From 42c5e8627160caa3d58e848e48a3feaf94de9db8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Cl=C3=A9ment=20Oudot?= Date: Sun, 21 Jul 2013 16:37:21 +0000 Subject: [PATCH] Update documentation --- doc/index/alphabetical.html | 2 +- doc/pages/contact.html | 10 +-- doc/pages/documentation/1.3/authapache.html | 80 ++++++++++++++++++- doc/pages/documentation/1.3/authmulti.html | 10 ++- .../1.3/browseablesessionbackend.html | 18 ++--- doc/pages/documentation/1.3/exportedvars.html | 8 ++ .../documentation/1.3/parameterlist.html | 10 ++- doc/pages/documentation/1.3/performances.html | 33 +++++--- doc/pages/documentation/1.3/start.html | 47 ++++++----- doc/pages/download.html | 16 ++-- doc/pages/start.html | 2 +- 11 files changed, 169 insertions(+), 67 deletions(-) diff --git a/doc/index/alphabetical.html b/doc/index/alphabetical.html index 19f484c06..68fa2a333 100644 --- a/doc/index/alphabetical.html +++ b/doc/index/alphabetical.html @@ -16,4 +16,4 @@ -

Alphabetical Index

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 

Back to main index

A

activedirectoryminihowto
applications
authapache
authbasic
authcas
authchoice
authdbi
authdemo
authldap
authmulti
authnull
authopenid
authproxy
authradius
authremote
authsaml
authslave
authssl
authtwitter
authyubikey

B

browseablesessionbackend
bugzilla

C

cda
changeconfbackend
conferences
configlocation
configvhost
contact
customfunctions

D

default_sidebar
django
documentation
dokuwiki
download
drupal

E

error
exportedvars
extendedfunctions

F

features
federationproxy
fileconfbackend
filesessionbackend
formreplay

G

googleapps

H

handlerauthbasic
header_remote_user_conversion
highavailability

I

idpcas
idpopenid
idpsaml
installdeb
installrpm
installtarball
internalproxy

L

ldapconfbackend
ldapminihowto
ldapsessionbackend
liferay
limesurvey
loginhistory
logoutforward
logs

M

managerprotection
mediawiki
memcachedsessionbackend
menu1
mrtg
mysqlminihowto

N

nosqlsessionbackend
notifications

O

obm

P

parameterlist
passwordstore
performances
phpldapadmin
playground
portal
portalcustom
portalmenu
prereq
presentation
press

Q

quickstart

R

rbac
redirections
references
resetpassword

S

safejail
samlservice
screenshots
securetoken
security
selfmadeapplication
sessions
soapconfbackend
soapminihowto
soapservices
soapsessionbackend
spring
sqlconfbackend
sqlsessionbackend
ssocookie
start
status
sympa
syntax

T

tomcat
translations

U

upgrade

V

variables

W

writingrulesand_headers

Z

zimbra


Back to main index

\ No newline at end of file +

Alphabetical Index

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 

Back to main index

A

activedirectoryminihowto
applications
authapache
authbasic
authbrowserid
authcas
authchoice
authdbi
authdemo
authldap
authmulti
authnull
authopenid
authproxy
authradius
authremote
authsaml
authslave
authssl
authtwitter
authyubikey

B

browseablesessionbackend
bugzilla

C

cda
changeconfbackend
conferences
configlocation
configvhost
contact
customfunctions

D

default_sidebar
django
documentation
dokuwiki
download
drupal

E

error
exportedvars
extendedfunctions

F

features
federationproxy
fileconfbackend
filesessionbackend
formreplay

G

googleapps

H

handlerauthbasic
header_remote_user_conversion
highavailability

I

idpcas
idpopenid
idpsaml
installdeb
installrpm
installtarball
internalproxy

L

ldapconfbackend
ldapminihowto
ldapsessionbackend
liferay
limesurvey
loginhistory
logoutforward
logs

M

managerprotection
mediawiki
memcachedsessionbackend
menu1
mrtg
mysqlminihowto

N

nosqlsessionbackend
notifications

O

obm

P

parameterlist
passwordstore
performances
phpldapadmin
playground
portal
portalcustom
portalmenu
prereq
presentation
press

Q

quickstart

R

rbac
redirections
references
resetpassword

S

safejail
samlservice
screenshots
securetoken
security
selfmadeapplication
sessions
soapconfbackend
soapminihowto
soapservices
soapsessionbackend
spring
sqlconfbackend
sqlsessionbackend
ssocookie
start
status
sympa
syntax

