159 lines
7.3 KiB
HTML
159 lines
7.3 KiB
HTML
|
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
|
|
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
|
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
|
|
lang="en" dir="ltr">
|
|
|
|
<head>
|
|
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
|
|
<title></title>
|
|
<!-- metadata -->
|
|
<meta name="generator" content="Offline" />
|
|
<meta name="version" content="Offline 0.1" />
|
|
<!-- style sheet links -->
|
|
<link rel="stylesheet" media="all" type="text/css" href="../../../css/all.css" />
|
|
<link rel="stylesheet" media="screen" type="text/css" href="../../../css/screen.css" />
|
|
<link rel="stylesheet" media="print" type="text/css" href="../../../css/print.css" />
|
|
|
|
</head>
|
|
<body>
|
|
<div class="dokuwiki export">
|
|
|
|
|
|
|
|
|
|
<h1><a name="form_replay" id="form_replay">Form replay</a></h1>
|
|
<div class="level1">
|
|
|
|
</div>
|
|
<!-- SECTION "Form replay" [1-27] -->
|
|
<h2><a name="presentation" id="presentation">Presentation</a></h2>
|
|
<div class="level2">
|
|
|
|
<p>
|
|
|
|
Form replay allows you to open a session on a protected application by filling a <acronym title="HyperText Markup Language">HTML</acronym> POST login form and autosubmitting it, without asking anything to the user.
|
|
</p>
|
|
|
|
<p>
|
|
<p><div class="notewarning">
|
|
This kind of <acronym title="Single Sign On">SSO</acronym> mechanism is not clean, and can lead to problems, like local password blocking, local session not well closed, etc.
|
|
</p>
|
|
|
|
<p>
|
|
Please always try to find another solution to protect your application with <acronym title="LemonLDAP::NG">LL::NG</acronym>. At least, check if it is not a <a href="../../documentation/1.4/applications.html" class="wikilink1" title="documentation:1.4:applications">known application</a>, or <a href="../../documentation/1.4/selfmadeapplication.html" class="wikilink1" title="documentation:1.4:selfmadeapplication">try to adapt its source code</a>.
|
|
|
|
</div></p>
|
|
</p>
|
|
|
|
<p>
|
|
If you configure form replay with <acronym title="LemonLDAP::NG">LL::NG</acronym>, the Handler will detect forms to fill, add a javascript in the html page to fill form fields with dummy datas and submit it, then intercept the POST request and add POST data in the request body.
|
|
</p>
|
|
|
|
<p>
|
|
POST data can be static values or computed from user's session.
|
|
</p>
|
|
|
|
<p>
|
|
<p><div class="notetip">
|
|
To post user's password, you must enable <a href="../../documentation/1.4/passwordstore.html" class="wikilink1" title="documentation:1.4:passwordstore">password storing</a>. In this case you will be able to use <code>$_password</code> to fill any password POST field.
|
|
</div></p>
|
|
</p>
|
|
|
|
</div>
|
|
<!-- SECTION "Presentation" [28-1068] -->
|
|
<h2><a name="configuration" id="configuration">Configuration</a></h2>
|
|
<div class="level2">
|
|
|
|
<p>
|
|
|
|
You should grab some informations:
|
|
</p>
|
|
<ul>
|
|
<li class="level1"><div class="li"> <acronym title="Uniform Resource Identifier">URI</acronym> of the html page which contains the form</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> <acronym title="Uniform Resource Identifier">URI</acronym> the html form is sent to</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> Does the html page load jQuery ? If not, grab a jQuery <acronym title="Uniform Resource Locator">URL</acronym> reachable by user (any version over jQuery 1.0 is suitable)</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> are there several html forms in the page ? If so, get a jQuery selector for the form you want to post</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> is user required to click on a button, for example in order to perform some script ? If so, get a jQuery selector for that button</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> names and values of the fields you want to control</div>
|
|
</li>
|
|
</ul>
|
|
|
|
<p>
|
|
If you don't know jQuery selector, just be aware that they are similar to css selectors: for example, button#foo points to the html button whose id is “foo”, and .bar points to all html elements of css class “bar”.
