dani/lemonldap-ng
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
5d35b3271f
lemonldap-ng/po-doc/fr/pages/documentation/current/browseablesessionbackend.html
Xavier Guimard bf74d0fdab Update doc
2017-04-13 17:00:28 +00:00

339 lines
20 KiB
HTML
Raw Blame History

<!DOCTYPE html>
<html lang="fr" dir="ltr">
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<meta charset="utf-8" />
<title>documentation:2.0:browseablesessionbackend</title><!-- //if:usedebianlibs
<link rel="stylesheet" type="text/css" href="/javascript/bootstrap/css/bootstrap.min.css" />
//elsif:useexternallibs
<link rel="stylesheet" type="text/css" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css"></script>
//elsif:cssminified
<link rel="stylesheet" type="text/css" href="/static/bwr/bootstrap/dist/css/bootstrap.min.css" />
//else --><!-- //endif -->
<meta name="generator" content="DokuWiki"/>
<meta name="robots" content="index,follow"/>
<meta name="keywords" content="documentation,2.0,browseablesessionbackend"/>
<link rel="search" type="application/opensearchdescription+xml" href="lib/exe/opensearch.html" title="LemonLDAP::NG"/>
<link rel="start" href="browseablesessionbackend.html"/>
<link rel="contents" href="browseablesessionbackend.html" title="Sitemap"/>
<link rel="stylesheet" type="text/css" href="lib/exe/css.php.t.bootstrap3.css"/>
<link rel="stylesheet" type="text/css" href="/static/bwr/bootstrap/dist/css/bootstrap.css" />
<script type="text/javascript">/*<![CDATA[*/var NS='documentation:2.0';var JSINFO = {"id":"documentation:2.0:browseablesessionbackend","namespace":"documentation:2.0"};
/*!]]>*/</script>
<script type="text/javascript" charset="utf-8" src="lib/exe/js.php.t.bootstrap3.js"></script><!-- //if:usedebianlibs
<script type="text/javascript" src="/javascript/jquery/jquery.min.js"></script>
//elsif:useexternallibs
<script type="text/javascript" src="http://code.jquery.com/jquery-2.2.0.min.js"></script>
//elsif:jsminified
<script type="text/javascript" src="/static/bwr/jquery/dist/jquery.min.js"></script>
//else -->
<script type="text/javascript" src="/static/bwr/jquery/dist/jquery.js"></script><!-- //endif --><!-- //if:usedebianlibs
<script type="text/javascript" src="/javascript/jquery-ui/jquery-ui.min.js"></script>
//elsif:useexternallibs
<script type="text/javascript" src="http://code.jquery.com/ui/1.10.4/jquery-ui.min.js"></script>
//elsif:jsminified
<script type="text/javascript" src="/lib/scripts/jquery-ui.min.js"></script>
//else -->
<script type="text/javascript" src="/lib/scripts/jquery-ui.js"></script><!-- //endif -->
</head>
<body>
<div class="dokuwiki export container"><!-- TOC START -->
<div id="dw__toc">
<h3 class="toggle">Table of Contents</h3>
<div>
<ul class="toc">
<li class="level1"><div class="li"><a href="#presentation">Présentation</a></div></li>
<li class="level1"><div class="li"><a href="#browseable_nosql">Browseable NoSQL</a></div></li>
<li class="level1"><div class="li"><a href="#browseable_sql">Browseable SQL</a></div>
<ul class="toc">
<li class="level2"><div class="li"><a href="#prepare_database">Préparer la base de données</a></div></li>
<li class="level2"><div class="li"><a href="#manager">Manager</a></div></li>
</ul>
</li>
<li class="level1"><div class="li"><a href="#browseable_ldap">Browseable LDAP</a></div></li>
<li class="level1"><div class="li"><a href="#security">Sécurité</a></div></li>
<li class="level1"><div class="li"><a href="#performances">Performances</a></div></li>
</ul>
</div>
</div><!-- TOC END -->
<h1 class="sectionedit1" id="browseable_session_backend">Backend de session explorable</h1>
<div class="level1">
</div><!-- EDIT1 SECTION "Browseable session backend" [1-42] -->
<h2 class="sectionedit2" id="presentation">Présentation</h2>
<div class="level2">
<p>
Le backend de session explorable (<a href="http://search.cpan.org/perldoc?Apache::Session::Browseable" class="urlextern" title="http://search.cpan.org/perldoc?Apache::Session::Browseable" rel="nofollow">Apache::Session::Browseable</a>) fonctionne exactement comme le module Apache::Session::* correspondant mais ajoute des index qui améliore les performances de l'<a href="documentation/features.html#session_explorer" class="wikilink1" title="documentation:features">explorateur de session</a> et les <a href="documentation/features.html#session_restrictions" class="wikilink1" title="documentation:features">restrictions de sessions</a>.
