Update documentation (#909)
Clément Oudot
9 years ago
parent
2f91261261
commit
b48621b00c
File diff suppressed because one or more lines are too long
|
After Width: | Height: | Size: 15 KiB |
|
After Width: | Height: | Size: 11 KiB |
|
After Width: | Height: | Size: 23 KiB |
|
After Width: | Height: | Size: 25 KiB |
|
After Width: | Height: | Size: 43 KiB |
|
After Width: | Height: | Size: 10 KiB |
|
After Width: | Height: | Size: 14 KiB |
|
After Width: | Height: | Size: 14 KiB |
|
After Width: | Height: | Size: 67 KiB |
|
After Width: | Height: | Size: 136 KiB |
|
After Width: | Height: | Size: 59 KiB |
|
After Width: | Height: | Size: 12 KiB |
@ -0,0 +1,106 @@ |
||||
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" |
||||
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> |
||||
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" |
||||
lang="en" dir="ltr"> |
||||
|
||||
<head> |
||||
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> |
||||
<title></title> |
||||
<!-- metadata --> |
||||
<meta name="generator" content="Offline" /> |
||||
<meta name="version" content="Offline 0.1" /> |
||||
<!-- style sheet links --> |
||||
<link rel="stylesheet" media="all" type="text/css" href="../../../css/all.css" /> |
||||
<link rel="stylesheet" media="screen" type="text/css" href="../../../css/screen.css" /> |
||||
<link rel="stylesheet" media="print" type="text/css" href="../../../css/print.css" /> |
||||
|
||||
</head> |
||||
<body> |
||||
<div class="dokuwiki export"> |
||||
|
||||
|
||||
<h1 class="sectionedit1" id="france_connect">France Connect</h1> |
||||
<div class="level1"> |
||||
|
||||
<p> |
||||
<img src="../../../media/applications/franceconnect_logo.png" class="mediacenter" alt="" /> |
||||
</p> |
||||
|
||||
</div> |
||||
<!-- EDIT1 SECTION "France Connect" [1-82] --> |
||||
<h2 class="sectionedit2" id="presentation">Presentation</h2> |
||||
<div class="level2"> |
||||
|
||||
<p> |
||||
<a href="https://doc.integ01.dev-franceconnect.fr/" class="urlextern" title="https://doc.integ01.dev-franceconnect.fr/" rel="nofollow">France Connect</a> is an authentication platform made by French government. |
||||
</p> |
||||
|
||||
<p> |
||||
<p><div class="noteimportant">It is for the moment only in BETA stage. This documentation will explain how to configure <abbr title="LemonLDAP::NG">LL::NG</abbr> with the developer reserved space. |
||||
</div></p> |
||||
</p> |
||||
|
||||
</div> |
||||
<!-- EDIT2 SECTION "Presentation" [83-383] --> |
||||
<h2 class="sectionedit3" id="register_on_france_connect">Register on France Connect</h2> |
||||
<div class="level2"> |
||||
|
||||
<p> |
||||
Once <a href="../../documentation/1.9/openidconnectservice.html" class="wikilink1" title="documentation:1.9:openidconnectservice">OpenID Connect service</a> is configured, you need to register to France Connect. |
||||
</p> |
||||
|
||||
<p> |
||||
Use the following form: <a href="https://doc.integ01.dev-franceconnect.fr/inscription" class="urlextern" title="https://doc.integ01.dev-franceconnect.fr/inscription" rel="nofollow">https://doc.integ01.dev-franceconnect.fr/inscription</a>. |
||||
</p> |
||||
|
||||
<p> |
||||
You need to provide the callback URLs, for example <a href="https://auth.domain.com/?openidcallback=1" class="urlextern" title="https://auth.domain.com/?openidcallback=1" rel="nofollow">https://auth.domain.com/?openidcallback=1</a>. |
||||
</p> |
||||
|
||||
<p> |
||||
You will then get a <code>client_id</code> and a <code>client_secret</code>. |
||||
</p> |
||||
|
||||
</div> |
||||
<!-- EDIT3 SECTION "Register on France Connect" [384-770] --> |
||||
<h2 class="sectionedit4" id="declare_france_connect_in_your_llng_server">Declare France Connect in your LL::NG server</h2> |
||||
<div class="level2"> |
||||
|
||||
<p> |
||||
Go in Manager and create a new OpenID Connect provider. You can call it <code>france-connect</code> for example. |
||||
