Lemonld...al::Auth(3)

💅 NAME 💅

Lemonldap:NG::Portal::Auth — bestie, this is the page about writing authentication modules for LemonLDAP::NG. Like, you're literally building the thing that decides who gets in. Main character energy fr fr. 💖

---

✨ SYNOPSIS ✨

Okay so here's the whole vibe of what your module looks like, no cap:

package Lemonldap::NG::Portal::Auth::My;

use strict;
use Mouse;
# Add constants used by this module
use Lemonldap::NG::Portal::Main::Constants qw(PE_OK);

our $VERSION = '0.1';

# Directive provides by Mouse
extends 'Lemonldap::NG::Portal::Main::Auth';

sub init {
    ...
}

sub extractFormInfo {
    my ( $self, $req ) = @_;
    ...
}

sub authenticate {
    my ( $self, $req ) = @_;
    ...
}

sub setAuthSessionInfo {
    my ( $self, $req ) = @_;
    ...
}

sub authLogout {
    my ( $self, $req ) = @_;
    ...
}

sub getDisplayType {
    return ...;
}

1;

Look at that. She's gorgeous. 🎀

---

🦋 DESCRIPTION 🦋

So basically, Lemonldap::NG::Portal::Main::Auth is the thing you have to use to build LemonLDAP::NG authentication modules. That's not optional, that's the blueprint.

Authentication modules are independent objects — like, they have their own little lives — and they get instantiated by the LemonLDAP::NG portal. And they must provide the methods described down below. Periodt. No skipping. 👑

---

🌈 METHODS 🌈

🔑 Accessors and methods provided by Lemonldap::NG::Portal::Main::Auth

These come free with the base class, you don't have to write them, you just get to use them. Obsessed.

• p — the portal object
• conf — configuration hash (as reference)
• logger — alias for the p->logger accessor
• userLogger — alias for the p->userLogger accessor
• error — alias for the p->error method
• authnLevel — Lemonldap::NG authentication level

🛣️ "Routes" management

Just like every module that inherits from Lemonldap::NG::Portal::Plugin, Lemonldap::NG::Portal::Main::Auth hands you URI path functions:

• addAuthRoute — wrapper to the Lemonldap::NG::Handler::PSGI::Try addAuthRoute() method
• addUnauthRoute — wrapper to the Lemonldap::NG::Handler::PSGI::Try addUnauthRoute() method

Example, because a visual is always helpful:

sub init {
    ...
    $self->addAuthRoute( saml => { proxy => "proxySub" }, [ 'GET', 'POST' ] );
    ...
}
sub proxySub {
    my ( $self, $req ) = @_;
    ...
    # This sub must return a PSGI response. Example
    return [ 302, [ Location => 'http://x.y/' ], [] ];
}

So what this is saying is: requests to http://auth.../saml/proxy get handed off to the proxySub() method. Simple as that. 🫶

📝 Methods that must be provided by an authentication module

init()

Method launched after object creation — and yes, that means after each configuration reload too, so she gets re-run. It must return a true value if the authentication module is ready, and false if it's not. That's it, that's the whole job.

📬 Methods called at each request

All of these methods must return a Lemonldap::NG::Portal::Main::Constants value. And they're called with one argument: a Lemonldap::NG::Portal::Main::Request object.

💡 Note: if you want to change process() next steps, you literally just have to change the $req->steps array. That's the whole hack.

• extractFormInfo($req) — the first authentication method called during the authentication process. It must set $req->user, which is the thing the userDB object is gonna use to go get user information. Set it or the whole thing falls apart, bestie.
• authenticate($req) — the last method called during the authentication process. The finale. 🎬
• setAuthSessionInfo($req) — method that must at least set $req->{sessionInfo}->{authenticationLevel} to an integer that indicates the strong of authentication.

Proposed levels, so you know what number means what:

1. low level
2. web form level
3. session based level (Kerberos for example)
5. strong authentication

• authForce($req)
• authLogout($req)

(Yeah, those last two are just listed. They're yours to figure out. Slay. 💅)

---

📢 LOGGING 📢

Logging is provided by $self->logger and $self->userLogger. And these rules must be applied — they're not suggestions, they're the rules:

• logger->debug — technical debugging messages
• logger->info — simple technical information
• logger->notice — technical information that could interest administrators
• logger->warn — technical warning
• logger->error — error that must be reported to administrator
• userLogger->info — simple information about user's action
• userLogger->notice — information that may be registered (auth success,...)
• userLogger->warn — bad action of a user (auth failure). Auth/Combination transform it to "info" when another authentication scheme is available
• userLogger->error — bad action of a user that must be reported, (even if another backend is available with Combination)

---

👑 AUTHORS 👑

LemonLDAP::NG team <http://lemonldap-ng.org/team> — the whole squad, iconic, we love them.

---

🐛 BUG REPORT 🐛

Found a bug? Need a feature? Use the OW2 system to report bug or ask for features:

<https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/issues>

They want to hear from you, fr fr. Don't be shy. 🌸

---

💾 DOWNLOAD 💾

Lemonldap::NG is available at <https://lemonldap-ng.org/download>

Go get her. 🏃♀️💨

---

📜 COPYRIGHT AND LICENSE 📜

See COPYING file for details.

This library is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2, or (at your option) any later version.

⚠️ This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. Like, for real, no warranty. None. Zero. 💀

You should have received a copy of the GNU General Public License along with this program. If not, see <http://www.gnu.org/licenses/>.

---

And that's the whole page, bestie! This was brought to you by perl v5.42.3 on 2026-09-24, straight out of the User Contributed Perl Documentation corner of the internet. Take care of your auth modules and they'll take care of you. 🧚💖✨