Upgrade from 2.0.x to 2.0.y¶
Please apply general caution as you would with any software: have backups and a rollback plan ready!
Danger
If you have
installed LemonLDAP::NG from official RPMs, you may
run into bug
#1757
and lose your Apache configuration files while updating from
LemonLDAP::NG 2.0.0 or 2.0.1 to later versions. Please backup your
/etc/httpd/conf.d/z-lemonldap-ng-*.conf
files before the
update.
2.0.9¶
Bad default value to display OIDC Consents tab has been fixed. The default value is now:
$_oidcConsents && $_oidcConsents =~ /\w+/
Some user log messages have been modified, check logs documentation (see also #2244)
SAML SOAP calls are now using
text/xml
instead ofapplication/xml
as the MIME Content Type, as required by the SOAP standardIncremental lock times values can now be set in BruteForceProtection plugin through Manager. It must be a list of comma separated values. Default values are
5, 15, 60, 300, 600
Cookie issues with Chrome¶
This release fixes several issues related to the change in SameSite cookie
policy for Google Chrome users. The new default value of the SameSite
configuration parameter will set SameSite to Lax
unless you are using SAML,
in which case it will be set to None
.
This means that from now on, any LemonLDAP::NG installation using SAML must be
served over HTTPS, as SameSite None
value requires the Secure
flag in cookie.
Change in default cache directory¶
The default config/session cache directory has been moved from /tmp
to
/var/cache/lemonldap-ng
in order to avoid issues with cache purges when using
Systemd. This change is only applied to new installations. If your
installation is experiencing cache purge issues, you need to manually change
your existing localSessionStorageOptions/cache_root
parameter from /tmp
to /var/cache/lemonldap-ng
. Be sure to create this directory on your
file system before modifying your configuration.
Required changes in NGINX handler rules (CVE-2020-24660)¶
We discovered a vulnerability that affects LemonLDAP::NG installations when ALL of the following criteria apply:
You are using the LemonLDAP::NG Handler to protect applications
Your handler server uses Nginx
Your virtual host configuration contains per-URL access rules based on regular expressions in addition to the built-in default access rule.
Note
You are safe from this vulnerability if your virtualhost only uses a regexp-based rule to trigger logout
If you are in this situation, you need to modify all your handler-protected virtualhosts by making the following change:
Replace
fastcgi_param X_ORIGINAL_URI $request_uri
byfastcgi_param X_ORIGINAL_URI $original_uri
if you are using FastCGIReplace
uwsgi_param X_ORIGINAL_URI $request_uri
byuwsgi_param X_ORIGINAL_URI $original_uri
if you are using uWSGIRight after
auth_request /lmauth;
, add the following lineset $original_uri $uri$is_args$args;
You can check the Manage virtual hosts page for more information
LDAP certificate validation (CVE-2020-16093)¶
LDAP server certificates were previously not verified by default when using secure transports (LDAPS or TLS), see CVE-2020-16093. Starting from this release, certificate validation is now enabled by default, including on existing installations.
If you have configured your CA certificates incorrectly, LemonLDAP::NG will now start complaining about invalid certificates. You may temporarily disable it again with the following command
/your/path/to/lemonldap-ng-cli set ldapVerify none
If you use LDAP as a configuration storage, and want to temporarily disable certificate validation, you must make the following addition to /etc/lemonldap-ng/lemonldap-ng.ini
[configuration]
...
ldapVerify = none
If you use LDAP as a session backend, you are strongly encouraged to also upgrade corresponding Apache::Session
modules (Apache::Session::LDAP
or Apache::Session::Browseable
). After this upgrade, if you want to temporarily disable certificate validation, you can add the following parameter to the list of Apache::Session module options:
key:
ldapVerify
value:
none
Please note that it is HIGHLY recommended to set certificate validation to require when contacting LDAP servers over a secure transport to avoid man-in-the-middle attacks.
2.0.8¶
New dependency: Perl module Time::Fake is now required to run unit test and build packages, but should not be mandatory to run the software.