</p>
<p>
Lorsqu'on utilise des fonctionnalités telles <abbr title="Security Assertion Markup Language">SAML</abbr> (authentification ou fournisseur d'identité), <abbr title="Central Authentication Service">CAS</abbr> (fournisseur d'identité) ou le service de réinitialisation de mots-de-passe, il faut également indexer quelques champs.
</p>
<div class="noteclassic">Sans index, <abbr title="LemonLDAP::NG">LL::NG</abbr> doit récupérer toutes les sessions stockées dans le backend et les examiner pour trouver les sessions demandées. Avec index, <abbr title="LemonLDAP::NG">LL::NG</abbr> ne récupère que les sessions demandées.
</div>
<p>
Le tableau suivant liste les champs à indexer suivant les fonctionnalités dont on souhaite améliorer les performances :
</p>
<div class="table sectionedit3"><table class="inline table table-bordered table-striped">
<thead>
<tr class="row0 roweven">
<th class="col0 centeralign"> Fonctionnalité </th><th class="col1 centeralign"> Champs à indexer </th>
</tr>
</thead>
<tr class="row1 rowodd">
<td class="col0"> Database cleaup <em>(cron)</em> </td><td class="col1 centeralign"> _session_kind _utime </td>
</tr>
<tr class="row2 roweven">
<td class="col0"> Explorateur de sessions </td><td class="col1 centeralign"> _session_kind ipAddr <em>WHATTOTRACE</em> </td>
</tr>
<tr class="row3 rowodd">
<td class="col0"> Session explorer (persistent sessions) </td><td class="col1 centeralign"> _session_kind _session_uid </td>
</tr>
<tr class="row4 roweven">
<td class="col0"> Resctriction d'ouverture de session </td><td class="col1 centeralign"> _session_kind ipAddr <em>WHATTOTRACE</em> </td>
</tr>
</table></div><!-- EDIT3 TABLE [877-1168] -->
<p>
See Apache::Session::Browseable::* man page to see how use indexes.
</p>
<div class="noteimportant"><em>WHATTOTRACE</em> must be replaced by the attribute or macro configured in the What To Trace parameter (REMOTE_USER). By default: <strong>_whatToTrace</strong>
</div><div class="notetip">Il est préférable d'utiliser des bases de sessions séparées pour les sessions standard, <abbr title="Security Assertion Markup Language">SAML</abbr> et <abbr title="Central Authentication Service">CAS</abbr> afin de gérer séparemment les index.
</div><div class="noteclassic">La documentation ci-dessous explique comment fixer les index à ipAddr et _whatToTrace. À adapter pour configurer les index voulus.
</div>
</div><!-- EDIT2 SECTION "Presentation" [43-1691] -->
<h2 class="sectionedit4" id="browseable_nosql">Browseable NoSQL</h2>
<div class="level2">
<p>
Il est possible d'utiliser Redis comme expliqué dans <a href="nosqlsessionbackend.html" class="wikilink1" title="documentation:2.0:nosqlsessionbackend">Backend de sessions Redis</a>.
</p>
<p>
Il suffira juste d'ajouter le paramètre <code>Index</code> dans <code>Paramètres généraux</code> » <code>Sessions</code> » <code>Stockage des sessions</code> » <code>Module Apache::Session</code> :
</p>
<div class="table sectionedit5"><table class="inline table table-bordered table-striped">
<thead>
<tr class="row0 roweven">
<th class="col0 centeralign" colspan="3"> Paramètres exigés </th>
</tr>
<tr class="row1 rowodd">
<th class="col0 centeralign"> Nom </th><th class="col1 centeralign"> Commentaire </th><th class="col2 centeralign"> Exemple </th>
</tr>
</thead>
<tr class="row2 roweven">
<td class="col0 centeralign"> <strong>server</strong> </td><td class="col1"> Serveur Redis </td><td class="col2"> 127.0.0.1:6379 </td>
</tr>
<tr class="row3 rowodd">
<td class="col0 centeralign"> <strong>Index</strong> </td><td class="col1"> Index </td><td class="col2"> _whatToTrace ipAddr </td>
</tr>
</table></div><!-- EDIT5 TABLE [1979-2136] -->
</div><!-- EDIT4 SECTION "Browseable NoSQL" [1692-2137] -->
<h2 class="sectionedit6" id="browseable_sql">Browseable SQL</h2>
<div class="level2">
<div class="noteclassic">This documentation concerns PostgreSQL. Quelques adaptations sont nécessaires pour les autres bases de données.
