||
|
||||
<p>
|
||||
|
||||
You can then access to the configuration of this OP.
|
||||
|
||||
On peut ensuite accéder à la configuration de cet OP.
|
||||
</p>
|
||||
|
||||
</div>
|
||||
|
||||
<h4 id="metadata">Métadata</h4>
|
||||
<h4 id="metadata">Métadonnée</h4>
|
||||
<div class="level4">
|
||||
|
||||
<p>
|
||||
|
||||
The OP should publish its metadata in a JSON file (see for example <a href="https://accounts.google.com/.well-known/openid-configuration" class="urlextern" title="https://accounts.google.com/.well-known/openid-configuration" rel="nofollow">Google metadata</a>). Copy the content of this file in the textarea.
|
||||
|
||||
L'OP peut publier sa métadonnée dans un fichier JSON (voir par exemple la <a href="https://accounts.google.com/.well-known/openid-configuration" class="urlextern" title="https://accounts.google.com/.well-known/openid-configuration" rel="nofollow">métadonnée Google</a>). Copier le contenu de ce fichie dans l'emplacement dédié.
|
||||
</p>
|
||||
|
||||
<p>
|
||||
|
||||
If no metadata is available, you need to write them in the textarea. Mandatory fields are:
|
||||
|
||||
À défaut de métadonnée, il faut les écrire. Les champs obligatoires sont :
|
||||
</p>
|
||||
<ul>
|
||||
<li class="level1"><div class="li"> issuer</div>
|
||||
|
|
@ -218,9 +194,7 @@ If no metadata is available, you need to write them in the textarea. Mandatory f
|
|||
</ul>
|
||||
|
||||
<p>
|
||||
|
||||
You can also define:
|
||||
|
||||
On peut aussi définir :
|
||||
</p>
|
||||
<ul>
|
||||
<li class="level1"><div class="li"> jwks_uri</div>
|
||||
|
|
@ -230,9 +204,7 @@ You can also define:
|
|||
</ul>
|
||||
|
||||
<p>
|
||||
|
||||
Example template:
|
||||
|
||||
Modèle exemple :
|
||||
</p>
|
||||
<pre class="code file javascript"><span class="br0">{</span>
|
||||
<span class="st0">"issuer"</span><span class="sy0">:</span> <span class="st0">"https://auth.example.com/"</span><span class="sy0">,</span>
|
||||
|
|
@ -244,18 +216,15 @@ Example template:
|
|||
|
||||
</div>
|
||||
|
||||
<h4 id="jwks_data">JWKS data</h4>
|
||||
<h4 id="jwks_data">Donnée JWKS</h4>
|
||||
<div class="level4">
|
||||
|
||||
<p>
|
||||
|
||||
JWKS is a JSON file containing public keys. <abbr title="LemonLDAP::NG">LL::NG</abbr> can grab them automatically if jwks_uri is defined in metadata. Else you can paste the content of the JSON file in the textarea.
|
||||
|
||||
JWKS est un fichier JSON contenant des clefs publiques. <abbr title="LemonLDAP::NG">LL::NG</abbr> peut les récupérer autoatiquement si jwks_uri est défini dans la métadonnée. Sinon copier le contenu du fichier JSON dans l'emplacement dédié.
|
||||
</p>
|
||||
|
||||
<p>
|
||||
</p><p></p><div class="notetip">If the OpenID Connect provider only uses symmetric encryption, JWKS data is not useful.
|
||||
|
||||
</p><p></p><div class="notetip">Si le fournisseur OpenID-Connect n'utilise qu'une clef symétrique de chiffrement, la donnée JWKS n'est pas nécessaire.
|
||||
</div></p>
|
||||
</p>
|
||||
|
||||
|
|
@ -265,9 +234,7 @@ JWKS is a JSON file containing public keys. <abbr title="LemonLDAP::NG">LL::NG</
|
|||
<div class="level4">
|
||||
|
||||
<p>
|
||||
|
||||
Define here the mapping between the <abbr title="LemonLDAP::NG">LL::NG</abbr> session content and the fields provided in UserInfo response. The fields are defined in <a href="http://openid.net/specs/openid-connect-core-1_0.html#StandardClaims" class="urlextern" title="http://openid.net/specs/openid-connect-core-1_0.html#StandardClaims" rel="nofollow">OpenID Connect standard</a>, and depends on the scope requested by <abbr title="LemonLDAP::NG">LL::NG</abbr> (see options in next chapter).
