httpd.conf

# WSGI Root
WSGIPythonPath /var/www/ldap-oauth2
WSGIPythonHome /var/www/venv

<VirtualHost *:80>
	ServerAdmin mlc@iitb.ac.in
	DocumentRoot /var/www/ldap-oauth2/staticfiles/

	ErrorLog ${APACHE_LOG_DIR}/error.log
	CustomLog ${APACHE_LOG_DIR}/access.log combined

	<Directory /var/www/ldap-oauth2>
		Require all granted
	</Directory>

	# Static files
	Alias "/profiles/static/" "/var/www/ldap-oauth2/staticfiles/"
	Alias "/profiles/media/" "/var/www/ldap-oauth2/media/"

	WSGIScriptAlias /sso /var/www/ldap-oauth2/sso/wsgi.py
	WSGIScriptAlias /profiles /var/www/ldap-oauth2/sso/wsgi.py
	WSGIPassAuthorization On

	# ============== OIDC ONLY ==================
	# OIDCProviderMetadataURL https://sso-uat.iitb.ac.in/.well-known/openid-configuration
	# OIDCScope "openid"
	# OIDCClientID gymkhana
	# OIDCClientSecret the_middle_layer_secret
	# OIDCRedirectURI https://gymkhana.iitb.ac.in/profiles/user/redir
	# OIDCCryptoPassphrase openstack
	# OIDCSSLValidateServer Off
	# OIDCRemoteUserClaim uid
	# OIDCCookiePath "/profiles/"
	# OIDCSessionMaxDuration 600
	# ===========================================

	<LocationMatch /profiles/(user|oauth/applications|oauth/authorize|account/logout|admin)(?!/api) >
		# ============== LDAP ONLY ==================
		AuthType form
		AuthName LDAP
		ErrorDocument 401 /profiles/account/login/
		AuthFormProvider ldap
		AuthFormLoginSuccessLocation "%{REQUEST_URI}?%{QUERY_STRING}"
		AuthFormLogoutLocation "/profiles/user/"

		Session On
		SessionCookieName psession path=/profiles/
		SessionCryptoPassphrase secret

		LDAPReferrals Off
		AuthLDAPUrl ldap://ldap.iitb.ac.in/dc=iitb,dc=ac,dc=in?uid,employeeNumber,employeeType,mobile,givenName,sn,mail?sub?(objectClass=*)
		# ===========================================

		# ============== OIDC ONLY ==================
		# AuthType openid-connect
		# ===========================================

		Require valid-user
	</LocationMatch>

	# ============== LDAP ONLY ==================
	<Location "/profiles/account/logout" >
		SetHandler form-logout-handler
		SessionMaxAge 1
	</Location>
	# ===========================================

	Options -Indexes
</VirtualHost>

# vim: syntax=apache ts=4 sw=4 sts=4 sr noet