diff --git a/README.md b/README.md index 2010e7f4c9c6a23f3dab784ea14bad50deec8a8b..fb980c0a2ec75b351548eb76be933368f7d4b680 100644 --- a/README.md +++ b/README.md @@ -36,15 +36,51 @@ A database has to be created, and its schema populated. For instance, with Maria ``` $> mysqladmin create -u root -p access_check Enter password: -$> mysql -u root -p access_check < conf/access-check.sql +$> mysql -u root -p account_manager < conf/account_manager.sql Enter password: $> mysql -u root -p mysql Enter password: -MariaDB [mysql]> grant all privileges on access_check.* to access_check@localhost identified by 's3cr3t'; +MariaDB [mysql]> grant all privileges on account_manager.* to account_manager@localhost identified by 's3cr3t'; Query OK, 0 rows affected (0.00 sec) MariaDB [mysql]> quit ``` +The web server has to be configured to map access to the CGI script. For instance, with Apache: +``` + + Alias /account-manager /usr/local/share/account-managerk/www + <Directory /usr/local/share/account-manager/www> + Require all granted + Options ExecCGI + DirectoryIndex account-manager.cgi + AddHandler cgi-script .cgi + </Directory> +``` + +Additional directories have to be created for logs and data, with write permission for the web server: +``` +$> sudo mkdir /var/log/account-manager +$> sudo mkdir /var/lib/account-manager +$> sudo chown apache.apache /var/log/account-manager +$> sudo chown apache.apache /var/lib/account-manager +``` + +The application has to be properly configured, using the installed ```manager.conf``` file. + +A cron task has to be set for downloading federation metadata. For instance: +``` +# download eduGAIN metadata hourly +01 * * * * root curl --silent http://mds.edugain.org/ -o /var/lib/account-manager/edugain.xml +``` + +Another cron task has to be set for purging expired tokens and accounts. For instance: +``` +# purge expired tokens hourly +01 * * * * root /usr/local/bin/account-manager.pl list_tokens --expired --delete > /dev/null +# purge expired accounts daily +02 0 * * * root /usr/local/bin/account-manager.pl list_accounts --expired --delete > /dev/null +``` + ##Identity Provider The identity provider is actually [simpleSAMLphp](https://simplesamlphp.org/).