NAME

       Lemonldap::NG::Portal::Main::Issuer - Base class for identity providers.

SYNOPSIS

         package Lemonldap::NG::Portal::Issuer::My;
         use strict;
         use Mouse;
         extends 'Lemonldap::NG::Portal::Main::Issuer';
         use Lemonldap::NG::Portal::Main::Constants qw(PE_OK);

         # Required: URL root path
         use constant path => 'saml';

         # Optional initialization method
         sub init {
             my ($self) = @_;
             ...
             # Must return 1 (succeed) or 0 (failure)
         }

         # Required methods are run() and logout(), they are launched only for
         # authenticated users
         # $req is a Lemonldap::NG::Portal::Main::Request object
         # They must return a Lemonldap::NG::Portal::Main::Constants constant
         sub run {
             my ( $self, $req ) = @_
             ...
             return PE_OK
         }

         sub logout {
             my ( $self, $req ) = @_
             ...
             return PE_OK
         }
         1;

DESCRIPTION

       Lemonldap::NG::Portal::Main::Issuer is a base class to write identity providers for Lemonldap::NG web-SSO
       system. It provide several methods to write easily an IdP and manage authentication if the identity
       request comes before authentication.

WRITING AN IDENTITY PROVIDER

       To write a classic identity provider, you just have to inherit this class and write run() and logout()
       methods. These methods must return a Lemonldap::NG::Portal::Main::Constants constant.

       A classic identity provider needs a "issuerDB>XXX<Path" parameter in LLNG configuration to declare its
       base URI path (see Lemonldap::NG::Manager::Build). Example: /saml/. All requests that starts with /saml/
       will call run() after authentication if needed, and no one else.

       The logout() function is called when user asks for logout on this server. If you want to write an
       identity provider, you must implement a single logout system.

   managing other URI path
       Lemonldap::NG::Portal::Main::Issuer provides methods to bind a method to an URI path:

       addAuthRoute() for authenticated users
       addUnauthRoute() for unauthenticated users

       They must be called during initialization process (so you must write the optional init() sub).

       Be careful with "add*authRoute()": you can't catch here your root path (= path declared in "$self->path")
       because it is caught by this module, but you can catch sub-routes (ie "/path/something").

       Example:

         sub init {
             my ($self) = @_;
             ...
             $self->addUnauthRoute( saml => { soap => 'soapServer' }, [ 'POST' ] );
             return 1;
         }
         sub soapServer {
             my ( $self, $req ) = @_;
             ...
             # You must return a valid PSGI response
             return [ 200, [ 'Content-Type' => 'application/xml' ], [] ];
         }

   avoid conflicts in path
       If you share base URI path with another plugin (a "Auth::*" module for example), it is recommended to
       write a "ssoMatch" function that returns true if "$req->uri" has to be handled by Issuer module. See
       "Issuer::SAML" or "Issuer::OpenIDConnect" to have some examples.

SEE ALSO

       <http://lemonldap-ng.org/>

AUTHORS

       LemonLDAP::NG team <http://lemonldap-ng.org/team>

BUG REPORT

       Use OW2 system to report bug or ask for features:
       <https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/issues>

DOWNLOAD

       Lemonldap::NG is available at <https://lemonldap-ng.org/download>

COPYRIGHT AND LICENSE

       See COPYING file for details.

       This library is free software; you can redistribute it and/or modify it under the terms of the GNU
       General Public License as published by the Free Software Foundation; either version 2, or (at your
       option) any later version.

       This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even
       the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public
       License for more details.

       You should have received a copy of the GNU General Public License along with this program.  If not, see
       <http://www.gnu.org/licenses/>.