137 lines
6.8 KiB
HTML
137 lines
6.8 KiB
HTML
<!DOCTYPE html>
|
|
<html lang="en" dir="ltr">
|
|
<head>
|
|
<meta charset="utf-8" />
|
|
<title>documentation:2.0:formreplay</title>
|
|
<meta name="generator" content="DokuWiki"/>
|
|
<meta name="robots" content="index,follow"/>
|
|
<meta name="keywords" content="documentation,2.0,formreplay"/>
|
|
<link rel="search" type="application/opensearchdescription+xml" href="lib/exe/opensearch.html" title="LemonLDAP::NG"/>
|
|
<link rel="start" href="formreplay.html"/>
|
|
<link rel="contents" href="formreplay.html" title="Sitemap"/>
|
|
<link rel="stylesheet" type="text/css" href="lib/exe/css.php.t.bootstrap3.css"/>
|
|
<link rel="stylesheet" type="text/css" href="/static/bwr/bootstrap/dist/css/bootstrap.min.css"/>
|
|
<script type="text/javascript">/*<![CDATA[*/var NS='documentation:2.0';var JSINFO = {"id":"documentation:2.0:formreplay","namespace":"documentation:2.0"};
|
|
/*!]]>*/</script>
|
|
<script type="text/javascript" charset="utf-8" src="lib/exe/js.php.t.bootstrap3.js"></script>
|
|
</head>
|
|
<body>
|
|
<div class="dokuwiki export container">
|
|
|
|
<h1 class="sectionedit1" id="form_replay">Form replay</h1>
|
|
<div class="level1">
|
|
|
|
</div>
|
|
<!-- EDIT1 SECTION "Form replay" [1-27] -->
|
|
<h2 class="sectionedit2" id="presentation">Presentation</h2>
|
|
<div class="level2">
|
|
|
|
<p>
|
|
Form replay allows you to open a session on a protected application by filling a <abbr title="HyperText Markup Language">HTML</abbr> POST login form and autosubmitting it, without asking anything to the user.
|
|
</p>
|
|
<div class="notewarning">This kind of <abbr title="Single Sign On">SSO</abbr> mechanism is not clean, and can lead to problems, like local password blocking, local session not well closed, etc.
|
|
<p>
|
|
Please always try to find another solution to protect your application with <abbr title="LemonLDAP::NG">LL::NG</abbr>. At least, check if it is not a <a href="applications.html" class="wikilink1" title="documentation:2.0:applications">known application</a>, or <a href="selfmadeapplication.html" class="wikilink1" title="documentation:2.0:selfmadeapplication">try to adapt its source code</a>.
|
|
</p>
|
|
|
|
</div>
|
|
<p>
|
|
If you configure form replay with <abbr title="LemonLDAP::NG">LL::NG</abbr>, the Handler will detect forms to fill, add a javascript in the html page to fill form fields with dummy datas and submit it, then intercept the POST request and add POST data in the request body.
|
|
</p>
|
|
|
|
<p>
|
|
POST data can be static values or computed from user's session.
|
|
</p>
|
|
<div class="notetip">To post user's password, you must enable <a href="passwordstore.html" class="wikilink1" title="documentation:2.0:passwordstore">password storing</a>. In this case you will be able to use <code>$_password</code> to fill any password POST field.
|
|
</div>
|
|
</div>
|
|
<!-- EDIT2 SECTION "Presentation" [28-1068] -->
|
|
<h2 class="sectionedit3" id="configuration">Configuration</h2>
|
|
<div class="level2">
|
|
|
|
<p>
|
|
You should grab some information:
|
|
</p>
|
|
<ul>
|
|
<li class="level1"><div class="li"> <abbr title="Uniform Resource Identifier">URI</abbr> of the html page which contains the form</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> <abbr title="Uniform Resource Identifier">URI</abbr> the html form is sent to</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> Does the html page load jQuery ? If not, grab a jQuery <abbr title="Uniform Resource Locator">URL</abbr> reachable by user (any version over jQuery 1.0 is suitable)</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> are there several html forms in the page ? If so, get a jQuery selector for the form you want to post</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> is user required to click on a button, for example in order to perform some script ? If so, get a jQuery selector for that button</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> names and values of the fields you want to control</div>
|
|
</li>
|
|
</ul>
|
|
|
|
<p>
|
|
If you don't know jQuery selector, just be aware that they are similar to css selectors: for example, button#foo points to the html button whose id is “foo”, and .bar points to all html elements of css class “bar”.
|
|
</p>
|
|
|
|
<p>
|
|
For example:
|
|
</p>
|
|
<ul>
|
|
<li class="level1"><div class="li"> Form page <abbr title="Uniform Resource Identifier">URI</abbr>: /login.php</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> Target <abbr title="Uniform Resource Identifier">URI</abbr>: /process.php (if you let this parameter empty, target <abbr title="Uniform Resource Identifier">URI</abbr> is supposed to be the same as form page <abbr title="Uniform Resource Identifier">URI</abbr>)</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> jQuery <abbr title="Uniform Resource Locator">URL</abbr>: http://ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js (if you let this parameter empty, jQuery is supposed to be already loaded; you can also set <code>default</code> to point to jQuery <abbr title="Uniform Resource Locator">URL</abbr> of <abbr title="LemonLDAP::NG">LL::NG</abbr> portal)</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> jQuery form selector: #loginForm (if you let this parameter empty, browser will fill and submit any html form)</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> jQuery button selector: button.validate (if you let this parameter empty, the form will be submitted but no button will be clicked; if you set it to “none”, no button will be clicked and the form will be filled but not submitted)</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> Fields:</div>
|
|
<ul>
|
|
<li class="level2"><div class="li"> postuid: $uid</div>
|
|
</li>
|
|
<li class="level2"><div class="li"> postmail: $mail</div>
|
|
</li>
|
|
<li class="level2"><div class="li"> poststatic: 'static'</div>
|
|
</li>
|
|
</ul>
|
|
</li>
|
|
</ul>
|
|
|
|
<p>
|
|
Go in Manager, “Virtual Hosts” » <em>virtualhost</em> » “Form replay” and click on “New form replay”.
|
|
</p>
|
|
|
|
<p>
|
|
<img src="documentation/manager-form-replay.png" class="mediacenter" alt="" />
|
|
</p>
|
|
|
|
<p>
|
|
Fill values here:
|
|
</p>
|
|
<ul>
|
|
<li class="level1"><div class="li"> <strong>Form <abbr title="Uniform Resource Locator">URL</abbr></strong>: /login.php</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> <strong>Target <abbr title="Uniform Resource Locator">URL</abbr></strong>: /process.php</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> <strong>jQuery <abbr title="Uniform Resource Locator">URL</abbr></strong>: http://ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> <strong>jQuery form selector</strong>: #loginForm</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> <strong>jQuery button selector</strong>: button.validate</div>
|
|
</li>
|
|
</ul>
|
|
|
|
<p>
|
|
Then click on <code>New variable</code> and add all data with their values, for example:
|
|
</p>
|
|
|
|
<p>
|
|
<img src="documentation/manager-form-replay-vars.png" class="mediacenter" alt="" />
|
|
</p>
|
|
<div class="notetip">You can define more than one form replay <abbr title="Uniform Resource Locator">URL</abbr> per virtual host.
|
|
</div>
|
|
</div>
|
|
<!-- EDIT3 SECTION "Configuration" [1069-] --></div>
|
|
</body>
|
|
</html>
|