151 lines
6.6 KiB
HTML
151 lines
6.6 KiB
HTML
|
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
|
|
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
|
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
|
|
lang="en" dir="ltr">
|
|
|
|
<head>
|
|
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
|
|
<title></title>
|
|
<!-- metadata -->
|
|
<meta name="generator" content="Offline" />
|
|
<meta name="version" content="Offline 0.1" />
|
|
<!-- style sheet links -->
|
|
<link rel="stylesheet" media="all" type="text/css" href="../../../css/all.css" />
|
|
<link rel="stylesheet" media="screen" type="text/css" href="../../../css/screen.css" />
|
|
<link rel="stylesheet" media="print" type="text/css" href="../../../css/print.css" />
|
|
|
|
</head>
|
|
<body>
|
|
<div class="dokuwiki export">
|
|
|
|
|
|
<h1 class="sectionedit1" id="form_replay">Form replay</h1>
|
|
<div class="level1">
|
|
|
|
</div>
|
|
<!-- EDIT1 SECTION "Form replay" [1-27] -->
|
|
<h2 class="sectionedit2" id="presentation">Presentation</h2>
|
|
<div class="level2">
|
|
|
|
<p>
|
|
Form replay allows you to open a session on a protected application by filling a <abbr title="HyperText Markup Language">HTML</abbr> POST login form and autosubmitting it, without asking anything to the user.
|
|
</p>
|
|
|
|
<p>
|
|
<p><div class="notewarning">
|
|
This kind of <abbr title="Single Sign On">SSO</abbr> mechanism is not clean, and can lead to problems, like local password blocking, local session not well closed, etc.
|
|
</p>
|
|
|
|
<p>
|
|
Please always try to find another solution to protect your application with <abbr title="LemonLDAP::NG">LL::NG</abbr>. At least, check if it is not a <a href="../../documentation/2.0/applications.html" class="wikilink1" title="documentation:2.0:applications">known application</a>, or <a href="../../documentation/2.0/selfmadeapplication.html" class="wikilink1" title="documentation:2.0:selfmadeapplication">try to adapt its source code</a>.
|
|
|
|
</div></p>
|
|
</p>
|
|
|
|
<p>
|
|
If you configure form replay with <abbr title="LemonLDAP::NG">LL::NG</abbr>, the Handler will detect forms to fill, add a javascript in the html page to fill form fields with dummy datas and submit it, then intercept the POST request and add POST data in the request body.
|
|
</p>
|
|
|
|
<p>
|
|
POST data can be static values or computed from user's session.
|
|
</p>
|
|
|
|
<p>
|
|
<p><div class="notetip">
|
|
To post user's password, you must enable <a href="../../documentation/2.0/passwordstore.html" class="wikilink1" title="documentation:2.0:passwordstore">password storing</a>. In this case you will be able to use <code>$_password</code> to fill any password POST field.
|
|
</div></p>
|
|
</p>
|
|
|
|
</div>
|
|
<!-- EDIT2 SECTION "Presentation" [28-1068] -->
|
|
<h2 class="sectionedit3" id="configuration">Configuration</h2>
|
|
<div class="level2">
|
|
|
|
<p>
|
|
You should grab some informations:
|
|
</p>
|
|
<ul>
|
|
<li class="level1"><div class="li"> <abbr title="Uniform Resource Identifier">URI</abbr> of the html page which contains the form</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> <abbr title="Uniform Resource Identifier">URI</abbr> the html form is sent to</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> Does the html page load jQuery ? If not, grab a jQuery <abbr title="Uniform Resource Locator">URL</abbr> reachable by user (any version over jQuery 1.0 is suitable)</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> are there several html forms in the page ? If so, get a jQuery selector for the form you want to post</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> is user required to click on a button, for example in order to perform some script ? If so, get a jQuery selector for that button</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> names and values of the fields you want to control</div>
|
|
</li>
|
|
</ul>
|
|
|
|
<p>
|
|
If you don't know jQuery selector, just be aware that they are similar to css selectors: for example, button#foo points to the html button whose id is “foo”, and .bar points to all html elements of css class “bar”.
|
|
</p>
|
|
|
|
<p>
|
|
For example:
|
|
</p>
|
|
<ul>
|
|
<li class="level1"><div class="li"> Form page <abbr title="Uniform Resource Identifier">URI</abbr>: /login.php</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> Target <abbr title="Uniform Resource Identifier">URI</abbr>: /process.php (if you let this parameter empty, target <abbr title="Uniform Resource Identifier">URI</abbr> is supposed to be the same as form page <abbr title="Uniform Resource Identifier">URI</abbr>)</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> jQuery <abbr title="Uniform Resource Locator">URL</abbr>: http://ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js (if you let this parameter empty, jQuery is supposed to be already loaded; you can also set <code>default</code> to point to jQuery <abbr title="Uniform Resource Locator">URL</abbr> of <abbr title="LemonLDAP::NG">LL::NG</abbr> portal)</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> jQuery form selector: #loginForm (if you let this parameter empty, browser will fill and submit any html form)</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> jQuery button selector: button.validate (if you let this parameter empty, the form will be submitted but no button will be clicked; if you set it to “none”, no button will be clicked and the form will be filled but not submitted)</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> Fields:</div>
|
|
<ul>
|
|
<li class="level2"><div class="li"> postuid: $uid</div>
|
|
</li>
|
|
<li class="level2"><div class="li"> postmail: $mail</div>
|
|
</li>
|
|
<li class="level2"><div class="li"> poststatic: 'static'</div>
|
|
</li>
|
|
</ul>
|
|
</li>
|
|
</ul>
|
|
|
|
<p>
|
|
Go in Manager, “Virtual Hosts” » <em>virtualhost</em> » “Form replay” and click on “New form replay”.
|
|
</p>
|
|
|
|
<p>
|
|
<img src="../../../media/documentation/manager-form-replay.png" class="mediacenter" alt="" />
|
|
</p>
|
|
|
|
<p>
|
|
Fill values here:
|
|
</p>
|
|
<ul>
|
|
<li class="level1"><div class="li"> <strong>Form <abbr title="Uniform Resource Locator">URL</abbr></strong>: /login.php</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> <strong>Target <abbr title="Uniform Resource Locator">URL</abbr></strong>: /process.php</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> <strong>jQuery <abbr title="Uniform Resource Locator">URL</abbr></strong>: http://ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> <strong>jQuery form selector</strong>: #loginForm</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> <strong>jQuery button selector</strong>: button.validate</div>
|
|
</li>
|
|
</ul>
|
|
|
|
<p>
|
|
Then click on <code>New variable</code> and add all data with their values, for example:
|
|
</p>
|
|
|
|
<p>
|
|
<img src="../../../media/documentation/manager-form-replay-vars.png" class="mediacenter" alt="" />
|
|
</p>
|
|
|
|
<p>
|
|
<p><div class="notetip">You can define more than one form replay <abbr title="Uniform Resource Locator">URL</abbr> per virtual host.
|
|
</div></p>
|
|
</p>
|
|
|
|
</div>
|
|
</div><!-- closes <div class="dokuwiki export">--> |