188 lines
8.8 KiB
HTML
188 lines
8.8 KiB
HTML
|
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
|
|
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
|
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
|
|
lang="en" dir="ltr">
|
|
|
|
<head>
|
|
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
|
|
<title></title>
|
|
<!-- metadata -->
|
|
<meta name="generator" content="Offline" />
|
|
<meta name="version" content="Offline 0.1" />
|
|
<!-- style sheet links -->
|
|
<link rel="stylesheet" media="all" type="text/css" href="../../../css/all.css" />
|
|
<link rel="stylesheet" media="screen" type="text/css" href="../../../css/screen.css" />
|
|
<link rel="stylesheet" media="print" type="text/css" href="../../../css/print.css" />
|
|
|
|
</head>
|
|
<body>
|
|
<div class="dokuwiki export">
|
|
|
|
|
|
<h1 class="sectionedit1" id="writing_rules_and_headers">Writing rules and headers</h1>
|
|
<div class="level1">
|
|
|
|
<p>
|
|
Lemonldap::NG manage applications by their hostname (Apache's virtualHosts). Rules are used to protect applications, headers are HTTP headers added to the request to give datas to the application (for logs, profiles,…).
|
|
</p>
|
|
|
|
<p>
|
|
<p><div class="noteimportant">Note that variables designed by $xx correspond to the name of the <a href="../../documentation/1.9/exportedvars.html" class="wikilink1" title="documentation:1.9:exportedvars">exported variables</a> or <a href="../../documentation/1.9/performances.html#macros_and_groups" class="wikilink1" title="documentation:1.9:performances">macro names</a>.
|
|
</div></p>
|
|
</p>
|
|
|
|
</div>
|
|
<!-- EDIT1 SECTION "Writing rules and headers" [1-440] -->
|
|
<h2 class="sectionedit2" id="rules">Rules</h2>
|
|
<div class="level2">
|
|
|
|
<p>
|
|
A rule associates a <a href="http://en.wikipedia.org/wiki/Perl_Compatible_Regular_Expressions" class="urlextern" title="http://en.wikipedia.org/wiki/Perl_Compatible_Regular_Expressions" rel="nofollow">regular expression</a> to a Perl boolean expression or a keyword.
|
|
</p>
|
|
|
|
<p>
|
|
<a href="/_detail/documentation/manager_access_rule.png?id=documentation%3A1.9%3Awritingrulesand_headers" class="media" title="documentation:manager_access_rule.png"><img src="../../../media/documentation/manager_access_rule.png" class="mediacenter" alt="" /></a>
|
|
</p>
|
|
|
|
<p>
|
|
Examples:
|
|
</p>
|
|
<div class="table sectionedit3"><table class="inline">
|
|
<thead>
|
|
<tr class="row0 roweven">
|
|
<th class="col0 centeralign"> Goal </th><th class="col1 centeralign"> Regular expression </th><th class="col2 centeralign"> Rule </th>
|
|
</tr>
|
|
</thead>
|
|
<tr class="row1 rowodd">
|
|
<td class="col0 leftalign"> Restrict /admin/ directory to user bart.simpson </td><td class="col1 centeralign"> ^/admin/ </td><td class="col2 centeralign"> $uid eq "bart.simpson" </td>
|
|
</tr>
|
|
<tr class="row2 roweven">
|
|
<td class="col0 leftalign"> Restrict /js/ and /css/ directory to authenticated users </td><td class="col1 centeralign"> ^/(css|js)/ </td><td class="col2 centeralign"> accept </td>
|
|
</tr>
|
|
<tr class="row3 rowodd">
|
|
<td class="col0 leftalign"> Deny access to /config/ directory </td><td class="col1 centeralign"> ^/config/ </td><td class="col2 centeralign"> deny </td>
|
|
</tr>
|
|
<tr class="row4 roweven">
|
|
<td class="col0 leftalign"> Do not restrict /public/ </td><td class="col1 centeralign"> ^/public/ </td><td class="col2 centeralign"> skip </td>
|
|
</tr>
|
|
<tr class="row5 rowodd">
|
|
<td class="col0 leftalign"> Makes authentication optional, but authenticated users are seen as such (that is, user data are sent to the app through HTTP headers) </td><td class="col1 centeralign"> ^/forum/ </td><td class="col2 centeralign"> unprotect </td>
|
|
</tr>
|
|
<tr class="row6 roweven">
|
|
<td class="col0 leftalign"> Restrict access to the whole site to users that have the LDAP description field set to “LDAP administrator” (must be set in exported variables) </td><td class="col1 centeralign"> default </td><td class="col2 centeralign"> $description eq "LDAP administrator" </td>
|
|
</tr>
|
|
</table></div>
|
|
<!-- EDIT3 TABLE [670-1513] -->
|
|
<p>
|
|
The “<strong>default</strong>” access rule is used if no other access rule match the current <abbr title="Uniform Resource Locator">URL</abbr>.