</div>
</div><!-- EDIT6 SECTION "Browseable SQL" [2138-2269] -->
<h3 class="sectionedit7" id="prepare_database">Préparer la base de données</h3>
<div class="level3">
<p>
La base de donnée doit être préparée exactement comme celle du <a href="sqlsessionbackend.html#prepare_the_database" class="wikilink1" title="documentation:2.0:sqlsessionbackend">backend de session SQL</a> si ce n'est qu'un champ doit être ajouté pour chaque donnée à indexer.
</p>
<pre class="code file sql"> Apache::<span class="kw1">SESSION</span>::Browseable::Postgres example:
<span class="sy0">&lt;</span>code sql<span class="sy0">&gt;</span>
<span class="kw1">CREATE</span> UNLOGGED <span class="kw1">TABLE</span> sessions <span class="br0">(</span>
id <span class="kw1">VARCHAR</span><span class="br0">(</span><span class="nu0">64</span><span class="br0">)</span> <span class="kw1">NOT</span> <span class="kw1">NULL</span> <span class="kw1">PRIMARY</span> <span class="kw1">KEY</span><span class="sy0">,</span>
a_session text<span class="sy0">,</span>
_whatToTrace text<span class="sy0">,</span>
_session_kind text<span class="sy0">,</span>
_utime <span class="kw1">BIGINT</span><span class="sy0">,</span>
ipAddr text
<span class="br0">)</span>;
<span class="kw1">CREATE</span> <span class="kw1">INDEX</span> uid1 <span class="kw1">ON</span> sessions <span class="kw1">USING</span> BTREE <span class="br0">(</span>_whatToTrace<span class="br0">)</span>;
<span class="kw1">CREATE</span> <span class="kw1">INDEX</span> s1 <span class="kw1">ON</span> sessions <span class="br0">(</span>_session_kind<span class="br0">)</span>;
<span class="kw1">CREATE</span> <span class="kw1">INDEX</span> u1 <span class="kw1">ON</span> sessions <span class="br0">(</span>_utime<span class="br0">)</span>;
<span class="kw1">CREATE</span> <span class="kw1">INDEX</span> ip1 <span class="kw1">ON</span> sessions <span class="kw1">USING</span> BTREE <span class="br0">(</span>ipAddr<span class="br0">)</span>;</pre>
<div class="noteimportant">For Session Explorer and one-off sessions, it is recommended to use BTREE or any index method that indexes partial content.
</div>
<p>
“id” fieds is set to <code>varchar(64)</code> (instead of char(32)) to use the now recommended SHA256 hash algorithm. See <a href="documentation/latest/sessions.html" class="wikilink1" title="documentation:latest:sessions">Sessions</a> for more details.
</p>
<div class="notetip">With new Apache::Session::Browseable::<strong>PgHstore</strong> and <strong>PgJSON</strong>, you don't need to declare indexes in <code>CREATE TABLE</code> since “json” and “hstore” type are browseable. You should anyway add some indexes <em>(see manpage)</em>.
</div>
</div><!-- EDIT7 SECTION "Prepare database" [2270-3479] -->
<h3 class="sectionedit8" id="manager">Manager</h3>
<div class="level3">
<p>
Aller dans le manager et mettre le module de session (<a href="http://search.cpan.org/perldoc?Apache::Session::Browseable::MySQL" class="urlextern" title="http://search.cpan.org/perldoc?Apache::Session::Browseable::MySQL" rel="nofollow">Apache::Session::Browseable::MySQL</a> pour MySQL) dans <code>Paramètres généraux</code> » <code>Sessions</code> » <code>Stockage des sessions</code> » <code>Module Apache::Session</code> et ajouter le paramètre suivant (sensible à la casse) :
</p>
<div class="table sectionedit9"><table class="inline table table-bordered table-striped">
<thead>
<tr class="row0 roweven">
<th class="col0 centeralign" colspan="3"> Paramètres exigés </th>
</tr>
<tr class="row1 rowodd">
<th class="col0 centeralign"> Nom </th><th class="col1 centeralign"> Commentaire </th><th class="col2 centeralign"> Exemple </th>
</tr>
</thead>
<tr class="row2 roweven">
<td class="col0 centeralign"> <strong>DataSource</strong> </td><td class="col1"> La chaîne <a href="http://search.cpan.org/perldoc?DBI" class="urlextern" title="http://search.cpan.org/perldoc?DBI" rel="nofollow">DBI</a> </td><td class="col2"> dbi:Pg:database=sessions </td>
</tr>
<tr class="row3 rowodd">
<td class="col0 centeralign"> <strong>UserName</strong> </td><td class="col1"> Le login de la base de données </td><td class="col2"> lemonldapng </td>
</tr>
<tr class="row4 roweven">
<td class="col0 centeralign"> <strong>Mot-de-passe</strong> </td><td class="col1"> Le mot de passe de la base de données </td><td class="col2"> mysuperpassword </td>
</tr>
<tr class="row5 rowodd">
<td class="col0 centeralign"> <strong>Index</strong> </td><td class="col1"> Index </td><td class="col2"> _whatToTrace ipAddr _session_kind _utime </td>
</tr>
</table></div><!-- EDIT9 TABLE [3808-4159] -->
<div class="notetip">Apache::Session::Browseable::MySQL n'utilise pas les locks pour conserver les performances.
