OBM

Presentation

OBM is enterprise-class messaging and collaboration platform for workgroup or enterprises with many thousands users. OBM includes Groupware, messaging server, CRM, LDAP, Windows Domain, smartphone and PDA synchronization…

OBM is shipped with a LL::NG plugin with these features:

  • SSO on OBM web interface
  • Logout
  • User provisioning (account auto creation at first connection)

Configuration

OBM

To enable LL::NG authentication plugin, go in /etc/obm/obm_conf.inc:

$auth_kind = 'LemonLDAP';
 
$lemonldap_config = Array(
                "auto_update"           => true,
                "auto_update_force_user" => true,
                "auto_update_force_group" => false,
                "url_logout"            => "https://OBMURL/logout",
                "server_ip_address"     => "localhost",
                "server_ip_check"       => false,
                "debug_level"           => "NONE",
//                "debug_header_name"     => "HTTP_OBM_UID",
//                "group_header_name"     => "HTTP_OBM_GROUPS",
                "headers_map"           => Array(
                        //"userobm_gid"                   => "HTTP_OBM_GID",
                        //"userobm_domain_id"           => ,
                        "userobm_login"                 => "HTTP_OBM_UID",
                        "userobm_password"              => "HTTP_OBM_USERPASSWORD",
                        //"userobm_password_type"       => ,
                        "userobm_perms"                 => "HTTP_OBM_PERMS",
                        //"userobm_kind"                => ,
                        "userobm_lastname"              => "HTTP_OBM_SN",
                        "userobm_firstname"             => "HTTP_OBM_GIVENNAME",
//                        "userobm_title"                 => "HTTP_OBM_TITLE",
                        "userobm_email"                 => "HTTP_OBM_MAIL",
                        "userobm_datebegin"             => "HTTP_OBM_DATEBEGIN",
                        //"userobm_account_dateexp"     => ,
                        //"userobm_delegation_target"   => ,
                        //"userobm_delegation"          => ,
                        "userobm_description"           => "HTTP_OBM_DESCRIPTION",
                        //"userobm_archive"             => ,
                        //"userobm_hidden"              => ,
                        //"userobm_status"              => ,
                        //"userobm_local"               => ,
                        //"userobm_photo_id"            => ,
                        "userobm_phone"                 => "HTTP_OBM_TELEPHONENUMBER",
                        //"userobom_phone2"             => ,
                        //"userobm_mobile"              => ,
                        "userobm_fax"                   => "HTTP_OBM_FACSIMILETELEPHONENUMBER",
                        //"userobm_fax2"                => ,
                        "userobm_company"               => "HTTP_OBM_O",
                        //"userobm_direction"           => ,
                        "userobm_service"               => "HTTP_OBM_OU",
                        "userobm_address1"              => "HTTP_OBM_POSTALADDRESS",
                        //"userobm_address2"            => ,
                        //"userobm_address3"            => ,
                        "userobm_zipcode"               => "HTTP_OBM_POSTALCODE",
                        "userobm_town"                  => "HTTP_OBM_L",
                        "userobm_zipcode"               => "HTTP_OBM_POSTALCODE",
                        "userobm_town"                  => "HTTP_OBM_L",
                        //"userobm_expresspostal"       => ,
                        //"userobm_host_id"             => ,
                        //"userobm_web_perms"           => ,
                        //"userobm_web_list"            => ,
                        //"userobm_web_all"             => ,
                        //"userobm_mail_perms"          => ,
                        //"userobm_mail_ext_perms"      => ,
                        //"userobm_mail_server_id"      => ,
                        //"userobm_mail_server_hostname" => ,
                        "userobm_mail_quota"            => "HTTP_OBM_MAILQUOTA",
                        //"userobm_nomade_perms"        => ,
                        //"userobm_nomade_enable"       => ,
                        //"userobm_nomade_local_copy"   => ,
                        //"userobm_email_nomade"        => ,
                        //"userobm_vacation_enable"     => ,
                        //"userobm_vacation_datebegin"  => ,
                        //"userobm_vacation_dateend"    => ,
                        //"userobm_vacation_message"    => ,
                        //"userobm_samba_perms"         => ,
                        //"userobm_samba_home"          => ,
                        //"userobm_samba_home_drive"    => ,
                        //"userobm_samba_logon_script"  => ,
                        // ---- Unused values ? ----
                        "userobm_ext_id"                => "HTTP_OBM_SERIALNUMBER",
                        //"userobm_system"              => ,
                        //"userobm_nomade_datebegin"    => ,
                        //"userobm_nomade_dateend"      => ,
                        //"userobm_location"            => ,
                        //"userobm_education"           => ,
                        ),
        );

Parameters:

  • url_logout: URL used by OBM to logout, will be caught by LL::NG
  • headers_map: map OBM internal field to LL::NG header

Edit also OBM configuration to enable LL::NG Handler:

  • For Apache:
<VirtualHost *:80>
    ServerName obm.example.com
 
    # SSO protection
    PerlHeaderParserHandler Lemonldap::NG::Handler
 
    DocumentRoot /usr/share/obm/php
 
    ...
 
</VirtualHost>
  • For Nginx:
server {
  listen 80;
  server_name obm.example.com;
  root /usr/share/obm/php;
  # Internal authentication request
  location = /lmauth {
    internal;
    include /etc/nginx/fastcgi_params;
    fastcgi_pass unix:/var/run/llng-fastcgi-server/llng-fastcgi.sock;
    # Drop post datas
    fastcgi_pass_request_body  off;
    fastcgi_param CONTENT_LENGTH "";
    # Keep original hostname
    fastcgi_param HOST $http_host;
    # Keep original request (LLNG server will received /llauth)
    fastcgi_param X_ORIGINAL_URI  $request_uri;
  } 
 
  # Client requests
  location ~ \.php$ {
    auth_request /lmauth;
    auth_request_set $lmremote_user $upstream_http_lm_remote_user;
    auth_request_set $lmlocation $upstream_http_location;
    error_page 401 $lmlocation;
    try_files $uri $uri/ =404;
 
    ...
 
    include /etc/lemonldap-ng/nginx-lua-headers.conf;
  }
  location / {
    try_files $uri $uri/ =404;
  }
}

LL::NG

Attributes and macros

You will need to collect all attributes needed to create a user in OBM, this includes:

  • First name
  • Last name
  • Login
  • Mail

To add these attributes, go in Manager, Variables » Exported Variables.

If you plan to forward user's password to OBM, then you have to keep the password in session.

You may also create these macros to manage OBM administrator account (Variables » Macros):

field value
uidR ($uid =~ /^admin0/i)[0] ? "admin0\@global.virt" : $uid
mailR ($uid =~ /^admin0/i)[0] ? "" : ($mail =~ /^([^@]+)/)[0] . "\@example.com"

Virtual host

Create OBM virtual host (for example obm.example.com) in LL::NG configuration: Virtual Hosts » New virtual host.

Then edit rules and headers.

Rules

Define at least:

  • Default rule: who can access to the application
  • Logout rule: catch OBM logout
  • Exceptions: allow anonymous access for specific URLs (connectors, etc.)
field value
^/logoutlogout_sso
^/obm-syncunprotect
^/minigunprotect
^/Microsoft-Server-ActiveSyncunprotect
^/caldavunprotect
defaultaccept (or whatever you want)
Headers

Define headers used in OBM mapping, for example:

field valeur
OBM_GIVENNAME$givenName
OBM_GROUPS$groups
OBM_UID$uidR
OBM_MAIL$mailR
OBM_USERPASSWORD$_password

Other

Do not forget to add OBM in applications menu.