NAME
Lemonldap::NG::Portal::Main::Issuer - Base class for identity providers.
SYNOPSIS
package Lemonldap::NG::Portal::Issuer::My;
use strict;
use Mouse;
extends 'Lemonldap::NG::Portal::Main::Issuer';
use Lemonldap::NG::Portal::Main::Constants qw(PE_OK);
# Required: URL root path
use constant path => 'saml';
# Optional initialization method
sub init {
my ($self) = @_;
...
# Must return 1 (succeed) or 0 (failure)
}
# Required methods are run() and logout(), they are launched only for
# authenticated users
# $req is a Lemonldap::NG::Portal::Main::Request object
# They must return a Lemonldap::NG::Portal::Main::Constants constant
sub run {
my ( $self, $req ) = @_
...
return PE_OK
}
sub logout {
my ( $self, $req ) = @_
...
return PE_OK
}
1;DESCRIPTION
Lemonldap::NG::Portal::Main::Issuer is a base class to write identity providers for Lemonldap::NG web-SSO system. It provide several methods to write easily an IdP and manage authentication if the identity request comes before authentication.
WRITING AN IDENTITY PROVIDER
To write a classic identity provider, you just have to inherit this class and write run() and logout() methods. These methods must return a Lemonldap::NG::Portal::Main::Constants constant.
A classic identity provider needs a "issuerDB>XXX<Path" parameter in LLNG configuration to declare its base URI path (see Lemonldap::NG::Manager::Build). Example: /saml/. All requests that starts with /saml/ will call run() after authentication if needed, and no one else.
The logout() function is called when user asks for logout on this server. If you want to write an identity provider, you must implement a single logout system.
managing other URI path
Lemonldap::NG::Portal::Main::Issuer provides methods to bind a method to an URI path:
They must be called during initialization process (so you must write the optional init() sub).
Be careful with add*authRoute(): you can't catch here your root path (= path declared in $self->path) because it is caught by this module, but you can catch sub-routes (ie /path/something).
Example:
sub init {
my ($self) = @_;
...
$self->addUnauthRoute( saml => { soap => 'soapServer' }, [ 'POST' ] );
return 1;
}
sub soapServer {
my ( $self, $req ) = @_;
...
# You must return a valid PSGI response
return [ 200, [ 'Content-Type' => 'application/xml' ], [] ];
}avoid conflicts in path
If you share base URI path with another plugin (a Auth::* module for example), it is recommended to write a ssoMatch function that returns true if $req->uri has to be handled by Issuer module. See Issuer::SAML or Issuer::OpenIDConnect to have some examples.
SEE ALSO
AUTHORS
- LemonLDAP::NG team http://lemonldap-ng.org/team
BUG REPORT
Use OW2 system to report bug or ask for features: https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/issues
DOWNLOAD
Lemonldap::NG is available at https://lemonldap-ng.org/download
COPYRIGHT AND LICENSE
See COPYING file for details.
This library is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with this program. If not, see http://www.gnu.org/licenses/.