|
||||
|
||||
Définir ici la correspondance entre le contenu de la sessions <abbr title="LemonLDAP::NG">LL::NG</abbr> et les champs fournis dans la réponse UserInfo. Les champs sont définis dans le <a href="http://openid.net/specs/openid-connect-core-1_0.html#StandardClaims" class="urlextern" title="http://openid.net/specs/openid-connect-core-1_0.html#StandardClaims" rel="nofollow">standard OpenID-Connect</a>, et dépendent de la portée requise par <abbr title="LemonLDAP::NG">LL::NG</abbr> (voir les options dans le prochain chapitre).
|
||||
</p>
|
||||
|
||||
</div>
|
||||
|
|
@ -276,7 +243,7 @@ Define here the mapping between the <abbr title="LemonLDAP::NG">LL::NG</abbr> se
|
|||
<div class="table sectionedit10"><table class="inline">
|
||||
<thead>
|
||||
<tr class="row0 roweven">
|
||||
<th class="col0"> Claim name </th><th class="col1"> Type </th><th class="col2"> Example of corresponding LDAP attribute </th>
|
||||
<th class="col0"> Nom affiché </th><th class="col1"> Type </th><th class="col2"> Exemple de correspondance d'attributs LDAP </th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tr class="row1 rowodd">
|
||||
|
|
@ -361,9 +328,7 @@ Define here the mapping between the <abbr title="LemonLDAP::NG">LL::NG</abbr> se
|
|||
<div class="level4">
|
||||
|
||||
<p>
|
||||
|
||||
So you can define for example:
|
||||
|
||||
Ainsi on peut définir par exemple:
|
||||
</p>
|
||||
<ul>
|
||||
<li class="level1"><div class="li"> cn ⇒ name</div>
|
||||
|
|
@ -381,47 +346,47 @@ So you can define for example:
|
|||
<h4 id="options">Options</h4>
|
||||
<div class="level4">
|
||||
<ul>
|
||||
<li class="level1"><div class="li"> <strong>Configuration</strong>:</div>
|
||||
<li class="level1"><div class="li"> <strong>Configuration</strong> :</div>
|
||||
<ul>
|
||||
<li class="level2"><div class="li"> <strong>Configuration endpoint</strong>: <abbr title="Uniform Resource Locator">URL</abbr> of OP configuration endpoint</div>
|
||||
<li class="level2"><div class="li"> <strong>Configuration endpoint</strong>: <abbr title="Uniform Resource Locator">URL</abbr> de point d'accès de configuration de l'OP</div>
|
||||
</li>
|
||||
<li class="level2"><div class="li"> <strong>JWKS data timeout</strong>: After this time, <abbr title="LemonLDAP::NG">LL::NG</abbr> will do a request to get a fresh version of JWKS data. Set to 0 to disable it.</div>
|
||||
<li class="level2"><div class="li"> <strong>Durée de vie de la donnée JWKS</strong> : au delà de ce délai, <abbr title="LemonLDAP::NG">LL::NG</abbr> effectuera une requête pour rafraîchir la donnée JWKS. Mettre à 0 pour désactiver.</div>
|
||||
</li>
|
||||
<li class="level2"><div class="li"> <strong>Client ID</strong>: Client ID given by OP</div>
|
||||
<li class="level2"><div class="li"> <strong>Identifiant client</strong> : identifiant client donné par l'OP</div>
|
||||
</li>
|
||||
<li class="level2"><div class="li"> <strong>Client secret</strong>: Client secret given by OP</div>
|
||||
<li class="level2"><div class="li"> <strong>Secret client</strong> : secret client donné par l'OP</div>
|
||||
</li>
|
||||
</ul>
|
||||
</li>
|
||||
<li class="level1"><div class="li"> <strong>Protocol</strong>:</div>
|
||||
<li class="level1"><div class="li"> <strong>Protocole</strong> :</div>
|
||||
<ul>
|
||||
<li class="level2"><div class="li"> <strong>Scope</strong>: Value of scope parameter (example: openid profile). The <code>openid</code> scope is mandatory.</div>
|
||||
