1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
|
<!DOCTYPE html>
<html lang="en" dir="ltr">
<head>
<meta charset="utf-8" />
<title>documentation:1.9:soapsessionbackend</title>
<meta name="generator" content="DokuWiki"/>
<meta name="robots" content="index,follow"/>
<meta name="keywords" content="documentation,1.9,soapsessionbackend"/>
<link rel="search" type="application/opensearchdescription+xml" href="lib/exe/opensearch.html" title="LemonLDAP::NG"/>
<link rel="start" href="soapsessionbackend.html"/>
<link rel="contents" href="soapsessionbackend.html" title="Sitemap"/>
<link rel="stylesheet" type="text/css" href="lib/exe/css.php.t.bootstrap3.css"/>
<!-- //if:usedebianlibs
<link rel="stylesheet" type="text/css" href="/javascript/bootstrap/css/bootstrap.min.css" />
//elsif:useexternallibs
<link rel="stylesheet" type="text/css" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css"></script>
//elsif:cssminified
<link rel="stylesheet" type="text/css" href="/static/bwr/bootstrap/dist/css/bootstrap.min.css" />
//else -->
<link rel="stylesheet" type="text/css" href="/static/bwr/bootstrap/dist/css/bootstrap.css" />
<!-- //endif -->
<script type="text/javascript">/*<![CDATA[*/var NS='documentation:1.9';var JSINFO = {"id":"documentation:1.9:soapsessionbackend","namespace":"documentation:1.9"};
/*!]]>*/</script>
<script type="text/javascript" charset="utf-8" src="lib/exe/js.php.t.bootstrap3.js"></script>
<!-- //if:usedebianlibs
<script type="text/javascript" src="/javascript/jquery/jquery.min.js"></script>
//elsif:useexternallibs
<script type="text/javascript" src="http://code.jquery.com/jquery-2.2.0.min.js"></script>
//elsif:jsminified
<script type="text/javascript" src="/static/bwr/jquery/dist/jquery.min.js"></script>
//else -->
<script type="text/javascript" src="/static/bwr/jquery/dist/jquery.js"></script>
<!-- //endif -->
<!-- //if:usedebianlibs
<script type="text/javascript" src="/javascript/jquery-ui/jquery-ui.min.js"></script>
//elsif:useexternallibs
<script type="text/javascript" src="http://code.jquery.com/ui/1.10.4/jquery-ui.min.js"></script>
//elsif:jsminified
<script type="text/javascript" src="/lib/scripts/jquery-ui.min.js"></script>
//else -->
<script type="text/javascript" src="/lib/scripts/jquery-ui.js"></script>
<!-- //endif -->
</head>
<body>
<div class="dokuwiki export container">
<!-- TOC START -->
<div id="dw__toc">
<h3 class="toggle">Table of Contents</h3>
<div>
<ul class="toc">
<li class="level1"><div class="li"><a href="#setup">Setup</a></div>
<ul class="toc">
<li class="level2"><div class="li"><a href="#manager">Manager</a></div></li>
<li class="level2"><div class="li"><a href="#apache">Apache</a></div></li>
<li class="level2"><div class="li"><a href="#real_session_backend">Real session backend</a></div></li>
</ul></li>
</ul>
</div>
</div>
<!-- TOC END -->
<h1 class="sectionedit1" id="soap_session_backend">SOAP session backend</h1>
<div class="level1">
<p>
<abbr title="LemonLDAP::NG">LL::NG</abbr> portal provides SOAP end points for sessions management:
</p>
<ul>
<li class="level1"><div class="li"> <strong>sessions/</strong>: read only access to sessions (enough for distant Handlers)</div>
</li>
<li class="level1"><div class="li"> <strong>adminSessions/</strong>: read/write access to sessions (required for distant Portal, distant Manager or distant Handlers which modify sessions)</div>
</li>
</ul>
<p>
This session backend can be used to share sessions stored in a non-network backend (like <a href="filesessionbackend.html" class="wikilink1" title="documentation:1.9:filesessionbackend">file session backend</a>) or in a network backend protected with a firewall that only accepts HTTP flows.
</p>
<p>
Most of the time, SOAP session backend is used by Handlers installed on external servers.
</p>
<p>
To configure it, SOAP session backend will be set trough Manager in global configuration (used by all Hanlders), and the real session backend will be configured for local components in lemonldap-ng.ini.