Nginx configuration: some changes are required to allow IPv6, see #2152
Option
singleSessionUserByIP
was removed, see #2159A memory leak was found in perl-fcgi with Perl < 5.18, a workaround is possible with Apache and llng-fastcgi-server, see #1314
With Apache: set
FcgidMaxRequestsPerProcess 500
in portal virtual hostWith llng-fastcgi-server: set
PM_MAX_REQUESTS=500
in llng-fastcgi-server service configuration
Cookie
SameSite
value: to avoid problems with recent browsers, SAML POST binding, LLNG cookies are now tagged as “SameSite=None”. You can change this value using manager, “SameSite=Lax” is best for installations without federations. Important note: if you’re using an unsecured connection (http:// instead of https://), “SameSite=None” will be ignored by browsers and users that already have a valid session might be prompted to login again.OAuth2.0 Handler: a VHost protected by the OAuth2.0 handler will now return a 401 when called without an Access Token, instead of redirecting to the portal, as specified by RFC6750
If you encounter the following issue:
AH01630: client denied by server configuration: /usr/share/lemonldap-ng/manager/api/api.fcgi
when trying to access the portal. It probably comes from incorrect Apache configuration. Remove the (optional and disabled by default) manager API config:
rm /etc/httpd/conf.d/z-lemonldap-ng-api.conf && systemctl reload httpd
2.0.7¶
Security:
#2040: Configuration of a redirection URI for an OpenID Connect Relying Party is now mandatory, as defined in the specifications. If you save your configuration, you will have an error if some of your RP don’t have a redirect URI configured.
#1943 / CVE-2019-19791: along with the patch provided in 2.0.7 in
Lemonldap/NG/Common/PSGI/Request.pm
, Apache rewrite rule must be updated to avoid an unprotected access to REST services:
portal-apache2.conf
RewriteCond "%{REQUEST_URI}" "!^/(?:(?:static|javascript|favicon).*|.*\.fcgi(?:/.*)?)$"
RewriteRule "^/(.+)$" "/index.fcgi/$1" [PT]
manager-apache2.conf
RewriteCond "%{REQUEST_URI}" "!^/(?:static|doc|lib|javascript|favicon).*"
RewriteRule "^/(.+)$" "/manager.fcgi/$1" [PT]
Other:
Option
checkTime
was enabled by default inlemonldap-ng.ini
, this let the portal check the configuration immediately instead of waiting for configuration cache expiration. You can keep this option enabled unless you need strong performances.
Removed parameters:
samlIdPResolveCookie
2.0.6¶
Option was added to display generate password box in password reset by mail plugin. If you use this feature, you must enable this option, which is disabled by default.
If you use the default _whatToTrace macro and a case insensitive authentication backend, then a user can generate several persistent sessions for the same login (see issue 1869). This can lead to a security bug if you enabled 2FA, which rely on data stored in the persistent session. To fix this, either choose a unique attribute for _whatToTrace, either force lower case in your macro:
$_auth eq 'SAML' ? lc($_user.'@'.$_idpConfKey) : $_auth eq 'OpenIDConnect' ? lc($_user.'@'.$_oidc_OP) : lc($_user)
On CentOS 7 / RHEL 7, a system upgrade breaks ImageMagick, which is used to display captchas (see #1951). To fix this, you can run the following commands:
yum install -y urw-base35-fonts-legacy
sed 's,/usr/share/fonts/default/Type1/,/usr/share/X11/fonts/urw-fonts/,g' -i /etc/ImageMagick/type-ghostscript.xml
2.0.5¶
The Text::Unidecode perl module becomes a requirement (it will be automatically installed if you upgrade from from the deb or RPM repositories)
CAS logout starts validating the service= parameter, but only if you use the CAS Access control policy. The URL sent in the service= parameter will be checked against known CAS applications, Virtual Hosts, and trusted domains. Add your target domain to trusted domains if you suddenly start having “Invalid URL” messages on logout
Improvements in cryptographic functions: to take advantage of them, you must change the encryption key of LemonLDAP::NG (see CLI example).
Debian packaging: FastCGI / uWsgi servers require llng-lmlog.conf and llng-lua-headers.conf. Those configuration files are now provided by lemonldap-ng-handler package and installed in /etc/nginx/snippets directory.