<!-- SECTION "Configuration of Apache virtual host" [3990-4634] -->
<h3><aname="use_kerberos_with_multiple_authentication_backend"id="use_kerberos_with_multiple_authentication_backend">Use Kerberos with Multiple authentication backend</a></h3>
<divclass="level3">
<p>
<p><divclass="notetip">Do no set <code>require valid-user</code> if you want to be able to fail back to another authentication backend for users without Kerberos ticket.
</div></p>
You may want to use the <ahref="../../documentation/1.3/authmulti.html"class="wikilink1"title="documentation:1.3:authmulti">Mutliple authentication backend</a> to fail back to another authentication for user without Kerberos ticket.
</p>
<p>
This needs some hacking because the Apache Kerberos authentication module do not work if <code>require valid-user</code> is not set.
</p>
<p>
To achieve this, follow these steps:
</p>
<ul>
<liclass="level1"><divclass="li"> Create a symlink on portal/index.pl to define the kerberos authentication end point:</div>
@ -160,11 +160,15 @@ multi <span class="sy0">=></span> <span class="br0">{</span>
<p>
When using this module, <acronymtitle="LemonLDAP::NG">LL::NG</acronym> portal will be called only if Apache does not return “401 Authentication required”, but this is not the Apache behaviour: if the auth module fails, Apache returns 401. We're studying a future solution for this…
When using this module, <acronymtitle="LemonLDAP::NG">LL::NG</acronym> portal will be called only if Apache does not return “401 Authentication required”, but this is not the Apache behaviour: if the auth module fails, Apache returns 401.
</p>
<p>
To bypass this, follow the documentation of <ahref="../../documentation/1.3/authapache.html#use_kerberos_with_multiple_authentication_backend"class="wikilink1"title="documentation:1.3:authapache">AuthApache module</a>
Note that groups are computed after macros, so a group rule may involve a macro value.
</p>
<p>
Besides, macros and groups are computed in alphanumeric order, that is, in the order they are displayed in the manager. For example, macro “macro1” will be computed before macro “macro2”: so, expression of macro2 may involve value of macro1. As same for groups: a group rule may involve another, previously computed group.
@ -38,10 +38,11 @@ Lemonldap::NG is designed to be very performant. In particular, it use Apache2 t
<p>
Handlers check rights and calculate headers for each <acronymtitle="Hyper Text Transfer Protocol">HTTP</acronym> hit. So to improve performances, avoid too complex rules by using the macro or the groups or local macros.
</p>
</div>
<!-- SECTION "Handler performance" [255-453] -->
<!-- SECTION "Handler performance" [255-452] -->
<h3><aname="macros_and_groups"id="macros_and_groups">Macros and groups</a></h3>
Note that groups are computed after macros, so a group rule may involve a macro value.
</p>
<p>
Besides, macros and groups are computed in alphanumeric order, that is, in the order they are displayed in the manager. For example, macro “macro1” will be computed before macro “macro2”: so, expression of macro2 may involve value of macro1. As same for groups: a group rule may involve another, previously computed group.
