1. The LemonLDAP::NG project
Clément OUDOT
Solutions Linux – 28th May 2013
Web access
under protect

2. Schedule Speaker Single Sign On The LemonLDAP::NG software 3/3/2017

3. About me
3/3/2017

4. Clément OUDOT
LDAP engineer since 2003 in LINAGORA company, with experiences in SUN/Oracle to OpenLDAP migration
LinID Dream Team Manager
Leader of LDAP Tool Box project project.org
Leader of LemonLDAP::NG project
3/3/2017

5. Single Sign On
3/3/2017

6. Definition
Single Sign On authentication allow users to submit their credentials only once, and to access all trusted applications
Applications do not manage passwords anymore
Identity of the user is forwarded to applications by the SSO software
3/3/2017

7. SSO for the newbies 1 User 3 2 Web Application WebSSO Portal 3/3/2017

8. LemonLDAP::NG
3/3/2017

9. Components LemonLDAP::NG main components:
Portal: authentication process, user interaction, application menu, password change form
Manager: configuration interface, sessions explorer
Handler: Apache agent, manage access authorizations
Perl, only Perl, just Perl
Relies on Apache and mod_perl
3/3/2017

10. SSO for the L33T
3/3/2017

11. Application protection
LemonLDAP::NG uses Apache virtual host as application identifier
Each application owns:
Access rules: each rule refers to an URL pattern, logout can be caught
HTTP headers: each header contains a session value, or an evaluated Perl expression
POST data: only used for form replay
Redirection options: protocol and port
3/3/2017

12. Examples Access rules: default → accept ^/admin → $groups =~ /admin/
^/logout.php → logout_sso
HTTP headers:
Auth-User → $uid
Auth-Name → uc($sn).", ".ucfirst($gn)
3/3/2017

13. Configuration interface
3/3/2017

14. Authentication methods
LemonLDAP::NG supports a lot of authentication methods:
LDAP
Database
SSL X509
Apache built-in modules (Kerberos, OTP, ...)
SAML 2.0
OpenID
Twitter
CAS
Yubikey
Radius
Methods can be stacked or displayed together
3/3/2017

15. Identity Provider
LemonLDAP::NG is a federation product, allowing services to get user identity trough standard protocols:
SAML 2.0
OpenID 2.0
CAS 1.0 and 2.0
3/3/2017

16. Next steps Better Active Directory integration
OAuth (Consumer and Provider)
Captcha
3/3/2017

17. The end... almost
3/3/2017

18. Thanks Thanks to: Solutions Linux OW2 LINAGORA company Stay in touch:
@lemonldapng
IRC: KPTN
3/3/2017

19. Questions?
3/3/2017