<li class="level2"><div class="li"> <strong>Portée</strong> : valeur du paramètre de portée (exemple : profil openid). La portée <code>openid</code> est exigée.</div>
|
||||
</li>
|
||||
<li class="level2"><div class="li"> <strong>Display</strong>: Value of display parameter (example: page)</div>
|
||||
<li class="level2"><div class="li"> <strong>Affichage</strong> : valeur du paramètre d'affichage (exemple : page)</div>
|
||||
</li>
|
||||
<li class="level2"><div class="li"> <strong>Prompt</strong>: Value of prompt parameter (example: consent)</div>
|
||||
<li class="level2"><div class="li"> <strong>Prompt</strong> : valeur du paramètre prompt (exemple : consent)</div>
|
||||
</li>
|
||||
<li class="level2"><div class="li"> <strong>Max age</strong>: Value of max_age parameter (example: 3600)</div>
|
||||
<li class="level2"><div class="li"> <strong>Âge max</strong> : valeur du paramètre max_age (exemple : 3600)</div>
|
||||
</li>
|
||||
<li class="level2"><div class="li"> <strong>UI locales</strong>: Value of ui_locales parameter (example: en-<abbr title="Gigabyte">GB</abbr> en fr-FR fr)</div>
|
||||
<li class="level2"><div class="li"> <strong>UI locales</strong> : valeur du paramètre ui_locales (exemple : en-<abbr title="Gigaoctet">GB</abbr> en fr-FR fr)</div>
|
||||
</li>
|
||||
<li class="level2"><div class="li"> <strong>ACR values</strong>: Value acr_values parameters (example: loa-1)</div>
|
||||
<li class="level2"><div class="li"> <strong>Valeurs ACR</strong> : valeur des paramètres acr_values (exemple : loa-1)</div>
|
||||
</li>
|
||||
<li class="level2"><div class="li"> <strong>Token endpoint authentication method</strong>: Choice between <code>client_secret_post</code> and <code>client_secret_basic</code></div>
|
||||
<li class="level2"><div class="li"> <strong>Méthode d'authentification du point d'accès du jeton</strong> : choisir entre <code>client_secret_post</code> et <code>client_secret_basic</code></div>
|
||||
</li>
|
||||
<li class="level2"><div class="li"> <strong>Check JWT signature</strong>: Set to 0 to disable JWT signature checking</div>
|
||||
<li class="level2"><div class="li"> <strong>Vérifier la signature JWT</strong> : mettre à 0 pour désactiver la signature JWT</div>
|
||||
</li>
|
||||
<li class="level2"><div class="li"> <strong>ID Token max age</strong>: If defined, <abbr title="LemonLDAP::NG">LL::NG</abbr> will check the date of ID token and refuse it if it is too old</div>
|
||||
<li class="level2"><div class="li"> <strong>Durée de vie max des jetons</strong> : si défini, <abbr title="LemonLDAP::NG">LL::NG</abbr> examinera la date du jeton d'identification et refusera les jetons trop anciens</div>
|
||||
</li>
|
||||
<li class="level2"><div class="li"> <strong>Use Nonce</strong>: If enabled, a nonce will be sent, and verified from the ID Token</div>
|
||||
<li class="level2"><div class="li"> <strong>Utiliser Nonce</strong> : si activé, un nonce sera envoyé, et vérifié depuis le jeton d'identité</div>
|
||||
</li>
|
||||
</ul>
|
||||
</li>
|
||||
<li class="level1"><div class="li"> <strong>Affichage</strong> :</div>
|
||||
<ul>
|
||||
<li class="level2"><div class="li"> <strong>Display name</strong>: Name of the application</div>
|
||||
<li class="level2"><div class="li"> <strong>Nom affiché</strong> : nom de l'application</div>
|
||||
</li>
|
||||
<li class="level2"><div class="li"> <strong>Logo</strong>: Logo of the application</div>
|
||||
<li class="level2"><div class="li"> <strong>Logo</strong> : logo de l'application</div>