|
|
</p>
|
|
|
|
<p>
|
|
<p><div class="notetip">
|
|
</p>
|
|
<ul>
|
|
<li class="level1"><div class="li"> Comments can be used to order your rules: rules are applied in the alphabetical order of comment (or regexp in there is no comment). See <strong><a href="../../documentation/1.9/security.html#write_good_rules" class="wikilink1" title="documentation:1.9:security">security chapter</a></strong> to learn more about writing good rules.</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> See <a href="../../documentation/1.9/performances.html#handler_performance" class="wikilink1" title="documentation:1.9:performances">performances</a> to know how to use macros and groups in rules.</div>
|
|
</li>
|
|
</ul>
|
|
|
|
<p>
|
|
|
|
</div></p>
|
|
</p>
|
|
|
|
<p>
|
|
Rules can also be used to intercept logout <abbr title="Uniform Resource Locator">URL</abbr>:
|
|
</p>
|
|
<div class="table sectionedit4"><table class="inline">
|
|
<thead>
|
|
<tr class="row0 roweven">
|
|
<th class="col0 centeralign"> Goal </th><th class="col1 centeralign"> Regular expression </th><th class="col2 centeralign"> Rule </th>
|
|
</tr>
|
|
</thead>
|
|
<tr class="row1 rowodd">
|
|
<td class="col0 leftalign"> Logout user from Lemonldap::NG and redirect it to http://intranet/ </td><td class="col1 centeralign"> ^/index.php\?logout </td><td class="col2 centeralign"> logout_sso http://intranet/ </td>
|
|
</tr>
|
|
<tr class="row2 roweven">
|
|
<td class="col0 leftalign"> Logout user from current application and redirect it to the menu </td><td class="col1 centeralign"> ^/index.php\?logout </td><td class="col2 centeralign"> logout_app https://auth.example.com/ </td>
|
|
</tr>
|
|
<tr class="row3 rowodd">
|
|
<td class="col0 leftalign"> Logout user from current application and from Lemonldap::NG and redirect it to http://intranet/ </td><td class="col1 centeralign"> ^/index.php\?logout </td><td class="col2 centeralign"> logout_app_sso http://intranet/ </td>
|
|
</tr>
|
|
</table></div>
|
|
<!-- EDIT4 TABLE [2007-2612] -->
|
|
<p>
|
|
<p><div class="notetip">By default, user will be redirected on portal if no <abbr title="Uniform Resource Locator">URL</abbr> defined, or on the specified <abbr title="Uniform Resource Locator">URL</abbr> if any.
|
|
</div></p>
|
|
</p>
|
|
|
|
<p>
|
|
<p><div class="noteimportant">Only current application is concerned by logout_app* targets. Be careful with some applications which doesn't verify Lemonldap::NG headers after having created their own cookies. If so, you can redirect users to a <abbr title="HyperText Markup Language">HTML</abbr> page that explain that it is safe to close browser after disconnect.
|
|
</div></p>
|
|
</p>
|
|
|
|
</div>
|
|
<!-- EDIT2 SECTION "Rules" [441-3040] -->
|
|
<h2 class="sectionedit5" id="headers">Headers</h2>
|
|
<div class="level2">
|
|
|
|
<p>
|
|
Headers are associations between an header name and a perl expression that returns a string. Headers are used to give user datas to the application.
|
|
</p>
|
|
|
|
<p>
|
|
Examples:
|
|
</p>
|
|
<div class="table sectionedit6"><table class="inline">
|
|
<thead>
|
|
<tr class="row0 roweven">
|
|
<th class="col0 centeralign"> Goal </th><th class="col1 centeralign"> Header name </th><th class="col2 centeralign"> Header value </th>
|
|
</tr>
|
|
</thead>
|
|
<tr class="row1 rowodd">
|
|
<td class="col0 leftalign"> Give the uid (for accounting) </td><td class="col1 centeralign"> Auth-User </td><td class="col2 centeralign"> $uid </td>
|
|
</tr>
|
|
<tr class="row2 roweven">
|
|
<td class="col0 leftalign"> Give a static value </td><td class="col1 centeralign"> Some-Thing </td><td class="col2 centeralign"> “static-value” </td>
|
|
</tr>
|
|
<tr class="row3 rowodd">
|
|
<td class="col0 leftalign"> Give display name </td><td class="col1 centeralign"> Display-Name </td><td class="col2 centeralign"> $givenName.“ ”.$surName </td>
|
|
</tr>
|
|
<tr class="row4 roweven">
|
|
<td class="col0 leftalign"> Give a non ascii data </td><td class="col1 centeralign"> Display-Name </td><td class="col2 centeralign"> encode_base64($givenName." ".$surName) </td>
|
|
</tr>
|
|
</table></div>
|
|
<!-- EDIT6 TABLE [3224-3557] -->
|
|
<p>
|
|
As described in <a href="../../documentation/1.9/performances.html#handler_performance" class="wikilink1" title="documentation:1.9:performances">performances chapter</a>, you can use macros, local macros,…
|
|
</p>
|
|
|
|
<p>
|
|
<p><div class="noteimportant">
|
|
</p>
|
|
<ul>
|
|
<li class="level1"><div class="li"> Since many HTTP servers refuse non ascii headers, it is recommended to use encode_base64() function to transmit those headers</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> Header names must contain only letters and “-” character</div>
|
|
</li>
|
|
</ul>
|
|
|
|
<p>
|
|
|
|
</div></p>
|
|
</p>
|
|
|
|
<p>
|
|
<p><div class="notetip">By default, <abbr title="Single Sign On">SSO</abbr> cookie is hidden, so protected applications cannot get <abbr title="Single Sign On">SSO</abbr> session key. But you can forward this key if it is really needed:
|
|
</p>
|
|
<pre class="code">Session-ID => $_session_id</pre>
|
|
|
|
<p>
|
|
|
|
</div></p>
|
|
</p>
|
|
|
|
</div>
|
|
</div><!-- closes <div class="dokuwiki export">--> |