---
name: "Lemonldap::NG::Portal::Main::Issuer"
section: "3pm"
platform: "linux"
package: "liblemonldap-ng-portal-perl"
version: "2.21.2+ds-1+deb13u3"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/Lemonldap::NG::Portal::Main::Issuer"
---

# Lemonldap::NG::Portal::Main::Issuer(3pm)

Base class for identity providers.

## NAME

Lemonldap::NG::Portal::Main::Issuer - Base class for identity providers.

## SYNOPSIS

```
  package Lemonldap::NG::Portal::Issuer::My;
  use strict;
  use Mouse;
  extends 'Lemonldap::NG::Portal::Main::Issuer';
  use Lemonldap::NG::Portal::Main::Constants qw(PE_OK);
  # Required: URL root path
  use constant path => 'saml';

  # Optional initialization method
  sub init {
      my ($self) = @_;
      ...
      # Must return 1 (succeed) or 0 (failure)
  }

  # Required methods are run() and logout(), they are launched only for
  # authenticated users
  # $req is a Lemonldap::NG::Portal::Main::Request object
  # They must return a Lemonldap::NG::Portal::Main::Constants constant
  sub run {
      my ( $self, $req ) = @_
      ...
      return PE_OK
  }

  sub logout {
      my ( $self, $req ) = @_
      ...
      return PE_OK
  }
  1;
```

## DESCRIPTION

Lemonldap::NG::Portal::Main::Issuer is a base class to write identity providers for Lemonldap::NG web-SSO system. It provide several methods to write easily an IdP and manage authentication if the identity request comes before authentication.

## WRITING AN IDENTITY PROVIDER

To write a classic identity provider, you just have to inherit this class and write **run()** and **logout()** methods. These methods must return a Lemonldap::NG::Portal::Main::Constants constant.

A classic identity provider needs a "issuerDB\>XXX\<Path" parameter in LLNG configuration to declare its base URI path (see Lemonldap::NG::Manager::Build). Example: /saml/. All requests that starts with /saml/ will call **run()** after authentication if needed, and no one else.

The **logout()** function is called when user asks for logout on this server. If you want to write an identity provider, you must implement a single logout system.

### managing other URI path

Lemonldap::NG::Portal::Main::Issuer provides methods to bind a method to an URI path:

- **addAuthRoute()** for authenticated users

  - **addUnauthRoute()** for unauthenticated users

  They must be called during initialization process (so you must write the optional **init()** sub).

Be careful with `"add*authRoute()"`: you can't catch here your root path (= path declared in `"$self->path"`) because it is caught by this module, but you can catch sub-routes (ie `"/path/something"`).

Example:

```
  sub init {
      my ($self) = @_;
      ...
      $self->addUnauthRoute( saml => { soap => 'soapServer' }, [ 'POST' ] );
      return 1;
  }
  sub soapServer {
      my ( $self, $req ) = @_;
      ...
      # You must return a valid PSGI response
      return [ 200, [ 'Content-Type' => 'application/xml' ], [] ];
  }
```

### avoid conflicts in path

If you share base URI path with another plugin (a `"Auth::*"` module for example), it is recommended to write a `"ssoMatch"` function that returns true if `"$req->uri"` has to be handled by Issuer module. See `"Issuer::SAML"` or `"Issuer::OpenIDConnect"` to have some examples.

## SEE ALSO

\<http://lemonldap-ng.org/\>

## AUTHORS

- LemonLDAP::NG team \<http://lemonldap-ng.org/team\>

  ## BUG REPORT

Use OW2 system to report bug or ask for features: \<https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/issues\>

## DOWNLOAD

Lemonldap::NG is available at \<https://lemonldap-ng.org/download\>

## COPYRIGHT AND LICENSE

See COPYING file for details.

This library is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program.  If not, see \<http://www.gnu.org/licenses/\>.