|
||||
</li>
|
||||
</ul>
|
||||
</li>
|
||||
|
|
|
|||
|
|
@ -33,30 +33,25 @@
|
|||
<div class="level2">
|
||||
|
||||
<p>
|
||||
|
||||
Do you we have to present <a href="http://www.google.com" class="urlextern" title="http://www.google.com" rel="nofollow">Google</a>? The good news is that Google is a standard OpenID Provider, and so you can easily delegate the authentication of <abbr title="LemonLDAP::NG">LL::NG</abbr> to Google: <a href="https://developers.google.com/identity/protocols/OpenIDConnect" class="urlextern" title="https://developers.google.com/identity/protocols/OpenIDConnect" rel="nofollow">https://developers.google.com/identity/protocols/OpenIDConnect</a>
|
||||
Devons-nous présenter <a href="http://www.google.com" class="urlextern" title="http://www.google.com" rel="nofollow">Google</a> ? La bonne nouvelle est que Google est un fournisseur OpenID-Connect standard, on peut ainsi aisément déléguer l'authentification de <abbr title="LemonLDAP::NG">LL::NG</abbr> à Google : <a href="https://developers.google.com/identity/protocols/OpenIDConnect" class="urlextern" title="https://developers.google.com/identity/protocols/OpenIDConnect" rel="nofollow">https://developers.google.com/identity/protocols/OpenIDConnect</a>
|
||||
</p>
|
||||
|
||||
<p>
|
||||
</p><p></p><div class="noteimportant">Google does not support logout trough OpenID Connect. If you close your session on <abbr title="LemonLDAP::NG">LL::NG</abbr> side, your Google session will still be open.
|
||||
|
||||
</p><p></p><div class="noteimportant">Google ne supporte pas la déconnexion via OpenID-Connect. Si on ferme la session <abbr title="LemonLDAP::NG">LL::NG</abbr>, celle de Google reste ouverte.
|
||||
</div></p>
|
||||
</p>
|
||||
|
||||
</div><!-- EDIT2 SECTION "Presentation" [68-507] -->
|
||||
|
||||
<h2 class="sectionedit3" id="register_on_google">Register on Google</h2>
|
||||
<h2 class="sectionedit3" id="register_on_google">S'enregistrer chez Google</h2>
|
||||
<div class="level2">
|
||||
|
||||
<p>
|
||||
|
||||
You need a Google developer account to access to <a href="https://console.developers.google.com/" class="urlextern" title="https://console.developers.google.com/" rel="nofollow">https://console.developers.google.com/</a>
|
||||
Il faut un compte développer Google pour accéder à <a href="https://console.developers.google.com/" class="urlextern" title="https://console.developers.google.com/" rel="nofollow">https://console.developers.google.com/</a>
|
||||
</p>
|
||||
|
||||
<p>
|
||||
|
||||
Here you can go in <abbr title="Interface de programmation">API</abbr> Manager and get new credentials (<code>client_id</code> and <code>client_secret</code>).
|
||||
|
||||
Aller ensuite dans « <abbr title="Interface de programmation">API</abbr> Manager » et récupérer les nouveaux éléments (<code>client_id</code> and <code>client_secret</code>).
|
||||
</p>
|
||||
|
||||
<p>
|
||||
|
|
@ -65,29 +60,23 @@ Il faut fournir les URLs de rappel, par exemple <a href="https://auth.domain.com
|
|||
|
||||
</div><!-- EDIT3 SECTION "Register on Google" [508-818] -->
|
||||
|
||||
<h2 class="sectionedit4" id="declare_google_in_your_llng_server">Declare Google in your LL::NG server</h2>
|
||||
<h2 class="sectionedit4" id="declare_google_in_your_llng_server">Déclarer Google dans le serveur LL::NG</h2>
|
||||
<div class="level2">
|
||||
|
||||
<p>
|
||||
Aller dans le Manager et créer un fournisseur OpenID-Connect. You can call it <code>google</code> for example.