</p> |
||||
|
||||
<p> |
||||
Click on <code>Metadata</code> and set manually the metadata of the service, using <a href="https://doc.integ01.dev-franceconnect.fr/fournisseur-service" class="urlextern" title="https://doc.integ01.dev-franceconnect.fr/fournisseur-service" rel="nofollow">France Connect endpoints</a>. For example: |
||||
</p> |
||||
<pre class="code file javascript"><span class="br0">{</span> |
||||
<span class="st0">"issuer"</span><span class="sy0">:</span> <span class="st0">"https://fcp.integ01.dev-franceconnect.fr"</span><span class="sy0">,</span> |
||||
<span class="st0">"authorization_endpoint"</span><span class="sy0">:</span> <span class="st0">"https://fcp.integ01.dev-franceconnect.fr/api/v1/authorize"</span><span class="sy0">,</span> |
||||
<span class="st0">"token_endpoint"</span><span class="sy0">:</span> <span class="st0">"https://fcp.integ01.dev-franceconnect.fr/api/v1/token"</span><span class="sy0">,</span> |
||||
<span class="st0">"userinfo_endpoint"</span><span class="sy0">:</span> <span class="st0">"https://fcp.integ01.dev-franceconnect.fr/api/v1/userinfo"</span><span class="sy0">,</span> |
||||
<span class="st0">"end_session_endpoint"</span><span class="sy0">:</span><span class="st0">"https://fcp.integ01.dev-franceconnect.fr/api/v1/logout"</span> |
||||
<span class="br0">}</span></pre> |
||||
|
||||
<p> |
||||
You can skip JWKS data, they are not provided by France Connect. The security relies on the symmetric key <code>client_secret</code>. |
||||
</p> |
||||
|
||||
<p> |
||||
Go in <code>Exported attributes</code> to choose which attributes from “identité pivot” you want to collect. See <a href="https://doc.integ01.dev-franceconnect.fr/identite-pivot" class="urlextern" title="https://doc.integ01.dev-franceconnect.fr/identite-pivot" rel="nofollow">https://doc.integ01.dev-franceconnect.fr/identite-pivot</a> |
||||
</p> |
||||
|
||||
<p> |
||||
Now go in <code>Options</code>: |
||||
</p> |
||||
<ul> |
||||
<li class="level1"><div class="li"> In <code>Configuration</code>, register the <code>client_id</code> and <code>client_secret</code> given by France Connect</div> |
||||
</li> |
||||
<li class="level1"><div class="li"> In <code>Protocol</code>, adapt the <code>scope</code> to the exported attributes you want. See <a href="https://doc.integ01.dev-franceconnect.fr/fs-scopes" class="urlextern" title="https://doc.integ01.dev-franceconnect.fr/fs-scopes" rel="nofollow">https://doc.integ01.dev-franceconnect.fr/fs-scopes</a></div> |
||||
</li> |
||||
<li class="level1"><div class="li"> In <code>Display</code>, you can set the name and the logo</div> |
||||
</li> |
||||
</ul> |
||||
|
||||
</div> |
||||
</div><!-- closes <div class="dokuwiki export">--> |
||||
@ -0,0 +1,113 @@ |
||||
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" |
||||
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> |
||||
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" |
||||
lang="en" dir="ltr"> |
||||
|
||||
<head> |
||||
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> |
||||
<title></title> |
||||
<!-- metadata --> |
||||
<meta name="generator" content="Offline" /> |
||||
<meta name="version" content="Offline 0.1" /> |
||||
<!-- style sheet links --> |
||||
<link rel="stylesheet" media="all" type="text/css" href="../../../css/all.css" /> |
||||
<link rel="stylesheet" media="screen" type="text/css" href="../../../css/screen.css" /> |
||||
<link rel="stylesheet" media="print" type="text/css" href="../../../css/print.css" /> |
||||
|
||||
</head> |
||||
<body> |
||||
<div class="dokuwiki export"> |
||||
|
||||
|
||||
<h1 class="sectionedit1" id="google">Google</h1> |
||||
<div class="level1"> |
||||
|
||||
<p> |
||||
<img src="../../../media/applications/google_logo.png" class="mediacenter" alt="" /> |
||||
</p> |
||||
|
||||
</div> |
||||
<!-- EDIT1 SECTION "Google" [1-67] --> |
||||
<h2 class="sectionedit2" id="presentation">Presentation</h2> |