|
|
</p>
|
|
|
|
<p>
|
|
For example:
|
|
</p>
|
|
<ul>
|
|
<li class="level1"><div class="li"> Form page <acronym title="Uniform Resource Identifier">URI</acronym>: /login.php</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> Target <acronym title="Uniform Resource Identifier">URI</acronym>: /process.php (if you let this parameter empty, target <acronym title="Uniform Resource Identifier">URI</acronym> is supposed to be the same as form page <acronym title="Uniform Resource Identifier">URI</acronym>)</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> jQuery <acronym title="Uniform Resource Locator">URL</acronym>: http://ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js (if you let this parameter empty, jQuery is supposed to be already loaded; you can also set “default” to point to jQuery <acronym title="Uniform Resource Locator">URL</acronym> of <acronym title="LemonLDAP::NG">LL::NG</acronym> portal)</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> jQuery form selector: #loginForm (if you let this parameter empty, browser will fill and submit any html form)</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> jQuery button selector: button.validate (if you let this parameter empty, the form will be submitted but no button will be clicked; if you set it to “none”, no button will be clicked and the form will be filled but not submitted)</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> Fields:</div>
|
|
<ul>
|
|
<li class="level2"><div class="li"> login: $uid (uid of the user)</div>
|
|
</li>
|
|
<li class="level2"><div class="li"> password: $_password (password of the user)</div>
|
|
</li>
|
|
<li class="level2"><div class="li"> static: 'StaticValue' (a static value)</div>
|
|
</li>
|
|
<li class="level2"><div class="li"> remember: '1' (checked box)</div>
|
|
</li>
|
|
</ul>
|
|
</li>
|
|
</ul>
|
|
|
|
<p>
|
|
|
|
Then go in Manager, “Virtual Hosts” » <em>virtualhost</em> » “Form replay” and click on “New form”.
|
|
</p>
|
|
|
|
<p>
|
|
<a href="/_detail/documentation/manager-formreplay-newurl.png?id=documentation%3A1.4%3Aformreplay" class="media" title="documentation:manager-formreplay-newurl.png"><img src="../../../media/documentation/manager-formreplay-newurl.png" class="mediacenter" alt="" /></a>
|
|
</p>
|
|
|
|
<p>
|
|
Fill values here:
|
|
</p>
|
|
<ul>
|
|
<li class="level1"><div class="li"> <strong>Form <acronym title="Uniform Resource Locator">URL</acronym></strong>: /login.php</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> <strong>Target <acronym title="Uniform Resource Locator">URL</acronym></strong>: /process.php</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> <strong>jQuery <acronym title="Uniform Resource Locator">URL</acronym></strong>: http://ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> <strong>jQuery form selector</strong>: #loginForm</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> <strong>jQuery button selector</strong>: button.validate</div>
|
|
</li>
|
|
</ul>
|
|
|
|
<p>
|
|
|
|
Then click on <code>New POST data</code> and add all data with their values, for example:
|
|
</p>
|
|
|
|
<p>
|
|
<a href="/_detail/documentation/manager-formreplay-newdata.png?id=documentation%3A1.4%3Aformreplay" class="media" title="documentation:manager-formreplay-newdata.png"><img src="../../../media/documentation/manager-formreplay-newdata.png" class="mediacenter" alt="" /></a>
|
|
</p>
|
|
|
|
<p>
|
|
<p><div class="notetip">You can define more than one form replay <acronym title="Uniform Resource Locator">URL</acronym> per virtual host.
|
|
</div></p>
|
|
</p>
|
|
|
|
</div>
|
|
<!-- SECTION "Configuration" [1069-] --></div><!-- closes <div class="dokuwiki export">--> |