<p>
Pour les bases de données telles PostgreSQL, ne pas oublier d'ajouter “Commit” avec une valeur de 1
</p>
</div>
</div><!-- EDIT8 SECTION "Manager" [3480-4338] -->
<h2 class="sectionedit10" id="browseable_ldap">Browseable LDAP</h2>
<div class="level2">
<p>
Aller dans le manager et mettre le module de session à <code>Apache::Session::Browseable::LDAP</code> Configurer ensuite les options comme dans le <a href="ldapsessionbackend.html" class="wikilink1" title="documentation:2.0:ldapsessionbackend">backend de sessions LDAP</a>.
</p>
<p>
Il faut ajouter le champ <code>Index</code>, on peut aussi configurer le champ <code>ldapAttributeIndex</code> pour indiquer le nom d'attribut dans lequel les index doivent être stockés.
</p>
<div class="table sectionedit11"><table class="inline table table-bordered table-striped">
<thead>
<tr class="row0 roweven">
<th class="col0 centeralign" colspan="3"> Paramètres exigés </th>
</tr>
<tr class="row1 rowodd">
<th class="col0 centeralign"> Nom </th><th class="col1 centeralign"> Commentaire </th><th class="col2 centeralign"> Exemple </th>
</tr>
</thead>
<tr class="row2 roweven">
<td class="col0 centeralign"> <strong>ldapServer</strong> </td><td class="col1"> <abbr title="Uniform Resource Identifier">URI</abbr> du serveur </td><td class="col2"> ldap://localhost </td>
</tr>
<tr class="row3 rowodd">
<td class="col0 centeralign"> <strong>ldapConfBase</strong> </td><td class="col1"> <abbr title="Distinguished Name">DN</abbr> de la branche des sessions </td><td class="col2"> ou=sessions,dc=example,dc=com </td>
</tr>
<tr class="row4 roweven">
<td class="col0 centeralign"> <strong>ldapBindDN</strong> </td><td class="col1"> Login de connexion </td><td class="col2"> cn=admin,dc=example,dc=password </td>
</tr>
<tr class="row5 rowodd">
<td class="col0 centeralign"> <strong>ldapBindPassword</strong> </td><td class="col1"> Mot-de-passe de connexion </td><td class="col2"> secret </td>
</tr>
<tr class="row6 roweven">
<td class="col0 centeralign"> <strong>Index</strong> </td><td class="col1"> Liste d'index </td><td class="col2"> _whatToTrace ipAddr </td>
</tr>
<tr class="row7 rowodd">
<th class="col0 centeralign" colspan="3"> Paramètres optionnels </th>
</tr>
<tr class="row8 roweven">
<th class="col0 centeralign"> Nom </th><th class="col1 centeralign"> Commentaire </th><th class="col2 centeralign"> Valeur par défaut </th>
</tr>
<tr class="row9 rowodd">
<td class="col0 centeralign"> <strong>ldapObjectClass</strong> </td><td class="col1"> Objectclass de l'entrée </td><td class="col2"> applicationProcess </td>
</tr>
<tr class="row10 roweven">
<td class="col0 centeralign"> <strong>ldapAttributeId</strong> </td><td class="col1"> Attribut où stocker l'idetifiant de session </td><td class="col2"> cn </td>
</tr>
<tr class="row11 rowodd">
<td class="col0 centeralign"> <strong>ldapAttributeContent</strong> </td><td class="col1"> Attribut où stocker le contenu de la session </td><td class="col2"> description </td>
</tr>
<tr class="row12 roweven">
<td class="col0 centeralign"> <strong>ldapAttributeIndex</strong> </td><td class="col1"> Attribut où stocker les index </td><td class="col2"> ou </td>
</tr>
</table></div><!-- EDIT11 TABLE [4690-5424] -->
</div><!-- EDIT10 SECTION "Browseable LDAP" [4339-5425] -->
<h2 class="sectionedit12" id="security">Sécurité</h2>
<div class="level2">
<p>
Restreindre l'accès réseau au backend.