||||
<div class="level2"> |
||||
|
||||
<p> |
||||
Do you we have to present <a href="http://www.google.com" class="urlextern" title="http://www.google.com" rel="nofollow">Google</a>? The good news is that Google is a standard OpenID Provider, and so you can easily delegate the authentication of <abbr title="LemonLDAP::NG">LL::NG</abbr> to Google: <a href="https://developers.google.com/identity/protocols/OpenIDConnect" class="urlextern" title="https://developers.google.com/identity/protocols/OpenIDConnect" rel="nofollow">https://developers.google.com/identity/protocols/OpenIDConnect</a> |
||||
</p> |
||||
|
||||
<p> |
||||
<p><div class="noteimportant">Google does not support logout trough OpenID Connect. If you close your session on <abbr title="LemonLDAP::NG">LL::NG</abbr> side, your Google session will still be open. |
||||
</div></p> |
||||
</p> |
||||
|
||||
</div> |
||||
<!-- EDIT2 SECTION "Presentation" [68-507] --> |
||||
<h2 class="sectionedit3" id="register_on_google">Register on Google</h2> |
||||
<div class="level2"> |
||||
|
||||
<p> |
||||
You need a Google developer account to access to <a href="https://console.developers.google.com/" class="urlextern" title="https://console.developers.google.com/" rel="nofollow">https://console.developers.google.com/</a> |
||||
</p> |
||||
|
||||
<p> |
||||
Here you can go in <abbr title="Application Programming Interface">API</abbr> Manager and get new credentials (<code>client_id</code> and <code>client_secret</code>). |
||||
</p> |
||||
|
||||
<p> |
||||
You need to provide the callback URLs, for example <a href="https://auth.domain.com/?openidcallback=1" class="urlextern" title="https://auth.domain.com/?openidcallback=1" rel="nofollow">https://auth.domain.com/?openidcallback=1</a>. |
||||
</p> |
||||
|
||||
</div> |
||||
<!-- EDIT3 SECTION "Register on Google" [508-818] --> |
||||
<h2 class="sectionedit4" id="declare_google_in_your_llng_server">Declare Google in your LL::NG server</h2> |
||||
<div class="level2"> |
||||
|
||||
<p> |
||||
Go in Manager and create a new OpenID Connect provider. You can call it <code>google</code> for example. |
||||
</p> |
||||
|
||||
<p> |
||||
Click on <code>Metadata</code>, and use the OpenID Connect configuration <abbr title="Uniform Resource Locator">URL</abbr> to load them: <a href="https://accounts.google.com/.well-known/openid-configuration" class="urlextern" title="https://accounts.google.com/.well-known/openid-configuration" rel="nofollow">https://accounts.google.com/.well-known/openid-configuration</a>. |
||||
</p> |
||||
|
||||
<p> |
||||
You can also load the JWKS data from the <abbr title="Uniform Resource Locator">URL</abbr> <a href="https://www.googleapis.com/oauth2/v3/certs" class="urlextern" title="https://www.googleapis.com/oauth2/v3/certs" rel="nofollow">https://www.googleapis.com/oauth2/v3/certs</a>. But as Google rotate their keys, we will also configure a refresh interval on JKWS data. |
||||
</p> |
||||
|
||||
<p> |
||||
Go in <code>Exported attributes</code> to choose which attributes you want to collect. Google supports these claims: |
||||
</p> |
||||
<ul> |
||||
<li class="level1"><div class="li"> email</div> |
||||
</li> |
||||
<li class="level1"><div class="li"> email_verified</div> |
||||
</li> |
||||
<li class="level1"><div class="li"> family_name</div> |
||||
</li> |
||||
<li class="level1"><div class="li"> given_name</div> |
||||
</li> |
||||
<li class="level1"><div class="li"> locale</div> |
||||
</li> |
||||
<li class="level1"><div class="li"> name</div> |
||||
</li> |
||||
<li class="level1"><div class="li"> picture</div> |
||||
</li> |
||||
<li class="level1"><div class="li"> sub</div> |
||||
</li> |
||||
</ul> |
||||
|
||||
<p> |
||||
Now go in <code>Options</code>: |
||||
</p> |
||||
<ul> |
||||