@ -150,7 +159,7 @@ To make the portal start faster when the server is relaunched, add those lines i
Lemonldap::NG handlers use a local cache to store sessions (for 10 minutes). So Apache::Session module is not a problem for handlers. It can be a brake for the portal:
</p>
<ol>
<liclass="level1"><divclass="li"> When you use the multiple sessions restriction parameters, sessions are parsed for each authentication unless you use an <ahref="http://search.cpan.org/perldoc?Apache::Session::Browseable"class="urlextern"title="http://search.cpan.org/perldoc?Apache::Session::Browseable"rel="nofollow">Apache::Session::Browseable</a> module.</div>
<liclass="level1"><divclass="li"> When you use the multiple sessions restriction parameters, sessions are parsed for each authentication unless you use an <ahref="https://metacpan.org/module/Apache::Session::Browseable"class="urlextern"title="https://metacpan.org/module/Apache::Session::Browseable"rel="nofollow">Apache::Session::Browseable</a> module.</div>
</li>
<liclass="level1"><divclass="li"> Since MySQL does not have always transaction feature, Apache::Session::MySQL has been designed to use MySQL locks. Since MySQL performances are very bad using this, if you want to store sessions in a MySQL database, prefer one of the following</div>
</li>
@ -163,7 +172,7 @@ Lemonldap::NG handlers use a local cache to store sessions (for 10 minutes). So
<p>
In “Apache::Session module” field, set ”<ahref="http://search.cpan.org/perldoc?Apache::Session::Flex"class="urlextern"title="http://search.cpan.org/perldoc?Apache::Session::Flex"rel="nofollow">Apache::Session::Flex</a>” and use the following parameters:
In “Apache::Session module” field, set ”<ahref="https://metacpan.org/module/Apache::Session::Flex"class="urlextern"title="https://metacpan.org/module/Apache::Session::Flex"rel="nofollow">Apache::Session::Flex</a>” and use the following parameters:
</p>
<preclass="code">
@ -188,7 +197,7 @@ Password -> ...
<p>
<ahref="http://search.cpan.org/perldoc?Apache::Session::Browseable"class="urlextern"title="http://search.cpan.org/perldoc?Apache::Session::Browseable"rel="nofollow">Apache::Session::Browseable</a> is a wrapper for other Apache::Session modules that add the capability to manage indexes. To use it (with MySQL for example), choose “Apache::Session::Browseable::MySQL” as “Apache::Session module” and use the following parameters:
<ahref="https://metacpan.org/module/Apache::Session::Browseable"class="urlextern"title="https://metacpan.org/module/Apache::Session::Browseable"rel="nofollow">Apache::Session::Browseable</a> is a wrapper for other Apache::Session modules that add the capability to manage indexes. To use it (with MySQL for example), choose “Apache::Session::Browseable::MySQL” as “Apache::Session module” and use the following parameters:
</p>
<preclass="code">
@ -203,7 +212,7 @@ Note that Apache::Session::Browseable::MySQL doesn't use MySQL locks.
</p>
<p>
<p><divclass="notetip">A <ahref="http://search.cpan.org/perldoc?Apache::Session::Browseable::Redis"class="urlextern"title="http://search.cpan.org/perldoc?Apache::Session::Browseable::Redis"rel="nofollow">Apache::Session::Browseable::Redis</a> has been created, it is the faster
<p><divclass="notetip">A <ahref="https://metacpan.org/module/Apache::Session::Browseable::Redis"class="urlextern"title="https://metacpan.org/module/Apache::Session::Browseable::Redis"rel="nofollow">Apache::Session::Browseable::Redis</a> has been created, it is the faster (except for session explorer, defeated by Apache::Session::Browseable::<ahref="https://metacpan.org/module/Apache::Session::Browseable"class="urlextern"title="https://metacpan.org/module/Apache::Session::Browseable"rel="nofollow">DBI</a>/<ahref="https://metacpan.org/module/Apache::Session::Browseable::LDAP"class="urlextern"title="https://metacpan.org/module/Apache::Session::Browseable::LDAP"rel="nofollow">LDAP</a>>= 1.0)
</div></p>
</p>
@ -213,7 +222,7 @@ Note that Apache::Session::Browseable::MySQL doesn't use MySQL locks.
