A simple LDAP SSO for nginx, written in Lua
- Nginx-extras from Debian wheezy-backports
- lua-json
- lua-ldap
OR
- Nginx "Openresty" flavored : http://openresty.org/
- lua-ldap
- Fetch the repository
git clone https://github.com/Kloadut/SSOwat /etc/ssowat
- Add SSOwat's Nginx configuration (
http{}
scope)
nano /etc/nginx/conf.d/ssowat.conf
lua_shared_dict cache 10m;
init_by_lua_file /etc/ssowat/init.lua;
access_by_lua_file /etc/ssowat/access.lua;
You can also put the access_by_lua_file
directive in a server{}
scope if you want to protect only a vhost.
mv /etc/ssowat/conf.json.example /etc/ssowat/conf.json
nano /etc/ssowat/conf.json
If you use YunoHost, you may want to edit the /etc/ssowat/conf.json.persistent
file, since the /etc/ssowat/conf.json
will often be overwritten.
These are the SSOwat's configuration parameters. Only portal_domain
and skipped_urls
are required, but it is recommended to know the others to fully understand what you can do with SSOwat.
Domain of the authentication portal. It has to be a domain, IP addresses will not work with SSOwat (Required)
URI of the authentication portal (default: /ssowat/
). This path must end with “/
”.
Web port of the authentication portal (default: 443
for https
, 80
for http
)
Whether authentication should use secure connection or not (default: https
)
List of handled domains (default: similar to portal_domain
)
LDAP server hostname (default: localhost
)
LDAP group to search in (default: ou=users,dc=yunohost,dc=org
)
LDAP user identifier (default: uid
)
User's attributes to fetch from LDAP (default: ["uid", "givenname", "sn", "cn", "homedirectory", "mail", "maildrop"]
)
Whether users can authenticate with their mail address (default: true
)
URI argument to use for cross-domain authentication (default: sso_login
)
Array of additionnal HTTP headers to set once user is authenticated (default: { "Remote-User": "uid" }
)
The session expiracy time limit in seconds, since the last connection (default: 86400
/ one day)
The session expiracy time limit in seconds (default: 604800
/ one week)
List of priorily protected URLs and/or URIs (by default, every URL is protected)
List of regular expressions to be matched against URLs and URIs to protect them
List of URLs and/or URIs that will not be affected by SSOwat. This must be a JSON array, and SSOwat automatically adds itself to this array.
List of regular expressions to be matched against URLs and URIs to ignore them
List of URLs and/or URIs that will not be affected by SSOwat unless user is authenticated
List of regular expressions to be matched against URLs and URIs to ignore them unless user is authenticated
Array of URLs and/or URIs to redirect and their redirect URI/URL (example: { "/": "example.org/subpath" }
)
Array of regular expressions to be matched against URLS and URIs and their redirect URI/URL (example: { "example.org/megusta$": "example.org/subpath" }
)
2-level array containing usernames and their allowed URLs along with an App name (example: { "kload": { "kload.fr/myapp/": "My App" } }
)
Language code used by default in views (default: en
)