|
||||
Aller dans le Manager et créer un fournisseur OpenID-Connect. On peut l'appeler <code>google</code> par exemple.
|
||||
</p>
|
||||
|
||||
<p>
|
||||
|
||||
Click on <code>Metadata</code>, and use the OpenID Connect configuration <abbr title="Uniform Resource Locator">URL</abbr> to load them: <a href="https://accounts.google.com/.well-known/openid-configuration" class="urlextern" title="https://accounts.google.com/.well-known/openid-configuration" rel="nofollow">https://accounts.google.com/.well-known/openid-configuration</a>.
|
||||
|
||||
Cliquer sur <code>Métadonnées</code>, et utiliser l'<abbr title="Uniform Resource Locator">URL</abbr> de configuration OpenID-Connect pour les charger : <a href="https://accounts.google.com/.well-known/openid-configuration" class="urlextern" title="https://accounts.google.com/.well-known/openid-configuration" rel="nofollow">https://accounts.google.com/.well-known/openid-configuration</a>.
|
||||
</p>
|
||||
|
||||
<p>
|
||||
|
||||
You can also load the JWKS data from the <abbr title="Uniform Resource Locator">URL</abbr> <a href="https://www.googleapis.com/oauth2/v3/certs" class="urlextern" title="https://www.googleapis.com/oauth2/v3/certs" rel="nofollow">https://www.googleapis.com/oauth2/v3/certs</a>. But as Google rotate their keys, we will also configure a refresh interval on JKWS data.
|
||||
|
||||
On peut aussi charger les données JWKS depuis l'<abbr title="Uniform Resource Locator">URL</abbr> <a href="https://www.googleapis.com/oauth2/v3/certs" class="urlextern" title="https://www.googleapis.com/oauth2/v3/certs" rel="nofollow">https://www.googleapis.com/oauth2/v3/certs</a>. Mais comme Google change régulièrement ses clefs, il faut configurer un intervalle de rafraîchissement des données JKWS.
|
||||
</p>
|
||||
|
||||
<p>
|
||||
|
||||
Go in <code>Exported attributes</code> to choose which attributes you want to collect. Google supports these claims:
|
||||
|
||||
Aller dans les <code>attributs exportés</code> pour choisir les attributs à collecter. Google supporte ces champs :
|
||||
</p>
|
||||
<ul>
|
||||
<li class="level1"><div class="li"> email</div>
|
||||
|
|
@ -112,9 +101,9 @@ Go in <code>Exported attributes</code> to choose which attributes you want to co
|
|||
Aller ensuite dans <code>Options</code>:
|
||||
</p>
|
||||
<ul>
|
||||
<li class="level1"><div class="li"> In <code>Configuration</code>, register the <code>client_id</code> and <code>client_secret</code> given by Google. Set also the configuration <abbr title="Uniform Resource Identifier">URI</abbr> with <a href="https://accounts.google.com/.well-known/openid-configuration" class="urlextern" title="https://accounts.google.com/.well-known/openid-configuration" rel="nofollow">https://accounts.google.com/.well-known/openid-configuration</a>, and JWKS refresh, for example every day: 86400.</div>
|
||||
<li class="level1"><div class="li"> Dans <code>Configuration</code>, enregistrer les <code>client_id</code> et <code>client_secret</code> donnés par Google. Préciser alors l'<abbr title="Uniform Resource Identifier">URI</abbr> de configuration avec <a href="https://accounts.google.com/.well-known/openid-configuration" class="urlextern" title="https://accounts.google.com/.well-known/openid-configuration" rel="nofollow">https://accounts.google.com/.well-known/openid-configuration</a>, et le rafraîchissement JWKS, par exemple pour chaque jour : 86400.</div>
|
||||
</li>
|
||||
<li class="level1"><div class="li"> Dans <code>Protocole</code>, adapter le <code>scope</code> à l'attribut exporté voulu. You can for example use <code>openid profile email</code>.</div>
|
||||
<li class="level1"><div class="li"> Dans <code>Protocole</code>, adapter le <code>scope</code> à l'attribut exporté voulu. On peut par exemple utiliser <code>openid profile email</code>.</div>
|
||||
</li>
|
||||
<li class="level1"><div class="li"> Dans <code>Affichage</code>, on peut indiquer le nom et le logo</div>
|
||||
</li>
|
||||
|
|
|
|||
|
|
@ -113,7 +113,7 @@ In the Manager, select node <code><abbr title="Security Assertion Markup Languag
|
|||
|
||||
</div>
|
||||
|
||||
<h4 id="metadata">Métadata</h4>
|
||||
<h4 id="metadata">Métadonnée</h4>
|
||||
<div class="level4">
|
||||
|
||||
<p>
|
||||
|
|
|
|||
|
|
@ -29,8 +29,7 @@
|
|||
<div class="level2">
|
||||
|
||||
<p>
|
||||
</p><p></p><div class="noteclassic">OpenID Connect is a protocol based on REST, OAuth 2.0 and JOSE stacks. It is described here: <a href="http://openid.net/connect/" class="urlextern" title="http://openid.net/connect/" rel="nofollow">http://openid.net/connect/</a>.
