Lemonld...::Issuer(3)

✨ Lemonldap::NG::Portal::Main::Issuer 💖

okay bestie, welcome to the Lemonld...::Issuer(3) page — yes that's the real title, the man page system truncates it, iykyk 💅. It's part of the User Contributed Perl Documentation crew, and honestly? It's giving "build your own identity provider" main character energy. Let's get into it 🫶

---

🌸 NAME 🌸

Lemonldap::NG::Portal::Main::Issuer — the base class for identity providers. That's it, that's the whole vibe. It's the blueprint, the template, the ✨parent class✨ you inherit from when you wanna make your own IdP. 👑

---

🎀 SYNOPSIS 🎀

Here's the whole shape of it, no cap:

package Lemonldap::NG::Portal::Issuer::My;
use strict;
use Mouse;
extends 'Lemonldap::NG::Portal::Main::Issuer';
use Lemonldap::NG::Portal::Main::Constants qw(PE_OK);

# Required: URL root path
use constant path => 'saml';

# Optional initialization method
sub init {
    my ($self) = @_;
    ...
    # Must return 1 (succeed) or 0 (failure)
}

# Required methods are run() and logout(), they are launched only for
# authenticated users
# $req is a Lemonldap::NG::Portal::Main::Request object
# They must return a Lemonldap::NG::Portal::Main::Constants constant
sub run {
    my ( $self, $req ) = @_
    ...
    return PE_OK
}

sub logout {
    my ( $self, $req ) = @_
    ...
    return PE_OK
}
1;

So like, path is required (it's your URL root), init is optional, and run() + logout() are the mandatory girlies. They only fire for authenticated users, and they gotta return a Lemonldap::NG::Portal::Main::Constants constant. Periodt. 💖

---

🦋 DESCRIPTION 🦋

Lemonldap::NG::Portal::Main::Issuer is a base class for writing identity providers for the Lemonldap::NG web-SSO system. It provides a bunch of methods so you can write an IdP easily, and it handles the authentication situation for you when the identity request shows up before authentication has happened. So thoughtful of it, honestly. 🌈

---

💜 WRITING AN IDENTITY PROVIDER 💜

To write a classic identity provider, you literally just inherit this class and write run() and logout(). Those two methods must return a Lemonldap::NG::Portal::Main::Constants constant. That's the whole assignment. Slay. ✨

A classic identity provider needs an issuerDB>XXX<Path parameter in LLNG configuration to declare its base URI path (check out Lemonldap::NG::Manager::Build for that). Example: /saml/. Every request that starts with /saml/ will call run() — after authentication if that's needed — and nobody else gets those requests. It's exclusive like that. 💅

The logout() function gets called when a user asks for logout on this server. So if you're writing an identity provider, bestie, you must implement a single logout system. No skipping this one. 😭

🧚 managing other URI path

Lemonldap::NG::Portal::Main::Issuer gives you methods to bind a method to a URI path:

• addAuthRoute() — for authenticated users 🔐
• addUnauthRoute() — for unauthenticated users 🙈

These must be called during the initialization process, which means you have to write that optional init() sub. Surprise, it's not so optional after all. 👀

⚠️ Be careful with add*authRoute(): you can't catch your root path here (that's the path declared in $self->path) because this module catches it for you. But you can catch sub-routes, like /path/something. 💖

Example time, here's the whole thing:

sub init {
    my ($self) = @_;
    ...
    $self->addUnauthRoute( saml => { soap => 'soapServer' }, [ 'POST' ] );
    return 1;
}
sub soapServer {
    my ( $self, $req ) = @_;
    ...
    # You must return a valid PSGI response
    return [ 200, [ 'Content-Type' => 'application/xml' ], [] ];
}

Note the soapServer sub has to return a valid PSGI response, okay? Don't forget that part. 🫶

⭐ avoid conflicts in path

If you're sharing a base URI path with another plugin (say, an Auth::* module), it is recommended to write an ssoMatch function that returns true if $req->uri has to be handled by the Issuer module. Wanna see how it's done? Go peek at Issuer::SAML or Issuer::OpenIDConnect for examples. Iconic references, honestly. 👑

---

🔥 SEE ALSO 🔥

• <http://lemonldap-ng.org/> — the mothership 🌐

---

💖 AUTHORS 💖

LemonLDAP::NG team <http://lemonldap-ng.org/team> — the collective geniuses behind all this 🫶

---

🎀 BUG REPORT 🎀

Found a bug? Want a feature? Use the OW2 system, bestie:

• <https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/issues>

They wanna hear from you, fr fr. 🐛

---

🌈 DOWNLOAD 🌈

Lemonldap::NG is available at <https://lemonldap-ng.org/download> — go get it, it's right there. 💜

---

👑 COPYRIGHT AND LICENSE 👑

See the COPYING file for details.

This library is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. (Yeah, the legal girlies said it in all caps, we respect that. 💀)

You should have received a copy of the GNU General Public License along with this program. If not, see <http://www.gnu.org/licenses/>.

---

and that's the whole page, bestie!! 🎉 this manual was brought to you by perl v5.42.3, dated 2026-09-24 — so when you're out here building IdPs, just know the docs are literally from the future. no cap. stay iconic, go write that run() and logout(), and remember: return your constants, implement your single logout, and never share a base URI path without an ssoMatch. mwah 💋✨🦋