SSOwat

A simple LDAP SSO for NGINX, written in Lua.

Issues

• Please report issues to the YunoHost bugtracker.

Requirements

• nginx-extras from Debian wheezy-backports
• lua-json
• lua-ldap
• lua-filesystem
• lua-socket
• lua-rex-pcre

OR

• "OpenResty" flavored NGINX: https://openresty.org/
• lua-ldap
• lua-filesystem
• lua-socket
• lua-rex-pcre

Installation

• Fetch the repository

git clone https://github.com/YunoHost/SSOwat /etc/ssowat

NGINX configuration

• Add SSOwat's NGINX configuration (http{} scope)

nano /etc/nginx/conf.d/ssowat.conf

lua_shared_dict cache 10m;
init_by_lua_file   /etc/ssowat/init.lua;
access_by_lua_file /etc/ssowat/access.lua;

You can also put the access_by_lua_file directive in a server{} scope if you want to protect only a vhost.

SSOwat configuration

mv /etc/ssowat/conf.json.example /etc/ssowat/conf.json
nano /etc/ssowat/conf.json

If you use YunoHost, you may want to edit the /etc/ssowat/conf.json.persistent file, since the /etc/ssowat/conf.json will often be overwritten.

Available parameters

Only the portal_domain SSOwat configuration parameters is required, but it is recommended to know the others to fully understand what you can do with it.

portal_domain

Domain of the authentication portal. It has to be a domain, IP addresses will not work with SSOwat (Required).

portal_path

URI of the authentication portal (default: /ssowat/). This path must end with “/”.

portal_port

Web port of the authentication portal (default: 443 for https, 80 for http).

portal_scheme

Whether authentication should use secure connection or not (default: https).

domains

List of handled domains (default: similar to portal_domain).

ldap_host

LDAP server hostname (default: localhost).

ldap_group

LDAP group to search in (default: ou=users,dc=yunohost,dc=org).

ldap_identifier

LDAP user identifier (default: uid).

ldap_attributes

User's attributes to fetch from LDAP (default: ["uid", "givenname", "sn", "cn", "homedirectory", "mail", "maildrop"]).

ldap_enforce_crypt

Let SSOwat re-encrypt weakly-encrypted LDAP passwords into the safer sha-512 (crypt) (default: true).

allow_mail_authentication

Whether users can authenticate with their mail address (default: true).

login_arg

URI argument to use for cross-domain authentication (default: sso_login).

additional_headers

Array of additionnal HTTP headers to set once user is authenticated (default: { "Remote-User": "uid" }).

session_timeout

The session expiracy time limit in seconds, since the last connection (default: 86400 / one day).

session_max_timeout

The session expiracy time limit in seconds (default: 604800 / one week).

protected_urls

List of priorily protected URLs and/or URIs (by default, every URL is protected).

protected_regex

List of regular expressions to be matched against URLs and URIs to protect them.

skipped_urls

List of URLs and/or URIs that will not be affected by SSOwat. This must be a JSON array, and SSOwat automatically adds itself to it.

skipped_regex

List of regular expressions to be matched against URLs and URIs to ignore them.

unprotected_urls

List of URLs and/or URIs that will not be affected by SSOwat unless a user is authenticated.

unprotected_regex

List of regular expressions to be matched against URLs and URIs to ignore them unless a user is authenticated.

redirected_urls

Array of URLs and/or URIs to redirect and their redirect URI/URL (example: { "/": "example.org/subpath" }).

redirected_regex

Array of regular expressions to be matched against URLs and URIs and their redirect URI/URL (example: { "example.org/megusta$": "example.org/subpath" }).

users

2-level array containing usernames and their allowed URLs along with an app name (example: { "kload": { "kload.fr/myapp/": "My App" } }).

default_language

Language code used by default in views (default: en).