1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
lang="en" dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title></title>
<!-- metadata -->
<meta name="generator" content="Offline" />
<meta name="version" content="Offline 0.1" />
<!-- style sheet links -->
<link rel="stylesheet" media="all" type="text/css" href="../../../css/all.css" />
<link rel="stylesheet" media="screen" type="text/css" href="../../../css/screen.css" />
<link rel="stylesheet" media="print" type="text/css" href="../../../css/print.css" />
</head>
<body>
<div class="dokuwiki export">
<h1><a name="secure_token_handler" id="secure_token_handler">Secure Token Handler</a></h1>
<div class="level1">
</div>
<!-- SECTION "Secure Token Handler" [1-36] -->
<h2><a name="presentation" id="presentation">Presentation</a></h2>
<div class="level2">
<p>
The Secure Token Handler is a special Handler that create a token for each request and send it to the protected application. The real user identifier is stored in a Memcached server and the protected application can the request the Memcached server to get user identifier.
</p>
<p>
This mechanism allow to do <acronym title="Single Sign On">SSO</acronym> on application with an unsafe link between Handler and the application, but with a safe link with the Memcached server.
</p>
</div>
<!-- SECTION "Presentation" [37-488] -->
<h2><a name="configuration" id="configuration">Configuration</a></h2>
<div class="level2">
</div>
<!-- SECTION "Configuration" [489-515] -->
<h3><a name="virtual_host_in_apache" id="virtual_host_in_apache">Virtual host in Apache</a></h3>
<div class="level3">
<p>
Configure the virtual host like other <a href="../../documentation/1.3/configvhost.html" class="wikilink1" title="documentation:1.3:configvhost">protected virtual host</a> but use Secure Token Handler instead of default Handler.
</p>
<pre class="code file apache"><<span class="kw3">VirtualHost</span> *:80>
<span class="kw1">ServerName</span> secure.example.com
<span class="co1"># Load SecureToken Handler</span>
PerlRequire __HANDLERDIR__/MyHandlerSecureToken.pm
PerlHeaderParserHandler My::SecureToken
...
</<span class="kw3">VirtualHost</span>></pre>
</div>
<!-- SECTION "Virtual host in Apache" [516-938] -->
<h3><a name="handler_parameters" id="handler_parameters">Handler parameters</a></h3>
<div class="level3">
<p>
Go in Manager, <code>Default parameters</code> » <code>Advanced parameters</code> » <code>Special handlers</code> » <code>Secure Token</code>, and edit the different keys:
</p>
<ul>
<li class="level1"><div class="li"> <strong>Memcached servers</strong>: addresses of Memcached servers, separated with spaces.</div>
</li>
<li class="level1"><div class="li"> <strong>Token expiration</strong>: time in seconds for token expiration (remove from Memcached server).</div>
</li>
<li class="level1"><div class="li"> <strong>Attribute to store</strong>: the session key that will be stored in Memcached.</div>
</li>
<li class="level1"><div class="li"> <strong>Protected URLs</strong>: Regexp of URLs for which the secure token will be sent, separated by spaces</div>
</li>
<li class="level1"><div class="li"> <strong>Header name</strong>: name of the <acronym title="Hyper Text Transfer Protocol">HTTP</acronym> header carrying the secure token.</div>
</li>
<li class="level1"><div class="li"> <strong>Allow requests in error</strong>: allow a request that has generated an error in token generation to be forwarded to the protected application without secure token (default: yes)</div>
</li>
</ul>
</div>
<!-- SECTION "Handler parameters" [939-] --></div><!-- closes <div class="dokuwiki export">-->
|
