The LemonLDAP::NG project Clément OUDOT Solutions Linux – 28th May 2013 Web access under protect

Schedule Speaker Single Sign On The LemonLDAP::NG software 3/3/2017 http://lemonldap-ng.org

About me 3/3/2017 http://lemonldap-ng.org

Clément OUDOT LDAP engineer since 2003 in LINAGORA company, with experiences in SUN/Oracle to OpenLDAP migration LinID Dream Team Manager http://linid.org Leader of LDAP Tool Box project http://ltb- project.org Leader of LemonLDAP::NG project http://lemonldap-ng.org 3/3/2017 http://lemonldap-ng.org

Single Sign On 3/3/2017 http://lemonldap-ng.org

Definition Single Sign On authentication allow users to submit their credentials only once, and to access all trusted applications Applications do not manage passwords anymore Identity of the user is forwarded to applications by the SSO software 3/3/2017 http://lemonldap-ng.org

SSO for the newbies 1 User 3 2 Web Application WebSSO Portal 3/3/2017 http://lemonldap-ng.org

LemonLDAP::NG 3/3/2017 http://lemonldap-ng.org

Components LemonLDAP::NG main components: Portal: authentication process, user interaction, application menu, password change form Manager: configuration interface, sessions explorer Handler: Apache agent, manage access authorizations Perl, only Perl, just Perl Relies on Apache and mod_perl 3/3/2017 http://lemonldap-ng.org

SSO for the L33T 3/3/2017 http://lemonldap-ng.org

Application protection LemonLDAP::NG uses Apache virtual host as application identifier Each application owns: Access rules: each rule refers to an URL pattern, logout can be caught HTTP headers: each header contains a session value, or an evaluated Perl expression POST data: only used for form replay Redirection options: protocol and port 3/3/2017 http://lemonldap-ng.org

Examples Access rules: default → accept ^/admin → $groups =~ /admin/ ^/logout.php → logout_sso HTTP headers: Auth-User → $uid Auth-Name → uc($sn).", ".ucfirst($gn) 3/3/2017 http://lemonldap-ng.org

Configuration interface 3/3/2017 http://lemonldap-ng.org

Authentication methods LemonLDAP::NG supports a lot of authentication methods: LDAP Database SSL X509 Apache built-in modules (Kerberos, OTP, ...) SAML 2.0 OpenID Twitter CAS Yubikey Radius Methods can be stacked or displayed together 3/3/2017 http://lemonldap-ng.org

Identity Provider LemonLDAP::NG is a federation product, allowing services to get user identity trough standard protocols: SAML 2.0 OpenID 2.0 CAS 1.0 and 2.0 3/3/2017 http://lemonldap-ng.org

Next steps Better Active Directory integration OAuth (Consumer and Provider) Captcha 3/3/2017 http://lemonldap-ng.org

The end... almost 3/3/2017 http://lemonldap-ng.org

Thanks Thanks to: Solutions Linux OW2 LINAGORA company Stay in touch: Identica: @coudot Twitter: @clementoudot @lemonldapng IRC: KPTN #lemonldap-ng@freenode 3/3/2017 http://lemonldap-ng.org

Questions? 3/3/2017 http://lemonldap-ng.org