T

tomcat
translations

U

upgrade

V

variables

W

writingrulesand_headers

Z

zimbra


Back to main index

\ No newline at end of file diff --git a/doc/pages/contact.html b/doc/pages/contact.html index 87afd7ff7..e366262c3 100644 --- a/doc/pages/contact.html +++ b/doc/pages/contact.html @@ -143,16 +143,14 @@ We use
Xavier GUIMARD: historic project leader, developer, Debian packager, administrator of big Lemonldap::NG instances
-
  • Thomas CHEMINEAU: developer, graphics
    -
  • François-Xavier DELTOMBE: developer, tester
    • -
  • Sandro CAZZANIGA: developer, Mageia packager
    +
  • Sandro CAZZANIGA: developer, tester
    • - +

    Past and present contributors

    @@ -178,6 +176,8 @@ By alphabetical order:
  • Jean-Thomas CHECCO
    • +
  • Thomas CHEMINEAU
    +
  • Sebastien DIAZ
  • Gaultier HUBERT
    @@ -197,4 +197,4 @@ By alphabetical order:
    • -
    \ No newline at end of file + \ No newline at end of file diff --git a/doc/pages/documentation/1.3/authapache.html b/doc/pages/documentation/1.3/authapache.html index bb4b1b1fd..2a42c324f 100644 --- a/doc/pages/documentation/1.3/authapache.html +++ b/doc/pages/documentation/1.3/authapache.html @@ -280,13 +280,85 @@ Modify the portal virtual host:   </VirtualHost> + + +

    Use Kerberos with Multiple authentication backend

    +
    +

    -

    Do no set require valid-user if you want to be able to fail back to another authentication backend for users without Kerberos ticket. -

    + +You may want to use the Mutliple authentication backend to fail back to another authentication for user without Kerberos ticket. +

    + +

    +This needs some hacking because the Apache Kerberos authentication module do not work if require valid-user is not set. +

    + +

    +To achieve this, follow these steps:

    + +
    +ln -s /var/lib/lemonldap-ng/portal/index.pl /var/lib/lemonldap-ng/portal/kerberos.pl
+
    + +
    +vi /var/lib/lemonldap-ng/portal/login.pl
+
    +
    #!/usr/bin/perl
+use CGI ':cgi-lib';
+use strict;
+use MIME::Base64;
+use CGI::Carp 'fatalsToBrowser';
+my $uri = $ENV{"REDIRECT_QUERY_STRING"};
+print CGI::header(-Refresh => '0; URL=http://auth.example.com/?'.$uri);
+exit(0);
    + +
    <VirtualHost *>
+  ServerName auth.example.com
+ 
+  DocumentRoot /var/lib/lemonldap-ng/portal/
+ 
+  <Directory /var/lib/lemonldap-ng/portal/>
+    Order allow,deny
+    Allow from all
+    Options +ExecCGI +FollowSymLinks
+  </Directory>
+ 
+  ErrorDocument 401 /login.pl
+  <Location /kerberos.pl>
+    <IfModule auth_kerb_module>
+      AuthType Kerberos
+      KrbMethodNegotiate On
+      KrbMethodK5Passwd Off
+      KrbAuthRealms EXAMPLE.COM
+      Krb5KeyTab /etc/lemonldap-ng/auth.keytab
+      KrbVerifyKDC Off
+      KrbServiceName HTTP/auth.example.com
+    </IfModule>
+  </Location>
+ 
+</VirtualHost>
    +
    - +

    Time to test

    @@ -297,4 +369,4 @@ Configure IE or Firefox to trust
    - \ No newline at end of file + \ No newline at end of file diff --git a/doc/pages/documentation/1.3/authmulti.html b/doc/pages/documentation/1.3/authmulti.html index 779e7cdab..61648e162 100644 --- a/doc/pages/documentation/1.3/authmulti.html +++ b/doc/pages/documentation/1.3/authmulti.html @@ -160,11 +160,15 @@ multi => {

    -When using this module, LL::NG portal will be called only if Apache does not return “401 Authentication required”, but this is not the Apache behaviour: if the auth module fails, Apache returns 401. We're studying a future solution for this… +When using this module, LL::NG portal will be called only if Apache does not return “401 Authentication required”, but this is not the Apache behaviour: if the auth module fails, Apache returns 401. +

    + +

    +To bypass this, follow the documentation of AuthApache module

    - +

    SSL authentication

    @@ -175,4 +179,4 @@ To chain SSL, you have to set

    - \ No newline at end of file + \ No newline at end of file diff --git a/doc/pages/documentation/1.3/browseablesessionbackend.html b/doc/pages/documentation/1.3/browseablesessionbackend.html index 13f913a6c..874065571 100644 --- a/doc/pages/documentation/1.3/browseablesessionbackend.html +++ b/doc/pages/documentation/1.3/browseablesessionbackend.html @@ -35,20 +35,20 @@ If you use features like SAM

    -The following table list fields to index depending on the feature you want to use: +The following table list fields to index depending on the feature you want to increase performance:

    - + - + - + @@ -75,12 +75,12 @@ The following table list fields to index depending on the feature you want to us

    - +

    Setup

    - +

    Prepare database

    @@ -106,7 +106,7 @@ Database must be prepared exactly like in );
    - +

    Manager

    @@ -171,7 +171,7 @@ For databases like PostgreSQL, don't forget to add “Commit” with a valu

    - +

    Security

    @@ -185,4 +185,4 @@ You can also use different user/password for your servers by overriding paramete

    - \ No newline at end of file + \ No newline at end of file diff --git a/doc/pages/documentation/1.3/exportedvars.html b/doc/pages/documentation/1.3/exportedvars.html index 8623a8317..103cf09ca 100644 --- a/doc/pages/documentation/1.3/exportedvars.html +++ b/doc/pages/documentation/1.3/exportedvars.html @@ -105,6 +105,14 @@ admin ->$uid# Use a group in a rule^/admin ->$groups=~/\badmin\b/ +

    +Note that groups are computed after macros, so a group rule may involve a macro value. +

    + +

    +Besides, macros and groups are computed in alphanumeric order, that is, in the order they are displayed in the manager. For example, macro “macro1” will be computed before macro “macro2”: so, expression of macro2 may involve value of macro1. As same for groups: a group rule may involve another, previously computed group. +

    +
    diff --git a/doc/pages/documentation/1.3/parameterlist.html b/doc/pages/documentation/1.3/parameterlist.html index 64b493e61..1405f74e7 100644 --- a/doc/pages/documentation/1.3/parameterlist.html +++ b/doc/pages/documentation/1.3/parameterlist.html @@ -579,12 +579,18 @@ The attribute key name can be used directly in lemonldap-ng.ini or
    + + + + + +
    Feature Fields to index
    Session explorer ipAddr WHATTOTRACE Session explorer ipAddr WHATTOTRACE _httpSessionType ipAddr
    Session restrictions ipAddr WHATTOTRACE Session restrictions ipAddr WHATTOTRACE
    SAML authentication and issuer _saml_id ProxyID _nameID _assert_id _art_id SAML authentication and issuer _saml_id ProxyID _nameID _assert_id _art_id _session_id
    CAS issuer _cas_id
    Maintenance mode maintenance ✔
    Persistent Session backend persistentStorage ✔
    Persistent Session backend options persistentStorageOptions ✔

    - +

    Configuration backend parameters

    @@ -636,4 +642,4 @@ The attribute key name can be used directly in lemonldap-ng.ini or
    - \ No newline at end of file + \ No newline at end of file diff --git a/doc/pages/documentation/1.3/performances.html b/doc/pages/documentation/1.3/performances.html index e210d1a77..c1f17e653 100644 --- a/doc/pages/documentation/1.3/performances.html +++ b/doc/pages/documentation/1.3/performances.html @@ -38,10 +38,11 @@ Lemonldap::NG is designed to be very performant. In particular, it use Apache2 t

    Handlers check rights and calculate headers for each HTTP hit. So to improve performances, avoid too complex rules by using the macro or the groups or local macros. +

    - +

    Macros and groups

    @@ -81,8 +82,16 @@ admin -> $uid # Use a group in a rule ^/admin -> $groups =~ /\badmin\b/ +

    +Note that groups are computed after macros, so a group rule may involve a macro value. +

    + +

    +Besides, macros and groups are computed in alphanumeric order, that is, in the order they are displayed in the manager. For example, macro “macro1” will be computed before macro “macro2”: so, expression of macro2 may involve value of macro1. As same for groups: a group rule may involve another, previously computed group. +

    +
    - +

    Local macros

    @@ -101,12 +110,12 @@ Display-Name ->
    - +

    Portal performances

    - +

    General performances

    @@ -121,7 +130,7 @@ The portal is the biggest component of Lemonldap::NG. It is recommended to use M </Files>
    - +

    Starting performances

    @@ -141,7 +150,7 @@ To make the portal start faster when the server is relaunched, add those lines i </Perl>
    - +

    Apache::Session performances

    @@ -150,7 +159,7 @@ To make the portal start faster when the server is relaunched, add those lines i Lemonldap::NG handlers use a local cache to store sessions (for 10 minutes). So Apache::Session module is not a problem for handlers. It can be a brake for the portal:

      -
    1. When you use the multiple sessions restriction parameters, sessions are parsed for each authentication unless you use an Apache::Session::Browseable module.
      +
    2. When you use the multiple sessions restriction parameters, sessions are parsed for each authentication unless you use an Apache::Session::Browseable module.
    3. Since MySQL does not have always transaction feature, Apache::Session::MySQL has been designed to use MySQL locks. Since MySQL performances are very bad using this, if you want to store sessions in a MySQL database, prefer one of the following
      4. @@ -163,7 +172,7 @@ Lemonldap::NG handlers use a local cache to store sessions (for 10 minutes). So

      -In “Apache::Session module” field, set ”Apache::Session::Flex” and use the following parameters: +In “Apache::Session module” field, set ”Apache::Session::Flex” and use the following parameters: 

      @@ -188,7 +197,7 @@ Password   -> ...
 
