LemonLDAP-NG

Languages:

Maintainer

Daniel B.
Firewall Services
mailto:daniel@firewall-services.com

Description

LemonLDAP::NG offers a full AAA (Authentication Authorization Accounting) protection:

Authentication: credentials are needed to open SSO session
Authorization: access rules are checked for every HTTP requests
Accounting: each access is logged

The main benefit of using LemonLDAP::NG is that users only needs to login once: on LemonLDP::NG portal. Then, all applications configured to be protected by LemonLDAP::NG will recognize the user. This is called SSO (Single Sign On). LemonLDAP::NG is very flexible, you can use different backends for user information database, password verification etc... This contrib uses the internal LDAP server for everything. By default, everything will be pre-configured, so all users will be available, with their standard password. Group membership is also available to write access rules.

This page only describe the installation process on a SME Server. For a complete guide on how to use and configure LemonLDAP::NG, please refer to the official documentation

Requirement

LemonLDAP-NG has been developped and tested only on SMEServer 8b6. It'll will probably won't work with earlier releases, and won't be adapted to work on SME7.

Installation

Configure Firewall-Services's repository:

db yum_repositories set fws repository \
BaseURL http://repo.firewall-services.com/centos/\$releasever \
EnableGroups no GPGCheck yes \
Name "Firewall Services" \
GPGKey http://repo.firewall-services.com/RPM-GPG-KEY \
Visible yes status disabled
signal-event yum-modify

Configure the EPEL repository

db yum_repositories set epel repository \
Name 'Extra Packages for Enterprise Linux 5' \
MirrorList 'http://mirrors.fedoraproject.org/mirrorlist?repo=epel-5&arch=i386' \
status disabled GPGCheck yes \
GPGKey http://download.fedora.redhat.com/pub/epel/RPM-GPG-KEY-EPEL
signal-event yum-modify

install the rpms

yum --enablerepo=fws --enablerepo=epel install smeserver-lemonldap-ng

Now, appply the needed configuration:

signal-event webapps-update
db configuration set UnsavedChanges no

Configuration

This contrib will automatically create two new domains:

sso-manager.domain.tld: this domain is used to access LemonLDAP management interface (configuration and session explorer)
auth.domain.tld: this domain is the authentication portal

Those domains will work out-of-the-box from the internal network if you use your SME Server as DNS, else, you'll need to add thos two hostname to your DNS Server. You also need to add those hostnames on your external DNS server if you wawnt the portal to work from the outside.

Most of the configuration of LemonLDAP::NG is available from https://sso-manager.domain.tld/. You'll need to login using the admin credentials of your server to access this page.

Additional options

Some settings are available from the DB

ManagerAuth: If you want the manager interface (https://sso-manager.domain.tld) to be self protected (LemonLDAP protects it's own management interface), you can set the prop to self. You first need to be sure authentication on the portal is working.
Reload: A list of additionnal handler to call on configuration reloads. This setting is only usefull if you connect other handler on different phisical machines (using the Soap backend for example to access the configuration and session database). This needs to be a comma-separated list in the form:

db configuration setprop lemonldap Reload server1=https://server1.domain.tld/reload,server2=https://reload.domain.tld

SoapAllowFrom: A comma-separated list a IP addresses and/or networks which will be granted access to the SOAP ressources (/sessions, /config etc...). This is only needed if you configure remote handler to use the Soap backend to access sessions and configuration databases.
SoapPassword: All soap ressources are protected by IP restriction (see SoapAllowFrom), and username/password (basic auth). The username is lemonsaop, and the password is the value of this prop (the default password is randomly generated)

example:

db configuration setprop lemonldap Reload lamp.firewall-services.com=https://lamp.firewall-services.com/lm-reload SoapAllowFrom 10.11.12.13
signal-event webapps-update

Domain Name change

When you first install this contrib, the main domain name is used in the default LemonLDAP configuration. If you later change the main domain name, you'll need to adapt LemonLDAP configuration manually (using https://sso-manager.domain.tld/)

Troubleshoot

LemonLDAP logs are sent in apache error logs (/var/log/httpd/error_log)

Backup and Restore

You should backup the directory /var/lib/lemonldap, which is where configuration and sessions are stored

Uninstall

If you want to remove the contrib, just run:

yum remove lemonldap-ng

Source

The source for this contrib can be found in Firewall-Services's repository.

Contents