Changes between Version 3 and Version 4 of campuswifiandeduroam2023Agenda/pwdc

Timestamp:

Jul 22, 2024, 6:16:20 AM (4 months ago)

Author:

tuwan

Comment:

--

campuswifiandeduroam2023Agenda/pwdc

@@ -106 +106 @@
 }}}
 
+'''Graphics'''
 
+You change the default logo with your own
+
+{{{$logo = "images/ltb-logo.png";}}}
+
+You change the background image with your own
+
+{{{$background_image = "images/unsplash-space.jpeg";}}}
+
+To easily customize CSS
+
+{{{$custom_css = "css/custom.css";}}}
+
+You can hide the footer bar
+
+{{{$display_footer = false;}}}
+
+'''Debug'''
+
+{{{$debug = true;}}}
+
+{{{$smarty_debug = true;}}}
+
+'''Security'''
+
+You need a key phrase if you use ciphered tokens
+
+{{{$keyphrase = "secret";}}}
+
+There is also a protection on login to avoid LDAP injections. Some characters are forbidden, you can change the list of forbidden characters in login
+
+{{{$login_forbidden_chars = "*()&|";}}}
+
+For the reset process via mail token and send sms token, errors are hidden by default, to avoid account disclosure
+
+{{{
+$obscure_usernotfound_sendtoken = true;
+$obscure_notfound_sendsms = true;
+}}}
+
+'''LDAP Connection'''
+
+Server address
+
+Use an LDAP URI to configure the location of your LDAP server
+
+{{{$ldap_url = "ldap://localhost:389";}}}
+
+To use SSL
+
+{{{$ldap_url = "ldaps://localhost";}}}
+
+To use StartTLS, set true in $ldap_starttls
+
+{{{$ldap_starttls = true;}}}
+
+//Note://
+//LDAP certificate management in PHP relies on LDAP system libraries. Under Linux, you can configure /etc/ldap.conf (or /etc/ldap/ldap.conf on Debian or Ubuntu, or C:\OpenLDAP\sysconf\ldap.conf for Windows).//
+
+- Provide the certificate from the certificate authority that issued your LDAP server’s certificate
+{{{TLS_CACERT /etc/ssl/ca.crt}}}
+
+Or, disable server certificate checking:
+
+{{{TLS_REQCERT allow}}}
+
+If you face issues with non matching TLS versions between SSP and your LDAP server, you should try to modify TLS_CIPHER_SUITE to match the requirements of your server. For example:
+
+{{{TLS_CIPHER_SUITE TLSv1+RSA}}}
+
+You can also define the ldap connection timeout:
+
+{{{$ldap_network_timeout = true;}}}
+
+'''Credentials'''
+
+Configure DN and password in $ldap_bindn and $ldap_bindpw, for example a service account
+
+{{{
+$ldap_binddn = "cn=ssp,ou=dsa,dc=example,dc=com";
+
+$ldap_bindpw = "secret";
+}}}
+
+To instead use user’s credentials when writing in LDAP directory, replace manager with user in $who_change_password
+
+{{{
+$who_change_password = "user";
+}}}