 
      
 
-Apache::Session::Browseable is a wrapper for other Apache::Session modules that add the capability to manage indexes. To use it (with MySQL for example), choose “Apache::Session::Browseable::MySQL” as “Apache::Session module” and use the following parameters:
+Apache::Session::Browseable is a wrapper for other Apache::Session modules that add the capability to manage indexes. To use it (with MySQL for example), choose “Apache::Session::Browseable::MySQL” as “Apache::Session module” and use the following parameters:
 
 
      
 
      @@ -203,7 +212,7 @@ Note that Apache::Session::Browseable::MySQL doesn't use MySQL locks.
 
      
 
 
      
-
      A Apache::Session::Browseable::Redis has been created, it is the faster
+
      A Apache::Session::Browseable::Redis has been created, it is the faster (except for session explorer, defeated by Apache::Session::Browseable::DBI/LDAP >= 1.0)
 
      
 
      
 
@@ -213,7 +222,7 @@ Note that Apache::Session::Browseable::MySQL doesn't use MySQL locks.
 
      
 
 
      
-
+
 
      LDAP performances
      
 
      
 
@@ -263,4 +272,4 @@ ldapgroups -> memberOf
 
      
 
 
      
-
    \ No newline at end of file + \ No newline at end of file diff --git a/doc/pages/documentation/1.3/start.html b/doc/pages/documentation/1.3/start.html index e74c4cfbf..da7e10eef 100644 --- a/doc/pages/documentation/1.3/start.html +++ b/doc/pages/documentation/1.3/start.html @@ -126,54 +126,57 @@ Backend choice by users ✔ ✔ ✔ - CAS ✔ + BrowserID (Mozilla Persona) ✔ - Databases (DBI) ✔ ✔ ✔ + CAS ✔ - Demonstration ✔ ✔ ✔ + Databases (DBI) ✔ ✔ ✔ - LDAP (including Active Directory) ✔ ✔ ✔ + Demonstration ✔ ✔ ✔ - Null ✔ ✔ ✔ + LDAP (including Active Directory) ✔ ✔ ✔ - OpenID ✔ ✔ + Null ✔ ✔ ✔ - Proxy LL::NG ✔ ✔ + OpenID ✔ ✔ - Radius ✔ + Proxy LL::NG ✔ ✔ - Remote LL::NG ✔ ✔ + Radius ✔ - SAML 2.0 / Shibboleth ✔ ✔ + Remote LL::NG ✔ ✔ - Slave ✔ ✔ + SAML 2.0 / Shibboleth ✔ ✔ - SSL ✔ + Slave ✔ ✔ - Stack multiple backends ✔ ✔ + SSL ✔ - Twitter ✔ + Stack multiple backends ✔ ✔ + Twitter ✔ + + Yubikey ✔ - +

    Configuration database

    @@ -213,7 +216,7 @@

    - +

    Sessions database

    @@ -256,7 +259,7 @@ Sessions are stored using +

    Identity provider

    @@ -293,7 +296,7 @@ Sessions are stored using +

    Applications protection

    @@ -318,7 +321,7 @@ Sessions are stored using +

    Advanced features

    @@ -361,7 +364,7 @@ Sessions are stored using +

    Mini howtos

    @@ -390,7 +393,7 @@ Sessions are stored using +

    Exploitation

    @@ -419,4 +422,4 @@ Sessions are stored using
    \ No newline at end of file +
    \ No newline at end of file diff --git a/doc/pages/download.html b/doc/pages/download.html index 62218b018..caf380bba 100644 --- a/doc/pages/download.html +++ b/doc/pages/download.html @@ -32,7 +32,7 @@
    -

    Stable version (1.2.3)

    +

    Stable version (1.2.4)

    @@ -40,7 +40,7 @@

    Tarball

    @@ -71,9 +71,9 @@ You can:
    RHEL/CentOS 5
    @@ -82,9 +82,9 @@ You can:
    RHEL/CentOS 6
    @@ -113,12 +113,12 @@ You can:

    - +

    Older versions

    diff --git a/doc/pages/start.html b/doc/pages/start.html index fca2c28d6..b9b284668 100644 --- a/doc/pages/start.html +++ b/doc/pages/start.html @@ -285,6 +285,6 @@ LemonLDAP::NG is the first SSO softwar

    - +
    \ No newline at end of file