</p>
</div>
<!-- EDIT1 SECTION "SOAP session backend" [1-832] -->
<h2 class="sectionedit2" id="setup">Setup</h2>
<div class="level2">
</div>
<!-- EDIT2 SECTION "Setup" [833-851] -->
<h3 class="sectionedit3" id="manager">Manager</h3>
<div class="level3">
<p>
First, active SOAP in <code>General parameters</code> » <code>Advanced parameters</code> » <code>SOAP</code>.
</p>
<p>
Then, set <code>Lemonldap::NG::Common::Apache::Session::SOAP</code> in <code>General parameters</code> » <code>Sessions</code> » <code>Session storage</code> » <code>Apache::Session module</code> and add the following parameters (case sensitive):
</p>
<div class="table sectionedit4"><table class="inline table table-bordered table-striped">
<thead>
<tr class="row0 roweven">
<th class="col0 centeralign" colspan="3"> Required parameters </th>
</tr>
<tr class="row1 rowodd">
<th class="col0 centeralign"> Name </th><th class="col1 centeralign"> Comment </th><th class="col2 centeralign"> Example </th>
</tr>
</thead>
<tr class="row2 roweven">
<td class="col0 centeralign"> <strong>proxy</strong> </td><td class="col1"> <abbr title="Uniform Resource Locator">URL</abbr> of sessions SOAP end point </td><td class="col2"> http://auth.example.com/index.pl/sessions </td>
</tr>
</table></div>
<!-- EDIT4 TABLE [1163-1322] --><div class="notetip">Use /adminSessions if the Handler need to modify the session, for example if you configured an idle timeout.
</div>
</div>
<!-- EDIT3 SECTION "Manager" [852-1450] -->
<h3 class="sectionedit5" id="apache">Apache</h3>
<div class="level3">
<p>
Sessions SOAP end points access must be allowed in Apache portal configuration (for example, access by <abbr title="Internet Protocol">IP</abbr> range):
</p>
<pre class="code file apache"><span class="co1"># SOAP functions for sessions management (disabled by default)</span>
<<span class="kw3">Location</span> /index.pl/adminSessions>
<span class="kw1">Order</span> <span class="kw1">deny</span>,<span class="kw1">allow</span>
<span class="kw1">Deny</span> from <span class="kw2">all</span>
<span class="kw1">Allow</span> from 192.168.2.0/<span class="nu0">24</span>
</<span class="kw3">Location</span>>
<span class="co1"># SOAP functions for sessions access (disabled by default)</span>
<<span class="kw3">Location</span> /index.pl/sessions>
<span class="kw1">Order</span> <span class="kw1">deny</span>,<span class="kw1">allow</span>
<span class="kw1">Deny</span> from <span class="kw2">all</span>
<span class="kw1">Allow</span> from 192.168.2.0/<span class="nu0">24</span>
</<span class="kw3">Location</span>></pre>
</div>
<!-- EDIT5 SECTION "Apache" [1451-1956] -->
<h3 class="sectionedit6" id="real_session_backend">Real session backend</h3>
<div class="level3">
<p>
Real session backend will be configured in <code>lemonldap-ng.ini</code>, in <code>portal</code> section (the portal hosts the SOAP service for sessions, and will do the link between SOAP requests and real sessions).
</p>
<p>
For example, if real sessions are stored in <a href="filesessionbackend.html" class="wikilink1" title="documentation:1.9:filesessionbackend">files</a>:
</p>
<pre class="code file ini"><span class="re0"><span class="br0">[</span>portal<span class="br0">]</span></span>
<span class="re1">globalStorage</span> <span class="sy0">=</span><span class="re2"> Apache::Session::File</span>
<span class="re1">globalStorageOptions</span> <span class="sy0">=</span><span class="re2"> <span class="br0">{</span> 'Directory' <span class="sy0">=</span>> '/var/lib/lemonldap-ng/sessions/', 'LockDirectory' <span class="sy0">=</span>> '/var/lib/lemonldap-ng/sessions/lock/', <span class="br0">}</span></span></pre>
<div class="notetip">If your sessions explorer is on the same server that the portal, either use the <strong>adminSessions</strong> end point in Manager configuration, or override the <code>globalStorage</code> and <code>globalStorageOptions</code> parameters in section all (and not portal) of <code>lemonldap-ng.ini</code>.
</div>
</div>
<!-- EDIT6 SECTION "Real session backend" [1957-] --></div>
</body>
</html>
|