<ulclass="rss"><li><divclass="li"><ahref="http://websvn.ow2.org/revision.php?repname=lemonldap&path=%2F&isdir=1&rev=2823"class="urlextern"title="http://websvn.ow2.org/revision.php?repname=lemonldap&path=%2F&isdir=1&rev=2823"rel="nofollow">Rev 2823 -- Propage some trunk changes to 1.2.4</a> by guimard (2013/04/22 11:44)</div></li><li><divclass="li"><ahref="http://websvn.ow2.org/revision.php?repname=lemonldap&path=%2F&isdir=1&rev=2822"class="urlextern"title="http://websvn.ow2.org/revision.php?repname=lemonldap&path=%2F&isdir=1&rev=2822"rel="nofollow">Rev 2822 -- Add missing encoding directive in POD (#LEMONLDAP-592)</a> by clement_oudot (2013/04/19 13:39)</div></li><li><divclass="li"><ahref="http://websvn.ow2.org/revision.php?repname=lemonldap&path=%2F&isdir=1&rev=2821"class="urlextern"title="http://websvn.ow2.org/revision.php?repname=lemonldap&path=%2F&isdir=1&rev=2821"rel="nofollow">Rev 2821 -- Backport r2811 and r2812 (#LEMONLDAP-594)</a> by clement_oudot (2013/04/19 10:47)</div></li><li><divclass="li"><ahref="http://websvn.ow2.org/revision.php?repname=lemonldap&path=%2F&isdir=1&rev=2820"class="urlextern"title="http://websvn.ow2.org/revision.php?repname=lemonldap&path=%2F&isdir=1&rev=2820"rel="nofollow">Rev 2820 -- Fix getDisplayType call in Multi backend (#LEMONLDAP-593)</a> by clement_oudot (2013/04/19 10:27)</div></li><li><divclass="li"><ahref="http://websvn.ow2.org/revision.php?repname=lemonldap&path=%2F&isdir=1&rev=2819"class="urlextern"title="http://websvn.ow2.org/revision.php?repname=lemonldap&path=%2F&isdir=1&rev=2819"rel="nofollow">Rev 2819 -- Do not stack messages when configuration load is OK (#LEMONLDAP-590)</a> by clement_oudot (2013/04/19 10:24)</div></li></ul>
<ulclass="rss"><li><divclass="li"><ahref="http://websvn.ow2.org/revision.php?repname=lemonldap&path=%2F&isdir=1&rev=2873"class="urlextern"title="http://websvn.ow2.org/revision.php?repname=lemonldap&path=%2F&isdir=1&rev=2873"rel="nofollow">Rev 2873 -- Add missing translation for BrowserID Params node (#LEMONLDAP-584)</a> by clement_oudot (2013/07/21 17:59)</div></li><li><divclass="li"><ahref="http://websvn.ow2.org/revision.php?repname=lemonldap&path=%2F&isdir=1&rev=2872"class="urlextern"title="http://websvn.ow2.org/revision.php?repname=lemonldap&path=%2F&isdir=1&rev=2872"rel="nofollow">Rev 2872 -- Configuration of BrowserID authentication module in Manager (#LEMONLDAP-584)</a> by clement_oudot (2013/07/21 17:44)</div></li><li><divclass="li"><ahref="http://websvn.ow2.org/revision.php?repname=lemonldap&path=%2F&isdir=1&rev=2871"class="urlextern"title="http://websvn.ow2.org/revision.php?repname=lemonldap&path=%2F&isdir=1&rev=2871"rel="nofollow">Rev 2871 -- Possibility to customize BrowserID login window (#LEMONLDAP-584)</a> by clement_oudot (2013/07/20 11:07)</div></li><li><divclass="li"><ahref="http://websvn.ow2.org/revision.php?repname=lemonldap&path=%2F&isdir=1&rev=2870"class="urlextern"title="http://websvn.ow2.org/revision.php?repname=lemonldap&path=%2F&isdir=1&rev=2870"rel="nofollow">Rev 2870 -- Move assertion resolution in extractFormInfo to pass found user to ...</a> by clement_oudot (2013/07/20 10:35)</div></li><li><divclass="li"><ahref="http://websvn.ow2.org/revision.php?repname=lemonldap&path=%2F&isdir=1&rev=2869"class="urlextern"title="http://websvn.ow2.org/revision.php?repname=lemonldap&path=%2F&isdir=1&rev=2869"rel="nofollow">Rev 2869 -- Patch portal.js for compatibility with IE8 (#LEMONLDAP-603)</a> by clement_oudot (2013/07/18 13:04)</div></li></ul>
Clément Oudot
13 years ago