Combination of authentication schemes

Authentification	Utilisateurs	Mot-de-passe
✔	✔

Présentation

This backend allows one to chain authentication method, for example to failback to LDAP authentication if Remote authentication failed…

Configuration

You have to use Combination as authentication module (users module must be set to “Same”). Then go in Combination parameters to :

declare the modules that will be used
set the rule chain

Modules declaration

Each module that will be used in combination rule must be declared. You must set:

the name used in the rule (a uniq string)
the type (LDAP, DBI,…)
the scope:
- authentication and user DB
- authentication only
- user DB only

Par exemple :

Nom	Type	Scope
DB1	DBI	Auth only
DB2	DBI	User DB only

Usually, you can't declare two modules of the same type if they don't have the same parameters. For example, usually you can't declare a MySQL DBI and a PostgreSQL DBI, because there is no extra field for PostgreSQL parameters. Now with Combination, you can declare some overloaded parameters. For example, if DBI is configured to use PostgreSQL but DB2 is a MySQL DB, you can override the “dbiChain” parameter.

Rule chain

Combination allows:

to chain schemes (example: [LDAP] and [DBI])
to test different schemes (example: [LDAP] or [DBI])
to choose authentication scheme depending on some request values

Each scheme must be enclose in []. A comma separates auth and user DB modules. If only one value is set, the same is used for both.

Boolean expression

Remember that schemes in rules are the names declared above.

Exemple	Explanation
`[myLDAP] or [myDBI]`	If myLDAP fails, use myDBI
`[mySSL, myLDAP] or [myLDAP, myLDAP]`	Try mySSL for auth and myLDAP for userDB. If fails, switch to myLDAP for both
`[myLDAP] or [myDBI1] or [myDBI2]`	Try myLDAP, then if it fails, myDBI1, then if it fails myDBI2
`[mySSL and myLDAP, myLDAP ]`	Use mySSL and myLDAP to authentify, myLDAP to get user

Note that “or” can't be used inside a scheme. If you think to “[mySSL or myLDAP, myLDAP]”, you must write [mySSL, myLDAP] or [myLDAP, myLDAP]

Exemple	Explanation
`[myDBI1] and [myDBI2] or [myLDAP]`	Try myDBI1 and myDBI2, if it fails, try myLDAP
`[myDBI1] and [myDBI2] or [myLDAP] and [myDBI2]`	Try myDBI1 and myDBI2, if it fails, try myLDAP and myDBI2

You can't use brackets in a boolean expression and “and” has precedence on “or”.

If you think to “( [myLDAP] or [myDBI1] ) and [myDBI2]”, you must write [myLDAP] and [myDBI2] or [myDBI1] and [myDBI2]

Tests

Test can use only the $env variable. It contains the FastCGI environment variables.

Exemple	Explanation
`if($env→{REMOTE_ADDR} =~ /^10\./) then [myLDAP] else [mySSL, myLDAP]`	If user doesn't come from 10.0.0.0/8 network, use SSL as authentication module
`if($env→{REMOTE_ADDR} =~ /^10\./) then [myLDAP] else if($env→{REMOTE_ADDR} =~ /^192/) then [myDBI1] else [myDBI2]`	Chain tests

Note that brackets can't be used except to enclose test.

If you wants to write if(…) then if…, you must write if(not …) then … else if(…)…

Let's be crazy

The following rule is valid:

if($env→{REMOTE_ADDR} =~ /^192\./) then [mySSL, myLDAP] or [myLDAP] else [myLDAP and myDBI, myLDAP]

Problèmes connus

Federation protocols

SAML, OpenID-Connect, CAS or old OpenID can't be chained with a “and” for authentication part. So “[SAML] and [LDAP]” isn't valid. This is because their authentication kinematic don't use the same steps.

Bad expression	Solution	Explanation
`[SAML] and [LDAP]`	`[SAML, SAML and LDAP]`	Authentication is done by SAML only but user must match an LDAP entry
`[SAML] and [LDAP] or [LDAP]`	`[SAML, SAML and LDAP] or [LDAP]`	Authentication is done by SAML or LDAP but user must match an LDAP entry

Authentification AuthApache

En utilisant ce module, le portail LL::NG est appelé uniquement si Apache ne retourne pas “401 Authentication required”, aucune bascule n'est donc possible. So Kerberos can be used only with a “and” boolean expression.

Example: [ Apache and LDAP, LDAP ]

Pour outrepasser ceci, suivre la documentation du module AuthApache

Authentification SSL

Pour chaîner SSL, il est nécessaire de mettre “SSLRequire optional” dans le fichier de configuration Apache, sinon les utilisateurs ne seront authentifiés que par SSL.

Table of Contents