/ 
Lemonldap-NG-Handler-1.2.2
/ Lemonldap::NG::Handler::ZimbraPreAuth
Security Advisories (2)
CVE-2020-16093 (2022-07-18)

In LemonLDAP::NG (aka lemonldap-ng) through 2.0.8, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used.

CVE-2020-24660 (2020-09-14)

An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. An attacker may bypass URL-based access control to protected Virtual Hosts by submitting a non-normalized URI. This also affects versions before 0.5.2 of the "Lemonldap::NG handler for Node.js" package.

NAME

Lemonldap::NG::Handler::ZimbraPreAuth - Perl extension to generate Zimbra preauth URL for users authenticated by Lemonldap::NG

SYNOPSIS

package My::Zimbra;
use Lemonldap::NG::Handler::ZimbraPreAuth;
@ISA = qw(Lemonldap::NG::Handler::ZimbraPreAuth);

__PACKAGE__->init ( {

  # Zimbra parameters
  zimbraPreAuthKey => 'XXXX',
  zimbraAccountKey => 'uid',
  zimbraBy         => 'id',
  zimbraUrl        => '/service/preauth',
  zimbraSsoUrl     => '^/zimbrasso$',

  # Common parameters
  timeout          => '72000',

  # See Lemonldap::NG::Handler for more

} );
1;

DESCRIPTION

Edit you Zimbra vhost configuration like this:

<VirtualHost *> ServerName zimbra.example.com

# Load Zimbra Handler
PerlRequire __HANDLERDIR__/MyHandlerZimbra.pm
	PerlHeaderParserHandler My::Zimbra

</VirtualHost>

EXPORT

See Lemonldap::NG::Handler

SEE ALSO

http://wiki.zimbra.com/wiki/Preauth Lemonldap::NG::Handler

AUTHOR

Clement Oudot, <clement@oodo.net>

COPYRIGHT AND LICENSE

Copyright (C) 2010 by Clement Oudot

This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself, either Perl version 5.10.0 or, at your option, any later version of Perl 5 you may have available.