<abbrtitle="LemonLDAP::NG">LL::NG</abbr> can be used as a <abbrtitle="Central Authentication Service">CAS</abbr> server. It can allow one to federate <abbrtitle="LemonLDAP::NG">LL::NG</abbr> with:
<abbrtitle="LemonLDAP::NG">LL::NG</abbr> can be used as a <abbrtitle="Central Authentication Service">CAS</abbr> server. It can allow one to federate <abbrtitle="LemonLDAP::NG">LL::NG</abbr> with:
</p>
</p>
<ul>
<ul>
<liclass="level1"><divclass="li"> Another <ahref="authcas.html"class="wikilink1"title="documentation:2.0:authcas">CAS authentication</a><abbrtitle="LemonLDAP::NG">LL::NG</abbr> provider</div>
<liclass="level1"><divclass="li"> Another <ahref="authcas.html"class="wikilink1"title="documentation:2.1:authcas">CAS authentication</a><abbrtitle="LemonLDAP::NG">LL::NG</abbr> provider</div>
</li>
</li>
<liclass="level1"><divclass="li"> Any <abbrtitle="Central Authentication Service">CAS</abbr> consumer</div>
<liclass="level1"><divclass="li"> Any <abbrtitle="Central Authentication Service">CAS</abbr> consumer</div>
In the Manager, go in <code>General Parameters</code> » <code>Issuer modules</code> » <code><abbrtitle="Central Authentication Service">CAS</abbr></code> and configure:
In the Manager, go in <code>General Parameters</code> » <code>Issuer modules</code> » <code><abbrtitle="Central Authentication Service">CAS</abbr></code> and configure:
</p>
</p>
<ul>
<ul>
<liclass="level1"><divclass="li"><strong>Activation</strong>: set to <code>On</code>.</div>
<liclass="level1"><divclass="li"><strong>Activation</strong>: set to <code>On</code>.</div>
</li>
</li>
<liclass="level1"><divclass="li"><strong>Path</strong>: keep <code>^/cas/</code> unless you have change <ahref="configlocation.html#portal"class="wikilink1"title="documentation:2.0:configlocation">Apache portal configuration</a> file.</div>
<liclass="level1"><divclass="li"><strong>Path</strong>: it is recommended to keep the default value (<code>^/cas/</code>)</div>
</li>
<liclass="level1"><divclass="li"><strong>Use rule</strong>: a rule to allow user to use this module, set to 1 to always allow.</div>
</li>
</li>
</ul>
</ul>
<divclass="notetip">For example, to allow only users with a strong authentication level:
<h3class="sectionedit4"id="configuring_the_cas_service">Configuring the CAS Service</h3>
<divclass="level3">
<p>
<p>
Then go in <code>Options</code> to define:
Then go in <code><abbrtitle="Central Authentication Service">CAS</abbr> Service</code> to define:
</p>
</p>
<ul>
<ul>
<liclass="level1"><divclass="li"><strong><abbrtitle="Central Authentication Service">CAS</abbr> login</strong>: the session key used to fill user login (value will be transmitted to <abbrtitle="Central Authentication Service">CAS</abbr> clients).</div>
<liclass="level1"><divclass="li"><strong><abbrtitle="Central Authentication Service">CAS</abbr> login</strong>: the session key transmitted to <abbrtitle="Central Authentication Service">CAS</abbr> client as the main identifier (<abbrtitle="Central Authentication Service">CAS</abbr>Principal)</div>
</li>
</li>
<liclass="level1"><divclass="li"><strong><abbrtitle="Central Authentication Service">CAS</abbr> attributes</strong>: list of attributes that will be transmitted in validate response. Keys are the name of attribute in the <abbrtitle="Central Authentication Service">CAS</abbr> response, values are the name of session key.</div>
<liclass="level1"><divclass="li"><strong><abbrtitle="Central Authentication Service">CAS</abbr> attributes</strong>: list of attributes that will be transmitted by default in the validate response. Keys are the name of attribute in the <abbrtitle="Central Authentication Service">CAS</abbr> response, values are the name of session key.</div>
</li>
</li>
<liclass="level1"><divclass="li"><strong>Access control policy</strong>: define if access control should be done on <abbrtitle="Central Authentication Service">CAS</abbr> service. Three options:</div>
<liclass="level1"><divclass="li"><strong>Access control policy</strong>: define if access control should be done on <abbrtitle="Central Authentication Service">CAS</abbr> service. Three options:</div>
<ul>
<ul>
<liclass="level2"><divclass="li"><strong>none</strong>: no access control, the server will answer without checking if the user is authorized for the service (this is the default)</div>
