Security Advisories (2)
CVE-2021-35472 (2021-07-30)

An issue was discovered in LemonLDAP::NG before 2.0.12. Session cache corruption can lead to authorization bypass or spoofing. By running a loop that makes many authentication attempts, an attacker might alternately be authenticated as one of two different users.

CVE-2021-35473

OAuth2 handler does not verify access token validity

NAME

convertSessions - A tool to convert Lemonldap::NG sessions between storage backends.

SYNOPSIS

convertSession [-di] -c parameters.ini

DESCRIPTION

convertConfig is a command line tool to migrate all sessions stored in a source backend (sessions_from), into a new backend (sessions_to).

It requires a special configuration file in which you must list the source and destination backend modules and parameters.

Sessions will not be deleted from the source backend. Existing sessions in the destination backend will be kept, unless they have the same session ID as a session in the source backend. In that case, the source will overwrite the destination.

CONFIGURATION FILE FORMAT

The configuration file needs two sections to describe the source and destination backends

Here is an example

[sessions_from]
storageModule = Apache::Session::File
storageModuleOptions = {	\
      'Directory' => '/var/lib/lemonldap-ng/sessions', 	\
      'LockDirectory' => '/var/lib/lemonldap-ng/sessions/lock', \
}
# Only migrate some session types
# sessionKind = Persistent, SSO

[sessions_to]
storageModule = Apache::Session::Browseable::Postgres
storageModuleOptions = {	\
	'DataSource' => 'DBI:Pg:database=lemonldapdb;host=pg.example.com', \
	'UserName' => 'lemonldaplogin', \
	'Password' => 'lemonldappw', \
	'Commit' => 1, \
	'Index' => 'ipAddr _whatToTrace user', \
	'TableName' => 'sessions', \
}

The sessionKind parameter may be used to filter only some session types.

Thanks to this, you can use this script to migrate from one database holding all your sessions to separate tables from each session type.

SEE ALSO

http://lemonldap-ng.org/

AUTHORS

Maxime Besson, <maxime.besson@worteks.com>

BUG REPORT

Use OW2 system to report bug or ask for features: https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/issues

DOWNLOAD

Lemonldap::NG is available at http://forge.objectweb.org/project/showfiles.php?group_id=274