# Secure Token Handler

## Presentation

The Secure Token Handler is a special Handler that create a token for each request and send it to the protected application. The real user identifier is stored in a Memcached server and the protected application can the request the Memcached server to get user identifier.

This mechanism allows one to do SSO on application with an unsafe link between Handler and the application, but with a safe link with the Memcached server.

## Configuration

### Virtual host

#### Apache

Configure the virtual host like other protected virtual host but use Secure Token Handler instead of default Handler.

    PerlModule Lemonldap::NG::Handler::Specific::SecureToken
    <VirtualHost *:80>
           ServerName secure.example.com

           # Load SecureToken Handler
           PerlHeaderParserHandler Lemonldap::NG::Handler::Specific::SecureToken

           ...

    </VirtualHost>

#### Nginx

This module uses Apache2 Filter and is not compatible with Nginx.

### Handler parameters

SecureToken parameters are the following:

- Memcached servers: addresses of Memcached servers, separated with spaces.
- Token expiration: time in seconds for token expiration (remove from Memcached server).
- Attribute to store: the session key that will be stored in Memcached.
- Protected URLs: Regexp of URLs for which the secure token will be sent, separated by spaces
- Header name: name of the HTTP header carrying the secure token.
- Allow requests in error: allow a request that has generated an error in token generation to be forwarded to the protected application without secure token (default: yes)

Due to Handler API change in 1.9, you need to set these attributes in `lemonldap-ng.ini` and not in Manager, for example:

    [handler]
    secureTokenMemcachedServers = 127.0.0.1:11211
    secureTokenExpiration = 60
    secureTokenAttribute = uid
    secureTokenUrls = .*
    secureTokenHeader = Auth-Token
    secureTokenAllowOnError = 1