10. Application Plugins¶
privacyIDEA comes with application plugins. These are plugins for applications like PAM, OTRS, FreeRADIUS or simpleSAMLphp which enable these application to authenticate users against privacyIDEA.
10.1. Pluggable Authentication Module¶
The PAM module of privacyIDEA directly communicates with the privacyIDEA server via the API. The PAM module also supports offline authentication. In this case you need to configure an offline machine application. (See Offline)
You can install the PAM module with a ready made debian package for Ubuntu or just use the source code file. It is a python module, that requires pam-python.
The configuration could look like this:
... pam_python.so /path/to/privacyidea_pam.py
url=https://localhost prompt=privacyIDEA_Authentication
The URL parameter defaults to https://localhost. You can also add the parameters realm= and debug.
If you want to disable certificate validation, which you should not do in a productive environment, you can use the parameter nosslverify.
The default behaviour is to trigger an online authentication request. If the request was successful, the user is logged in. If the request was done with a token defined for offline authentication, than in addition all offline information is passed to the client and cached on the client so that the token can be used to authenticate without the privacyIDEA server available.
10.2. FreeRADIUS Plugin¶
If you want to install the FreeRADIUS Plugin on Ubuntu 14.04 LTS this can be easily done, since there is a ready made package (see FreeRADIUS).
If you want to run your FreeRADIUS server on another distribution, you may download the module at [1].
Then you need to configure your FreeRADIUS site and the perl module. The latest FreeRADIUS plugin uses the /validate/check REST API of privacyIDEA.
You need to configure the perl module in FreeRADIUS modules/perl to look something like this:
perl {
module = /usr/share/privacyidea/freeradius/privacyidea_radius.pm
}
Your freeradius enabled site config should contain something like this:
authenticate {
Auth-Type Perl {
perl
}
digest
unix
}
While you define the default authenticate type to be Perl in the users file:
DEFAULT Auth-Type := Perl
Note
The perl module is not thread safe, so you need to start FreeRADIUS with the -t switch.
You can test the RADIUS setup using a command like this:
echo "User-Name=user, Password=password" | radclient -sx yourRadiusServer \
auth topsecret
Note
Do not forget to configure the clients.conf accordingly.
10.3. simpleSAMLphp Plugin¶
You can install the plugin for simpleSAMLphp on Ubuntu 14.04 LTS (see SimpleSAMLphp) or on any other distribution using the source files from [2].
Follow the simpleSAMLphp instructions to configure your authsources.php. A usual configuration will look like this:
'example-privacyidea' => array(
'privacyidea:privacyidea',
/*
* The name of the privacyidea server and the protocol
* A port can be added by a colon
* Required.
*/
'privacyideaserver' => 'https://your.server.com',
/*
* Check if the hostname matches the name in the certificate
* Optional.
*/
'sslverifyhost' => False,
/*
* Check if the certificate is valid, signed by a trusted CA
* Optional.
*/
'sslverifypeer' => False,
/*
* The realm where the user is located in.
* Optional.
*/
'realm' => '',
/*
* This is the translation from privacyIDEA attribute names to
* SAML attribute names.
*/
'attributemap' => array('username' => 'samlLoginName',
'surname' => 'surName',
'givenname' => 'givenName',
'email' => 'emailAddress',
'phone' => 'telePhone',
'mobile' => 'mobilePhone',
),
),
10.4. TYPO3¶
You can install the privacyIDEA extension from the TYPO3 Extension Repository. The privacyIDEA extension is easily configured.
privacyIDEA Server URL
This is the URL of your privacyIDEA installation. You do not need to add the path validate/check. Thus the URL for a common installation would be https://yourServer/.
Check certificate
Whether the validity of the SSL certificate should be checked or not.
Warning
If the SSL certificate is not checked, the authentication
request could be modified and the answer to the request can be modified, easily granting access to an attacker.
Enable privacyIDEA for backend users
If checked, a user trying to authenticate at the backend, will need to authenticate against privacyIDEA.
Enable privacyIDEA for frontend users
If checked, a user trying to authenticate at the frontend, will need to authenticate against privacyIDEA.
Pass to other authentication module
If the authentication at privacyIDEA fails, the credential the user entered will be verified against the next authentication module.
This can come in handy, if you are setting up the system and if you want to avoid locking yourself out.
Anyway, in a productive environment you probably want to uncheck this feature.
10.5. OTRS¶
There are two plugins for OTRS. For OTRS version 4.0 and higher user privacyIDEA-4_0.pm.
This perl module needs to be installed to the directory Kernel/System/Auth.
On Ubuntu 14.04 LTS you can also install the module using the PPA repository and installing:
apt-get install privacyidea-otrs
To activate the OTP authentication you need to add the following to Kernel/Config.pm:
$Self->{'AuthModule'} = 'Kernel::System::Auth::privacyIDEA';
$Self->{'AuthModule::privacyIDEA::URL'} = \
"https://localhost/validate/check";
$Self->{'AuthModule::privacyIDEA::disableSSLCheck'} = "yes";
Note
As mentioned earlier you should only disable the checking of the SSL certificate if you are in a test environment. For productive use you should never disable the SSL certificate checking.
Note
This plugin requires, that you also add the path validate/check to the URL.
10.6. Further plugins¶
You can find further plugins for Dokuwiki, Wordpress, Contao and Django at [4].
| [1] | https://github.com/privacyidea/privacyidea/tree/master/authmodules/FreeRADIUS |
| [2] | https://github.com/privacyidea/privacyidea/tree/master/authmodules/simpleSAMLphp |
| [3] | https://github.com/privacyidea/privacyidea/tree/master/authmodules |
| [4] | https://github.com/cornelinux?tab=repositories |
