/ 
Lemonldap-NG-Handler-0.92
/ Lemonldap::NG::Handler::SympaAutoLogin
Security Advisories (2)
CVE-2020-16093 (2022-07-18)

In LemonLDAP::NG (aka lemonldap-ng) through 2.0.8, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used.

CVE-2020-24660 (2020-09-14)

An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. An attacker may bypass URL-based access control to protected Virtual Hosts by submitting a non-normalized URI. This also affects versions before 0.5.2 of the "Lemonldap::NG handler for Node.js" package.

NAME

Lemonldap::NG::Handler::SympaAutoLogin - Perl extension to generate Sympa cookie for users authenticated by Lemonldap::NG

SYNOPSIS

package My::Package;
use Lemonldap::NG::Handler::SympaAutoLogin;
@ISA = qw(Lemonldap::NG::Handler::SharedConf);

__PACKAGE__->init ( {
  # See Lemonldap::NG::Handler for more
  # Local storage used for sessions and configuration
  localStorage        => "Cache::DBFile",
  localStorageOptions => {...},
  # How to get my configuration
  configStorage       => {
      type                => "DBI",
      dbiChain            => "DBI:mysql:database=lemondb;host=$hostname",
      dbiUser             => "lemonldap",
      dbiPassword         => "password",
  }
  # Uncomment this to activate status module
  # status                => 1,
} );

DESCRIPTION

Lemonldap::NG::Handler::SympaAutoLogin is a special Lemonldap::NG handler that generates Sympa cookie for authenticated users. Use it instead of classic Lemonldap::NG::Handler to protect your Sympa web server. You have to set a header called "mail" in the Lemonldap::NG manager for this virtul host and to store Sympa secret (cookie parameter on Sympa configuration file) ina file called /etc/lemonldap-ng/sympa.secret. It has just to be readable by root (the owner that launch Apache).

EXPORT

See Lemonldap::NG::Handler

SEE ALSO

Lemonldap::NG::Handler

AUTHOR

Xavier Guimard, <x.guimard@free.fr>

COPYRIGHT AND LICENSE

Copyright (C) 2009 by Xavier Guimard

This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself, either Perl version 5.10.0 or, at your option, any later version of Perl 5 you may have available.