NAME

       Jifty::Plugin::AuthzLDAP - Jifty plugin to a add dynamic ldap authorization

DESCRIPTION

       Jifty plugin.  Provide ldap authorization with filters table and cache.

CONFIGURATION NOTES

       in etc/config.yml
         Plugins:
           - AuthzLDAP:
              LDAPbind: cn=testldap,ou=admins,dc=myorg,dc=org #
              LDAPpass: test                   # password
              LDAPhost: ldap.myorg.org         # ldap host
              LDAPbase: ou=people,dc=myorg..   # ldap base
              LDAPuid: uid                     # optional
              CacheTimout: 20                  # minutes, optional, default 20 minutes

       in application create a LDAPFilter model
               use base qw/Jifty::Plugin::AuthzLDAP::Model::LDAPFilter/;

       in LDAPFilter model create your filters, something like
        name    |filter                         |is_group
        is_admin|(!eduPersonAffiliation=STUDENT)|0
        in_admin|cn=admin,ou=groups,dc=my.org   |1

       to protect access to /admin in "TestApp" application create a lib/TestApp/Dispatcher.pm

           use strict;
           use warnings;

           package TestApp::Dispatcher;
           use Jifty::Dispatcher -base;

           before '/admin/*' => run {
              # Authentication
              Jifty->web->tangent(url => '/login')
                   if (! Jifty->web->current_user->id);
              # Authorization
              my $user = Jifty->web->current_user->user_object->name;
              Jifty->web->tangent(url => '/error/AccessDenied')
                   if (! Jifty::Plugin::AuthzLDAP->ldapvalidate($user,'is_admin') );
           };

           1

SEE ALSO

       Net::LDAP

METHODS

   init
       load config parameters, connect to ldap, create memory cache

   BASE CACHE DN  LDAP BASE UID PASS LDAPFilterClass
       accesors to conf parametres

   bind
       Bind to ldap

   ldapvalidate NAME FILTERNAME
       return 1 if NAME validate FILTER or NAME-FILTERNAME in cache else return 0

       If FILTERNAME is flagged as is_group, search if user is uniquemember of this group as
       supported by the Netscape Directory Server

AUTHOR

       Yves Agostini, <yvesago@cpan.org>

LICENSE

       Copyright 2007-2009 Yves Agostini. All Rights Reserved.

       This program is free software and may be modified and distributed under the same terms as
       Perl itself.