# Documentation for LemonLDAP::NG 1.4

## Installation

- Prerequisites and dependencies
- Installation from the tarball
- Installation on Debian/Ubuntu with packages
- Installation on RHEL/CentOS with packages
- Run in LemonLDAP::NG in Docker
- Upgrade from 1.3

## Configuration

### First steps

- Access to configuration
- Configure Single Sign On cookie and portal URL
- Parameter redirections
- Set exported variables
- Manage virtual hosts
- Configure sessions specificities

### Portal

- Presentation
- Portal customization
- Portal menu
- captcha

### Authentication, users and password databases

Backend | Authentication | Users | Password
--- | --- | --- | ---
Active Directory | ✔ | ✔ |
Apache (Kerberos, NTLM, OTP, ...) | ✔ |  |
Backend choice by users | ✔ | ✔ | ✔
BrowserID (Mozilla Persona) | ✔ |  |
CAS | ✔ |  |
Databases (DBI) | ✔ | ✔ | ✔
Demonstration | ✔ | ✔ | ✔
Facebook | ✔ | ✔ |
Google | ✔ | ✔ |
LDAP | ✔ | ✔ | ✔
Null | ✔ | ✔ | ✔
OpenID | ✔ | ✔ |
Proxy LL::NG | ✔ | ✔ |
Radius | ✔ |  |
Remote LL::NG | ✔ | ✔ |
SAML 2.0 / Shibboleth | ✔ | ✔ |
Slave | ✔ | ✔ |
SSL | ✔ |  |
Stack multiple backends | ✔ | ✔ |
Twitter | ✔ |  |
WebID | ✔ | ✔ |
Yubikey | ✔ |  |

### Configuration database

LL::NG needs a storage system to store its own configuration (managed by the manager). Choose one of the following:

Backend | Shareable | Comment
--- | --- | ---
File configuration backend |  | Not shareable between servers except if used in conjunction with SOAP configuration backend or with a shared file system (NFS,…). Selected by default during installation.
JSON File configuration backend |  | Not shareable between servers except if used in conjunction with SOAP configuration backend or with a shared file system (NFS,…).
SQL configuration backend (called RDBI or CDBI) | ✔ |
LDAP configuration backend | ✔ |
SOAP configuration backend | ✔ | Proxy backend to be used in conjunction with another configuration backend. Can be used to secure another backend for remote servers.

You can not start with an empty configuration, so read how to change configuration backend to convert your existing configuration into another one.

### Sessions database

Sessions are stored using Apache::Session modules family. All Apache::Session style modules are useable except for some features.

Backend | Shareable | Session explorer | Session restrictions | Session expiration | Comment
--- | --- | --- | --- | --- | ---
File |  | ✔ | ✔ | ✔ | Not shareable between servers except if used in conjunction with SOAP session backend or with a shared file system (NFS,…). Selected by default during installation.
SQL | ✔ | ✔ | ✔ | ✔ | Unoptimized for session explorer and single session features.
LDAP | ✔ | ✔ | ✔ | ✔
Memcached | ✔ |  |  |  | Must be secured by network access control.
NoSQL (Redis) | ✔ | ✔ | ✔ | ✔ | The faster. Must be secured by network access control.
Browseable (SQL, Redis or LDAP) | ✔ | ✔ | ✔ | ✔ | Optimized for session explorer and single session features.
SOAP | ✔ | ✔ | ✔ | ✔ | Proxy backend to be used in conjunction with another session backend. Can be used to secure another backend for remote servers.

### Identity provider

- SAML / Shibboleth identity provider
- OpenID identity provider
- CAS identity provider

- All identity provider protocols can be used simultaneously
- LemonLDAP::NG can be used as a proxy between those protocols

## Applications protection

- Writing rules and headers
- Variables that can be used in rules and headers
- Form replay
- Integrate existing applications
- Integrate your own application

## Advanced features

- Notifications system
- Store password in session
- Cross Domain Authentication (CDA)
- Role Based Access Control (RBAC)
- Use custom functions
- Use extended functions
- Reset password by mail (self service)
- Create an account (self service)
- Forward logout to applications
- Secure Token Handler
- Safe jail
- Login history
- Internal Proxy (lmProxy)
- AuthBasic Handler
- Fast CGI support
- See full parameters list

## Mini howtos

- Modify Manager protection
- Configuration and sessions in MySQL
- Configuration and sessions in LDAP
- Configuration and sessions access by SOAP
- Integration in Active Directory (LDAP and Kerberos)
- Create a protocol proxy (SAML to OpenID, CAS to SAML ,…)
- Convert HTTP header into environment variable

## Exploitation

- Performances
- Security
- Handler status page
- MRTG monitoring
- Logs settings
- Error messages
- High Availability