<li class="level1"><div class="li"> In <code>Configuration</code>, register the <code>client_id</code> and <code>client_secret</code> given by Google. Set also the configuration <abbr title="Uniform Resource Identifier">URI</abbr> with <a href="https://accounts.google.com/.well-known/openid-configuration" class="urlextern" title="https://accounts.google.com/.well-known/openid-configuration" rel="nofollow">https://accounts.google.com/.well-known/openid-configuration</a>, and JWKS refresh, for example every day: 86400.</div> |
||||
</li> |
||||
<li class="level1"><div class="li"> In <code>Protocol</code>, adapt the <code>scope</code> to the exported attributes you want. You can for example use <code>openid profile email</code>.</div> |
||||
</li> |
||||
<li class="level1"><div class="li"> In <code>Display</code>, you can set the name and the logo</div> |
||||
</li> |
||||
</ul> |
||||
|
||||
</div> |
||||
</div><!-- closes <div class="dokuwiki export">--> |
||||
@ -0,0 +1,109 @@ |
||||
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" |
||||
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> |
||||
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" |
||||
lang="en" dir="ltr"> |
||||
|
||||
<head> |
||||
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> |
||||
<title></title> |
||||
<!-- metadata --> |
||||
<meta name="generator" content="Offline" /> |
||||
<meta name="version" content="Offline 0.1" /> |
||||
<!-- style sheet links --> |
||||
<link rel="stylesheet" media="all" type="text/css" href="../../../css/all.css" /> |
||||
<link rel="stylesheet" media="screen" type="text/css" href="../../../css/screen.css" /> |
||||
<link rel="stylesheet" media="print" type="text/css" href="../../../css/print.css" /> |
||||
|
||||
</head> |
||||
<body> |
||||
<div class="dokuwiki export"> |
||||
|
||||
|
||||
<h1 class="sectionedit1" id="openid_connect_claims">OpenID Connect claims</h1> |
||||
<div class="level1"> |
||||
<div class="table sectionedit2"><table class="inline"> |
||||
<thead> |
||||
<tr class="row0 roweven"> |
||||
<th class="col0"> Claim name </th><th class="col1"> Type </th><th class="col2"> Example of corresponding LDAP attribute </th> |
||||
</tr> |
||||
</thead> |
||||
<tr class="row1 rowodd"> |
||||
<td class="col0"> sub </td><td class="col1"> string </td><td class="col2"> uid </td> |
||||
</tr> |
||||
<tr class="row2 roweven"> |
||||
<td class="col0"> name </td><td class="col1"> string </td><td class="col2"> cn </td> |
||||
</tr> |
||||
<tr class="row3 rowodd"> |
||||
<td class="col0"> given_name </td><td class="col1"> string </td><td class="col2"> givenName </td> |
||||
</tr> |
||||
<tr class="row4 roweven"> |
||||
<td class="col0"> family_name </td><td class="col1"> string </td><td class="col2"> sn </td> |
||||
</tr> |
||||
<tr class="row5 rowodd"> |
||||
<td class="col0"> middle_name </td><td class="col1"> string </td><td class="col2"> </td> |
||||
</tr> |
||||
<tr class="row6 roweven"> |
||||
<td class="col0"> nickname </td><td class="col1"> string </td><td class="col2"> </td> |
||||
</tr> |
||||
<tr class="row7 rowodd"> |
||||
<td class="col0"> preferred_username </td><td class="col1"> string </td><td class="col2"> displayName </td> |
||||
</tr> |
||||
<tr class="row8 roweven"> |
||||
<td class="col0"> profile </td><td class="col1"> string </td><td class="col2"> labeledURI </td> |
||||
</tr> |
||||
<tr class="row9 rowodd"> |
||||
<td class="col0"> picture </td><td class="col1"> string </td><td class="col2"> </td> |
||||
</tr> |
||||
<tr class="row10 roweven"> |
||||
<td class="col0"> website </td><td class="col1"> string </td><td class="col2"> </td> |
||||
</tr> |
||||
<tr class="row11 rowodd"> |
||||
<td class="col0"> email </td><td class="col1"> string </td><td class="col2"> mail </td> |
||||
</tr> |
||||
<tr class="row12 roweven"> |
||||
<td class="col0"> email_verified </td><td class="col1"> boolean </td><td class="col2"> </td> |
||||
</tr> |
||||
<tr class="row13 rowodd"> |
||||
<td class="col0"> gender </td><td class="col1"> string </td><td class="col2"> </td> |
