LemonLDAP-NG

Languages:

English  • français

Maintainer

Daniel B.
Firewall Services
mailto:daniel@firewall-services.com

Description

LemonLDAP::NG offers a full AAA (Authentication Authorization Accounting) protection:

• Authentication: credentials are needed to open SSO session
• Authorization: access rules are checked for every HTTP requests
• Accounting: each access is logged

The main benefit of using LemonLDAP::NG is that users only needs to login once: on LemonLDP::NG portal. Then, all applications configured to be protected by LemonLDAP::NG will recognize the user. This is called SSO (Single Sign On). LemonLDAP::NG is very flexible, you can use different backends for user information database, password verification etc... This contrib uses the internal LDAP server for everything. By default, everything will be pre-configured, so all users will be available, with their standard password. Group membership is also available to write access rules.

This page only describe the installation process on a SME Server. For a complete guide on how to use and configure LemonLDAP::NG, please refer to the official documentation

Requirement

LemonLDAP-NG has been developped and tested only on SMEServer 8b6. It'll will probably won't work with earlier releases, and won't be adapted to work on SME7.

You also need latest updates from the smeupdates-testing repository

yum --enablerepo=smeupdates-testing update
signal-event post-upgrade
signal-event reboot

Installation 8.x and 9.x

Configure Firewall-Services's repository:

db yum_repositories set fws repository \
BaseURL http://repo.firewall-services.com/centos/\$releasever \
EnableGroups no GPGCheck yes \
Name "Firewall Services" \
GPGKey http://repo.firewall-services.com/RPM-GPG-KEY \
Visible yes status disabled
signal-event yum-modify

Configure the EPEL repository

db yum_repositories set epel repository \
Name 'Extra Packages for Enterprise Linux 5' \
MirrorList 'http://mirrors.fedoraproject.org/mirrorlist?repo=epel-5&arch=i386' \
status disabled GPGCheck yes \
GPGKey http://download.fedora.redhat.com/pub/epel/RPM-GPG-KEY-EPEL
signal-event yum-modify

• install the rpms

yum --enablerepo=fws --enablerepo=epel install smeserver-lemonldap-ng

• Now, appply the needed configuration:

signal-event webapps-update
db configuration set UnsavedChanges no

Configuration

This contrib will automatically create two new domains:

• sso-manager.domain.tld: this domain is used to access LemonLDAP management interface (configuration and session explorer)
• auth.domain.tld: this domain is the authentication portal

Those domains will work out-of-the-box from the internal network if you use your SME Server as DNS, else, you'll need to add those two hostnames in your DNS Server. You also need to add those hostnames in your external DNS server if you want the portal to work from the outside.

Most of the configuration of LemonLDAP::NG is available from https://sso-manager.domain.tld/. You'll need to login using the admin credentials of your server to access this page.

Additional options

Some settings are available from the DB

• ManagerAuth: If you want the manager interface (https://sso-manager.domain.tld) to be self protected (LemonLDAP protects it's own management interface), you can set the prop to self. You first need to be sure authentication on the portal is working.
• Reload: A list of additionnal handler to call on configuration reloads. This setting is only usefull if you connect other handler on different phisical machines (using the Soap backend for example to access the configuration and session database). This needs to be a comma-separated list in the form:

db configuration setprop lemonldap Reload server1=https://server1.domain.tld/reload,server2=https://reload.domain.tld

• SoapAllowFrom: A comma-separated list a IP addresses and/or networks which will be granted access to the SOAP ressources (/sessions, /config etc...). This is only needed if you configure remote handler to use the Soap backend to access sessions and configuration databases.
• SoapPassword: All soap ressources are protected by IP restriction (see SoapAllowFrom), and username/password (basic auth). The username is lemonsaop, and the password is the value of this prop (the default password is randomly generated)

example:

db configuration setprop lemonldap Reload lamp.firewall-services.com=https://lamp.firewall-services.com/lm-reload SoapAllowFrom 10.11.12.13
signal-event webapps-update

Domain Name change

When you first install this contrib, the main domain name is used in the default LemonLDAP configuration. If you later change the main domain name, you'll need to adapt LemonLDAP configuration manually (using https://sso-manager.domain.tld/)

How-to protect applications

Here's quick guide on how to protect an web application with LemonLDAP::NG on SME Server:

• First, you can install your application (for example in /opt/myapp)
• Now, you need to create a custom template to make this application available from the web. LemonLDAP::NG uses VirtualHosts to protect different applications, so it's recommended to not create alias on the primary domain in your custom-template. A dedicated virtualhost will be created later to access the application. Here's a example of custom-template:

# MyApp configuration

<Directory /opt/myapp>
    AllowOverride None
    SSLRequireSSL on
    AddType application/x-httpd-php .php
    php_admin_value open_basedir /opt/myapp:/tmp
    order deny,allow
    deny from all
    allow from {"$localAccess $externalSSLAccess";}
    Satisfy all
</Directory>

Ok, now the application is ready to be served, but is not accessible yet (because there's no alias to make this application accessible).

• Create a domain for this application

db domains set myapp.domain.tld domain Content Primary \
Description 'My App' DocumentRoot /opt/myapp Authentication LemonLDAP \
Nameservers internet TemplatePath WebAppVirtualHost
signal-event domain-create myapp.domain.tld

	Note:
	Instead of LemonLDAP you can also use LemonLDAPBasic as Authentication type. LemonLDAPBasic will still use LemonLDAP::NG to handle authentication and authorization, but will use a basic HTTP auth scheme, it's usefull in some situation, like being able to connect native mobile application for example (but of course, you won't have the benefit of the SSO with a basic auth)

It's important to set TemplatePath to WebAppVirtualHost. Those templates are provided by smeserver-webapps-common package (automatically installed, as it's need by LemonLDAP). Those templates make it easy to protect any virtualhost by LemonLDAP::NG

• Ok, now your application is available from this addresse https://myapp.domain.tld/ but you'll get a access denied if you try to access it now. The last step is to declare myapp.domain.tld in LemonLDAP::NG. This is done using the configuration manager (https://sso-manager.domain.tld). You can then set the access rules you want. You can read the project documentation for this part, especially this page [1]

Troubleshoot

LemonLDAP logs are sent in apache error logs (/var/log/httpd/error_log)

Backup and Restore

You should backup the directory /var/lib/lemonldap/conf and /var/lib/lemonldap-ng/notifications/ which is where configuration and notifications are stored

Uninstall

If you want to remove the contrib, just run:

yum remove lemonldap-ng

Source

The source for this contrib can be found in Firewall-Services's repository.

---