|
||||
|
||||
</p><p></p><div class="noteclassic">OpenID Connect est un protocole basé sur les piles REST, OAuth 2.0 et JOSE. Il est décrit ici : <a href="http://openid.net/connect/" class="urlextern" title="http://openid.net/connect/" rel="nofollow">http://openid.net/connect/</a>.
|
||||
</div></p>
|
||||
</p>
|
||||
|
||||
|
|
@ -78,7 +77,7 @@ As an OP, <abbr title="LemonLDAP::NG">LL::NG</abbr> supports a lot of OpenID Con
|
|||
|
||||
</div><!-- EDIT3 SECTION "Configuration" [923-949] -->
|
||||
|
||||
<h3 class="sectionedit4" id="openid_connect_service">OpenID Connect Service</h3>
|
||||
<h3 class="sectionedit4" id="openid_connect_service">Service OpenID-Connect</h3>
|
||||
<div class="level3">
|
||||
|
||||
<p>
|
||||
|
|
@ -238,7 +237,7 @@ You can map here the attribute names from the <abbr title="LemonLDAP::NG">LL::NG
|
|||
<div class="table sectionedit8"><table class="inline">
|
||||
<thead>
|
||||
<tr class="row0 roweven">
|
||||
<th class="col0"> Claim name </th><th class="col1"> Type </th><th class="col2"> Example of corresponding LDAP attribute </th>
|
||||
<th class="col0"> Nom affiché </th><th class="col1"> Type </th><th class="col2"> Exemple de correspondance d'attributs LDAP </th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tr class="row1 rowodd">
|
||||
|
|
@ -323,9 +322,7 @@ You can map here the attribute names from the <abbr title="LemonLDAP::NG">LL::NG
|
|||
<div class="level4">
|
||||
|
||||
<p>
|
||||
|
||||
So you can define for example:
|
||||
|
||||
Ainsi on peut définir par exemple:
|
||||
</p>
|
||||
<ul>
|
||||
<li class="level1"><div class="li"> name ⇒ cn</div>
|
||||
|
|
|
|||
|
|
@ -137,7 +137,7 @@ Il est ensuite possible d'accéder à la liste des paramètre du SP :
|
|||
|
||||
</div>
|
||||
|
||||
<h4 id="metadata">Métadata</h4>
|
||||
<h4 id="metadata">Métadonnée</h4>
|
||||
<div class="level4">
|
||||
|
||||
<p>
|
||||
|
|
|
|||
|
|
@ -25,7 +25,7 @@
|
|||
<div class="table sectionedit2"><table class="inline">
|
||||
<thead>
|
||||
<tr class="row0 roweven">
|
||||
<th class="col0"> Claim name </th><th class="col1"> Type </th><th class="col2"> Example of corresponding LDAP attribute </th>
|
||||
<th class="col0"> Nom affiché </th><th class="col1"> Type </th><th class="col2"> Exemple de correspondance d'attributs LDAP </th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tr class="row1 rowodd">
|
||||
|
|
|
|||
Loading…
Reference in New Issue
Block a user