NAME¶

Jifty::Plugin::AuthzLDAP - Jifty plugin to a add dynamic ldap authorization

DESCRIPTION¶

Jifty plugin. Provide ldap authorization with filters table and cache.

CONFIGURATION NOTES¶

in etc/config.yml
Plugins:
- AuthzLDAP:
LDAPbind: cn=testldap,ou=admins,dc=myorg,dc=org #
LDAPpass: test # password
LDAPhost: ldap.myorg.org # ldap host
LDAPbase: ou=people,dc=myorg.. # ldap base
LDAPuid: uid # optional
CacheTimout: 20 # minutes, optional, default 20 minutes in application create a LDAPFilter model
use base qw/Jifty::Plugin::AuthzLDAP::Model::LDAPFilter/; in LDAPFilter model create your filters, something like
name |filter |is_group
is_admin|(!eduPersonAffiliation=STUDENT)|0
in_admin|cn=admin,ou=groups,dc=my.org |1 to protect access to /admin in "TestApp" application create a lib/TestApp/Dispatcher.pm

    use strict;
    use warnings;
    package TestApp::Dispatcher;
    use Jifty::Dispatcher -base;
    before '/admin/*' => run {
       # Authentication
       Jifty->web->tangent(url => '/login')
            if (! Jifty->web->current_user->id);
       # Authorization
       my $user = Jifty->web->current_user->user_object->name;
       Jifty->web->tangent(url => '/error/AccessDenied')
            if (! Jifty::Plugin::AuthzLDAP->ldapvalidate($user,'is_admin') );
    };
    1

SEE ALSO¶

Net::LDAP

METHODS¶

init¶

load config parameters, connect to ldap, create memory cache

BASE CACHE DN LDAP BASE UID PASS LDAPFilterClass¶

accesors to conf parametres

bind¶

Bind to ldap

ldapvalidate NAME FILTERNAME¶

return 1 if NAME validate FILTER or NAME-FILTERNAME in cache else return 0 If FILTERNAME is flagged as is_group, search if user is uniquemember of this group as supported by the Netscape Directory Server

AUTHOR¶

Yves Agostini, <yvesago@cpan.org>

LICENSE¶

Copyright 2007-2009 Yves Agostini. All Rights Reserved. This program is free software and may be modified and distributed under the same terms as Perl itself.