Events management

LemonLDAP::NG has two kinds of events to propagate between its nodes:

  • configuration updates

  • session logout

By default, events aren’t really propagated but a timer permits to refresh such data.

If you want immediate propagation, LemonLDAP::NG includes an optional PUB/SUB system (not enabled by default) to replace this timers. This isn’t useful in classic deployments but may help big ones.

Default events system

Session reload

The default LemonLDAP::NG cache system keeps in memory sessions during 10mn, sessions are automatically refreshed after this delay.

Configuration reload

After configuration is saved by Manager, LemonLDAP::NG will automatically reload the configuration after a few seconds.

The reload will happen next time a request is processed if more than checkTime (default: 1) and checkMsg (default: 5) seconds have passed since the last check.

Using a Pub/Sub system

The message broker system replaces the previous system using an external Pub/Sub system.

When enabled, all LemonLDAP::NG process subscribe to llng_events channel which propagate “events”:

  • configution update (newConf)

  • logouts (unlog)

Such messages are read every 5 seconds, then logout and configuration updates are propagated in this delay. To modify this delay (10 seconds for example), set checkMsg=10 inside lemonldap-ng.ini, section [all].

To configure the event system, go into “General Parameters » Advanced parameters » Events Management” and set Pub/Sub system to Redis, PostgreSQL or MQTT.

Then set into “Pub/Sub system options” the needed options depending on the chosen system (see below).

Note

The corresponding parameter inside lemonldap-ng.ini is messageBroker which takes as value: ::Redis or ::Pg or ::MQTT (which are abbreviations of Lemonldap::NG::Common::MessageBroker::<name>).

Options take place into messageBrokerOptions parameter.

Redis

See Redis options,

Example:

server => "redis.example.com:6379"

PostgreSQL

The following parameters are needed:

  • dbiChain: see DBD::Pg to know the syntax

  • dbiUser: the username to use to connect

  • dbiPassword: the password to use to connect

Example:

dbiChain    => "dbi:Pg:dbname=llng;host=localhost;port=5432",
dbiUser     => "llng",
dbiPassword => "llng",

MQTT

The following parameter can be set:

If ssl is set then these parameters are allowed:

  • user: usernane to use for login

  • password: password to use for login

  • SSL_ca_file: file with certificate authorities (PEM encoded)

  • SSL_cert_file: client certificate

  • SSL_key_file: client private key

If ssl is set then these environment variables can be used also:

  • MQTT_SIMPLE_SSL_INSECURE: Set to something other than 0 to disable SSL validation

  • MQTT_SIMPLE_SSL_CA: Path to the CA certificate or a directory of certificates. IO::Socket::SSL can find the CA path automatically on some systems.

  • MQTT_SIMPLE_SSL_CERT: Path to the client certificate file.

  • MQTT_SIMPLE_SSL_KEY: Path to the client private key file.

Web

LemonLDAP::NG provide a light pub/sub server, named llng-pubsub-server, designed to be used to manage LemonLDAP::NG events.

To use it, configure the message broker:

  • server (default: ``localhost:8080``). To enable SSL, use https://server:port

  • token: optional token to be set if the server requires a token

When SSL is enabled, the server certificate is verified. These parameters are allowed:

  • SSL_ca_file: file with certificate authorities (PEM encoded), to verify the server certificate

  • SSL_verify_mode: set to 0 to disable the server certificate verification, for example when the pub/sub server is on a private network with a self-signed certificate. The token is then sent to any server that answers, use it only on a trusted network.

Other IO::Socket::SSL SSL_* options (SSL_ca_path, SSL_cert_file, SSL_key_file…) can also be set. The SSL_* options of lwpSslOpts are also used; the message broker options override them.

Changed in version 2.24.0: The server certificate was not verified by the subscriber connection.

You can find llng-pubsub-server documentation into its manpage.