||||
</tr> |
||||
<tr class="row14 roweven"> |
||||
<td class="col0"> birthdate </td><td class="col1"> string </td><td class="col2"> </td> |
||||
</tr> |
||||
<tr class="row15 rowodd"> |
||||
<td class="col0"> zoneinfo </td><td class="col1"> string </td><td class="col2"> </td> |
||||
</tr> |
||||
<tr class="row16 roweven"> |
||||
<td class="col0"> locale </td><td class="col1"> string </td><td class="col2"> preferredLanguage </td> |
||||
</tr> |
||||
<tr class="row17 rowodd"> |
||||
<td class="col0"> phone_number </td><td class="col1"> string </td><td class="col2"> telephoneNumber </td> |
||||
</tr> |
||||
<tr class="row18 roweven"> |
||||
<td class="col0"> phone_number_verified </td><td class="col1"> boolean </td><td class="col2"> </td> |
||||
</tr> |
||||
<tr class="row19 rowodd"> |
||||
<td class="col0"> updated_at </td><td class="col1"> string </td><td class="col2"> </td> |
||||
</tr> |
||||
<tr class="row20 roweven"> |
||||
<td class="col0"> formatted </td><td class="col1"> string </td><td class="col2"> registeredAddress </td> |
||||
</tr> |
||||
<tr class="row21 rowodd"> |
||||
<td class="col0"> street_address </td><td class="col1"> string </td><td class="col2"> street </td> |
||||
</tr> |
||||
<tr class="row22 roweven"> |
||||
<td class="col0"> locality </td><td class="col1"> string </td><td class="col2"> l </td> |
||||
</tr> |
||||
<tr class="row23 rowodd"> |
||||
<td class="col0"> region </td><td class="col1"> string </td><td class="col2"> st </td> |
||||
</tr> |
||||
<tr class="row24 roweven"> |
||||
<td class="col0"> postal_code </td><td class="col1"> string </td><td class="col2"> postalCode </td> |
||||
</tr> |
||||
<tr class="row25 rowodd"> |
||||
<td class="col0"> country </td><td class="col1"> string </td><td class="col2"> co </td> |
||||
</tr> |
||||
</table></div> |
||||
<!-- EDIT2 TABLE [38-861] --> |
||||
</div> |
||||
</div><!-- closes <div class="dokuwiki export">--> |
||||
@ -0,0 +1,49 @@ |
||||
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" |
||||
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> |
||||
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" |
||||
lang="en" dir="ltr"> |
||||
|
||||
<head> |
||||
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> |
||||
<title></title> |
||||
<!-- metadata --> |
||||
<meta name="generator" content="Offline" /> |
||||
<meta name="version" content="Offline 0.1" /> |
||||
<!-- style sheet links --> |
||||
<link rel="stylesheet" media="all" type="text/css" href="../../../css/all.css" /> |
||||
<link rel="stylesheet" media="screen" type="text/css" href="../../../css/screen.css" /> |
||||
<link rel="stylesheet" media="print" type="text/css" href="../../../css/print.css" /> |
||||
|
||||
</head> |
||||
<body> |
||||
<div class="dokuwiki export"> |
||||
|
||||
|
||||
<h1 class="sectionedit1" id="selinux">SELinux</h1> |
||||
<div class="level1"> |
||||
|
||||
<p> |
||||
To make LemonLDAP::NG work with SELinux, you may need to set up some options. |
||||
</p> |
||||
|
||||
</div> |
||||
<!-- EDIT1 SECTION "SELinux" [1-102] --> |
||||
<h2 class="sectionedit2" id="disk_cache_sessions_an_configuration">Disk cache (sessions an configuration)</h2> |
||||
<div class="level2"> |
||||
<pre class="code">chcon -R -t httpd_sys_rw_content_t /tmp</pre> |
||||
|
||||
</div> |
||||
<!-- EDIT2 SECTION "Disk cache (sessions an configuration)" [103-208] --> |
||||
<h2 class="sectionedit3" id="memcache">Memcache</h2> |
||||
<div class="level2"> |
||||
<pre class="code">setsebool -P httpd_can_network_memcache 1</pre> |
||||
|
||||
</div> |
||||
<!-- EDIT3 SECTION "Memcache" [209-286] --> |
||||
<h2 class="sectionedit4" id="proxy_http">Proxy HTTP</h2> |
||||
<div class="level2"> |
||||
<pre class="code">setsebool -P httpd_can_network_relay 1</pre> |
||||
|
||||
</div> |
||||
</div><!-- closes <div class="dokuwiki export">--> |
||||
Loading…
Reference in new issue