package Lemonldap::NG::Portal::AuthSSL;
use strict;
use Lemonldap::NG::Portal::Simple;
our $VERSION = '0.04';
# Authentication is made by Apache with SSL and here before searching the LDAP
# Directory.
# So authenticate is overloaded to return only PE_OK.
our $OVERRIDE = {
# By default, authentication is valid if SSL_CLIENT_S_DN_Email environement
# variable is present. Adapt it if you want
extractFormInfo => sub {
my $self = shift;
$self->{user} = $self->https('SSL_CLIENT_S_DN_Email');
return PE_BADCREDENTIALS unless ( $self->{user} );
PE_OK;
},
# As we know only user mail, we have to use it to find him in the LDAP
# directory
formateFilter => sub {
my $self = shift;
$self->{filter} = "(&(mail=" . $self->{user} . ")(objectClass=person))";
PE_OK;
},
authenticate => sub {
PE_OK;
},
};
1;
__END__
=head1 NAME
Lemonldap::NG::Portal::AuthSSL - Perl extension for building Lemonldap::NG
compatible portals with SSL authentication.
=head1 SYNOPSIS
With Lemonldap::NG::Portal::SharedConf::DBI, set authentication field to "SSL".
With Lemonldap::NG::Portal::Simple:
use Lemonldap::NG::Portal::Simple;
my $portal = new Lemonldap::NG::Portal::Simple(
domain => 'gendarmerie.defense.gouv.fr',
globalStorage => 'Apache::Session::MySQL',
globalStorageOptions => {
DataSource => 'dbi:mysql:database',
UserName => 'db_user',
Password => 'db_password',
TableName => 'sessions',
},
ldapServer => 'ldap.domaine.com',
securedCookie => 1,
authentication => 'SSL',
);
if($portal->process()) {
# Write here the menu with CGI methods. This page is displayed ONLY IF
# the user was not redirected here.
print $portal->header; # DON'T FORGET THIS (see CGI(3))
print "...";
# or redirect the user to the menu
print $portal->redirect( -uri => 'https://portal/menu');
}
else {
# If the user enters here, IT MEANS THAT YOUR SSL PARAMETERS ARE BAD
print $portal->header; # DON'T FORGET THIS (see CGI(3))
print "Unable to work
";
print "This server isn't well configured. Contact your administrator.";
print "";
}
Modify your httpd.conf:
SSLVerifyClient require
SSLOptions +ExportCertData +CompatEnvVars +StdEnvVars
=head1 DESCRIPTION
This library just overload few methods of Lemonldap::NG::Portal::Simple to use
Apache SSLv3 mechanism: we've just to verify that
C<$ENV{SSL_CLIENT_S_DN_Email}> exists. So remenber to export SSL variables
to CGI.
See L for usage and other methods.
=head1 SEE ALSO
L, L
=head1 AUTHOR
Xavier Guimard, Ex.guimard@free.frE
=head1 COPYRIGHT AND LICENSE
Copyright (C) 2005 by Xavier Guimard Ex.guimard@free.frE
This library is free software; you can redistribute it and/or modify
it under the same terms as Perl itself, either Perl version 5.8.4 or,
at your option, any later version of Perl 5 you may have available.
=cut