<liclass="level2"><divclass="li"><strong>none</strong>: no access control. The <abbrtitle="Central Authentication Service">CAS</abbr> service will accept non-declared <abbrtitle="Central Authentication Service">CAS</abbr> applications and ignore access control rules. This is the default.</div>
</li>
</li>
<liclass="level2"><divclass="li"><strong>error</strong>: if user has no access, an error is shown on the portal, the user is not redirected to <abbrtitle="Central Authentication Service">CAS</abbr> service</div>
<liclass="level2"><divclass="li"><strong>error</strong>: if user has no access, an error is shown on the portal, the user is not redirected to <abbrtitle="Central Authentication Service">CAS</abbr> service</div>
</li>
</li>
@ -104,12 +132,54 @@ Then go in <code>Options</code> to define:
</li>
</li>
</ul>
</ul>
</li>
</li>
<liclass="level1"><divclass="li"><strong><abbrtitle="Central Authentication Service">CAS</abbr> session module name and options</strong>: choose a specific module if you do not want to mix <abbrtitle="Central Authentication Service">CAS</abbr> sessions and normal sessions (see <ahref="samlservice.html#saml_sessions_module_name_and_options"class="wikilink1"title="documentation:2.0:samlservice">why</a>).</div>
<liclass="level1"><divclass="li"><strong><abbrtitle="Central Authentication Service">CAS</abbr> session module name and options</strong>: choose a specific module if you do not want to mix <abbrtitle="Central Authentication Service">CAS</abbr> sessions and normal sessions (see <ahref="samlservice.html#saml_sessions_module_name_and_options"class="wikilink1"title="documentation:2.1:samlservice">why</a>).</div>
</li>
</li>
</ul>
</ul>
<divclass="notetip">If <code><abbrtitle="Central Authentication Service">CAS</abbr> login</code> is not set, it uses <code>General Parameters</code> » <code>Logs</code> » <code>REMOTE_USER</code> data, which is set to <code>uid</code> by default
<divclass="notetip">If <code><abbrtitle="Central Authentication Service">CAS</abbr> login</code> is not set, it uses <code>General Parameters</code> » <code>Logs</code> » <code>REMOTE_USER</code> data, which is set to <code>uid</code> by default
<!-- EDIT4 SECTION "Configuring the CAS Service" [641-1923] -->
<h3class="sectionedit5"id="configuring_cas_applications">Configuring CAS Applications</h3>
<divclass="level3">
<p>
If an access control policy other than <code>none</code> is specified, applications that want to authenticate users through the <abbrtitle="Central Authentication Service">CAS</abbr> protocol have to be declared before LemonLDAP::NG accepts to issue service tickets for them.
</p>
<p>
Go to <code><abbrtitle="Central Authentication Service">CAS</abbr> Applications</code> and then <code>Add <abbrtitle="Central Authentication Service">CAS</abbr> Application</code>. Give a technical name (no spaces, no special characters), like “app-example”.
</p>
<p>
You can then access the configuration of this application.
</p>
</div>
<h4id="options">Options</h4>
<divclass="level4">
<ul>
<liclass="level1"><divclass="li"><strong>Service <abbrtitle="Uniform Resource Locator">URL</abbr></strong> : the service (user-facing) <abbrtitle="Uniform Resource Locator">URL</abbr> of the <abbrtitle="Central Authentication Service">CAS</abbr>-enabled application.</div>
</li>
<liclass="level1"><divclass="li"><strong>Rule</strong> : The access control rule to enforce on this application. If left blank, access will be allowed for everyone.</div>
</li>
</ul>
<divclass="noteimportant">If the access control policy is set to <code>none</code>, this rule will be ignored
You may add a list of attributes that will be transmitted in the validate response. Keys are the name of attribute in the <abbrtitle="Central Authentication Service">CAS</abbr> response, values are the name of session key.
</p>
<p>
The attributes defined here will completely replace any attributes you may have declared in the global <code><abbrtitle="Central Authentication Service">CAS</abbr> Service</code> configuration. In order to re-use the global configuration, simply set this section to an empty list.
</p>
</div>
<!-- EDIT5 SECTION "Configuring CAS Applications" [1924-] --></div>
Maxime Besson
6 years ago
committed by