The Secure Token Handler is a special Handler that creates a token for each request and send it to the protected application. The real user identifier is stored in a Memcached server and the protected application can request the Memcached server to get user identifier.
This mechanism allows one to protect an application with an unsafe link between Handler and the application, but with a safe link between the Memcached server and the application.
Install Cache::Memcached dependency.
You just have to set “Type: SecureToken” in the VirtualHost options in the manager.
If you want to protect only a virtualHost part, keep type on “Main” and set type in your configuration file:
PerlSetVar VHOSTTYPE AuthBasic
fastcgi_param VHOSTTYPE SecureToken;
Note
This handler uses Apache2Filter Module to hide token, prefer Handling server webservice calls for other servers.
SecureToken parameters are the following:
Attention
Due to Handler API change in 1.9, you need to set these
attributes in lemonldap-ng.ini
and not in Manager, for example:
[handler]
secureTokenMemcachedServers = 127.0.0.1:11211
secureTokenExpiration = 60
secureTokenAttribute = uid
secureTokenUrls = .*
secureTokenHeader = Auth-Token
secureTokenAllowOnError = 1