LemonLDAP-NG
Maintainer
Daniel B.
Firewall Services
mailto:daniel@firewall-services.com
Description
LemonLDAP::NG offers a full AAA (Authentication Authorization Accounting) protection:
- Authentication: credentials are needed to open SSO session
- Authorization: access rules are checked for every HTTP requests
- Accounting: each access is logged
The main benefit of using LemonLDAP::NG is that users only needs to login once: on LemonLDP::NG portal. Then, all applications configured to be protected by LemonLDAP::NG will recognize the user. This is called SSO (Single Sign On). LemonLDAP::NG is very flexible, you can use different backends for user information database, password verification etc... This contrib uses the internal LDAP server for everything. By default, everything will be pre-configured, so all users will be available, with their standard password. Group membership is also available to write access rules.
This page only describe the installation process on a SME Server. For a complete guide on how to use and configure LemonLDAP::NG, please refer to the official documentation
Requirement
LemonLDAP-NG has been developped and tested only on SMEServer 8b6. It'll will probably won't work with earlier releases, and won't be adapted to work on SME7.
You also need latest updates from the smeupdates-testing repository
yum --enablerepo=smeupdates-testing update signal-event post-upgrade signal-event reboot
Installation
Configure Firewall-Services's repository:
db yum_repositories set fws repository \ BaseURL http://repo.firewall-services.com/centos/\$releasever \ EnableGroups no GPGCheck yes \ Name "Firewall Services" \ GPGKey http://repo.firewall-services.com/RPM-GPG-KEY \ Visible yes status disabled signal-event yum-modify
Configure the EPEL repository
db yum_repositories set epel repository \ Name 'Extra Packages for Enterprise Linux 5' \ MirrorList 'http://mirrors.fedoraproject.org/mirrorlist?repo=epel-5&arch=i386' \ status disabled GPGCheck yes \ GPGKey http://download.fedora.redhat.com/pub/epel/RPM-GPG-KEY-EPEL signal-event yum-modify
- install the rpms
yum --enablerepo=fws --enablerepo=epel install smeserver-lemonldap-ng
- Now, appply the needed configuration:
signal-event webapps-update db configuration set UnsavedChanges no
Configuration
This contrib will automatically create two new domains:
- sso-manager.domain.tld: this domain is used to access LemonLDAP management interface (configuration and session explorer)
- auth.domain.tld: this domain is the authentication portal
Those domains will work out-of-the-box from the internal network if you use your SME Server as DNS, else, you'll need to add thos two hostname to your DNS Server. You also need to add those hostnames on your external DNS server if you wawnt the portal to work from the outside.
Most of the configuration of LemonLDAP::NG is available from https://sso-manager.domain.tld/. You'll need to login using the admin credentials of your server to access this page.
Additional options
Some settings are available from the DB
- ManagerAuth: If you want the manager interface (https://sso-manager.domain.tld) to be self protected (LemonLDAP protects it's own management interface), you can set the prop to self. You first need to be sure authentication on the portal is working.
- Reload: A list of additionnal handler to call on configuration reloads. This setting is only usefull if you connect other handler on different phisical machines (using the Soap backend for example to access the configuration and session database). This needs to be a comma-separated list in the form:
db configuration setprop lemonldap Reload server1=https://server1.domain.tld/reload,server2=https://reload.domain.tld
- SoapAllowFrom: A comma-separated list a IP addresses and/or networks which will be granted access to the SOAP ressources (/sessions, /config etc...). This is only needed if you configure remote handler to use the Soap backend to access sessions and configuration databases.
- SoapPassword: All soap ressources are protected by IP restriction (see SoapAllowFrom), and username/password (basic auth). The username is lemonsaop, and the password is the value of this prop (the default password is randomly generated)
example:
db configuration setprop lemonldap Reload lamp.firewall-services.com=https://lamp.firewall-services.com/lm-reload SoapAllowFrom 10.11.12.13 signal-event webapps-update
Domain Name change
When you first install this contrib, the main domain name is used in the default LemonLDAP configuration. If you later change the main domain name, you'll need to adapt LemonLDAP configuration manually (using https://sso-manager.domain.tld/)
How-to protect applications
Here's quick guide on how to protect an web application with LemonLDAP::NG on SME Server:
- First, you can install your application (for example in /opt/myapp)
- Now, you need to create a custom template to make this application available from the web. LemonLDAP::NG uses VirtualHosts to protect different application, so it's recommanded to not create alias on the primary domain in your custom-template. A dedicated virtualhost will be created later to access the application. Here's a example of custom-template:
# MyApp configuration
<Directory /opt/kplaylist>
AllowOverride None
SSLRequireSSL on
AddType application/x-httpd-php .php
php_admin_value open_basedir /opt/myapp:/tmp
order deny,allow
deny from all
allow from {"$localAccess $externalSSLAccess";}
Satisfy all
</Directory>
Ok, now the application is ready to be served, but is not accessible yet (because there's no alias to make this application accessible).
- Create a domain for this application
db domains set myapp.domain.tld domain Content Primary \ Description 'My App' DocumentRoot /opt/myapp LemonLDAP enabled \ Nameservers internet TemplatePath WebAppVirtualHost
It's important to set TemplatePath to WebAppVirtualHost. Those templates are provided by smeserver-webapps-common package (automatically installed, as it's need by LemonLDAP). Those templates make it easy to protect any virtualhost by LemonLDAP::NG
- Ok, now your application is available from this addresse https://myapp.domain.tld/ but you'll get a access denied if you try to access it now. The last steop is to declare myapp.domain.tld in LemonLDAP::NG. This is done using the configuration manager (https://sso-manager.domain.tld). You can then set the access rules you want.
Troubleshoot
LemonLDAP logs are sent in apache error logs (/var/log/httpd/error_log)
Backup and Restore
You should backup the directory /var/lib/lemonldap, which is where configuration and sessions are stored
Uninstall
If you want to remove the contrib, just run:
yum remove lemonldap-ng
Source
The source for this contrib can be found in Firewall-Services's repository.