</p>
<p>
On peut utiliser différent login/mot-de-passe pour les serveurs en surchargeant les paramètres <code>globalStorage</code> et <code>globalStorageOptions</code> dans le fichier lemonldap-ng.ini.
</p>
</div><!-- EDIT12 SECTION "Security" [5426-5645] -->
<h2 class="sectionedit13" id="performances">Performances</h2>
<div class="level2">
<p>
Here are some recommended configurations:
</p>
<p>
<strong>Browseable::Postgres</strong>:
</p>
<pre class="code sql"><span class="kw1">CREATE</span> UNLOGGED <span class="kw1">TABLE</span> sessions <span class="br0">(</span>
id <span class="kw1">VARCHAR</span><span class="br0">(</span><span class="nu0">64</span><span class="br0">)</span> <span class="kw1">NOT</span> <span class="kw1">NULL</span> <span class="kw1">PRIMARY</span> <span class="kw1">KEY</span><span class="sy0">,</span>
a_session text<span class="sy0">,</span>
_whatToTrace text<span class="sy0">,</span>
_session_kind text<span class="sy0">,</span>
_utime <span class="kw1">BIGINT</span><span class="sy0">,</span>
ipAddr <span class="kw1">VARCHAR</span><span class="br0">(</span><span class="nu0">64</span><span class="br0">)</span>
<span class="br0">)</span>;
<span class="kw1">CREATE</span> <span class="kw1">INDEX</span> uid1 <span class="kw1">ON</span> sessions <span class="kw1">USING</span> BTREE <span class="br0">(</span>_whatToTrace text_pattern_ops<span class="br0">)</span>;
<span class="kw1">CREATE</span> <span class="kw1">INDEX</span> _s1 <span class="kw1">ON</span> sessions <span class="br0">(</span>_session_kind<span class="br0">)</span>;
<span class="kw1">CREATE</span> <span class="kw1">INDEX</span> _u1 <span class="kw1">ON</span> sessions <span class="br0">(</span>_utime<span class="br0">)</span>;
<span class="kw1">CREATE</span> <span class="kw1">INDEX</span> ip1 <span class="kw1">ON</span> sessions <span class="kw1">USING</span> BTREE <span class="br0">(</span>ipAddr<span class="br0">)</span></pre>
<p>
<strong>Browseable::MySQL</strong>:
</p>
<pre class="code sql"><span class="kw1">CREATE</span> <span class="kw1">TABLE</span> sessions <span class="br0">(</span>
id <span class="kw1">VARCHAR</span><span class="br0">(</span><span class="nu0">64</span><span class="br0">)</span> <span class="kw1">NOT</span> <span class="kw1">NULL</span> <span class="kw1">PRIMARY</span> <span class="kw1">KEY</span><span class="sy0">,</span>
a_session text<span class="sy0">,</span>
_whatToTrace <span class="kw1">VARCHAR</span><span class="br0">(</span><span class="nu0">64</span><span class="br0">)</span><span class="sy0">,</span>
_session_kind <span class="kw1">VARCHAR</span><span class="br0">(</span><span class="nu0">15</span><span class="br0">)</span><span class="sy0">,</span>
_utime <span class="kw1">BIGINT</span>
<span class="br0">)</span>;
<span class="kw1">CREATE</span> <span class="kw1">INDEX</span> uid1 <span class="kw1">ON</span> sessions <span class="br0">(</span>_whatToTrace<span class="br0">)</span> <span class="kw1">USING</span> BTREE;
<span class="kw1">CREATE</span> <span class="kw1">INDEX</span> _s1 <span class="kw1">ON</span> sessions <span class="br0">(</span>_session_kind<span class="br0">)</span>;
<span class="kw1">CREATE</span> <span class="kw1">INDEX</span> _u1 <span class="kw1">ON</span> sessions <span class="br0">(</span>_utime<span class="br0">)</span>;
<span class="kw1">CREATE</span> <span class="kw1">INDEX</span> ip1 <span class="kw1">ON</span> sessions <span class="br0">(</span>ipAddr<span class="br0">)</span> <span class="kw1">USING</span> BTREE;</pre>
</div><!-- EDIT13 SECTION "Performances" [5646-] -->
</div>
</body>
</html>
Reference in New Issue View Git Blame Copy Permalink