# Documentation for LemonLDAP::NG 1.9

## Main changes

Version 1.9 of LL::NG brings the following main changes:

- OpenID Connect support
- Nginx support
- New manager interface

You must read upgrade from 1.4 to 1.9 documentation page before installing it.

## Installation

### Before installation

- Prerequisites and dependencies
- Upgrade notes

### Installation

- Installation from the tarball
- Installation on Debian/Ubuntu with packages
- Installation on RHEL/CentOS with packages
- Installation on Suse Linux Enterprise Server with packages
- Run in LemonLDAP::NG in Docker

### After installation

- Deploy Apache configuration
- Deploy Nginx configuration

## Configuration

### First steps

- Configuration overview
- Configure Single Sign On cookie and portal URL
- Parameter redirections
- Set exported variables
- Manage virtual hosts
- Configure sessions specificities

### Portal

- Presentation
- Portal customization
- Portal menu
- Captcha
- Public pages

### Authentication, users and password databases

Official Backends | Authentication | Users | Password
--- | --- | --- | ---
Active Directory | ✔ | ✔ | ✔
Apache (Kerberos, NTLM, OTP, ...) | ✔ |  |
BrowserID (Mozilla Persona) | ✔ |  |
CAS | ✔ |  |
Databases (DBI) | ✔ | ✔ | ✔
Demonstration | ✔ | ✔ | ✔
Facebook | ✔ | ✔ |
Kerberos (available with version ≥ 1.9.14) | ✔ |  |
LDAP | ✔ | ✔ | ✔
LinkedIn | ✔ |  |
Null | ✔ | ✔ | ✔
OpenID Connect | ✔ | ✔ |
Proxy LL::NG | ✔ | ✔ |
Radius | ✔ |  |
SAML 2.0 / Shibboleth | ✔ | ✔ |
Slave | ✔ | ✔ |
SSL | ✔ |  |
Twitter | ✔ |  |
WebID | ✔ | ✔ |
Yubikey | ✔ |  |
Combo Backends | Authentication | Users | Password
Choice by users | ✔ | ✔ | ✔
Multiple backends stack | ✔ | ✔ |
Obsolete Backends | Authentication | Users | Password
Google | ✔ | ✔ |
OpenID | ✔ | ✔ |
Remote LL::NG | ✔ | ✔ |

### Configuration database

LL::NG needs a storage system to store its own configuration (managed by the manager). Choose one of the following:

Backend | Shareable | Comment
--- | --- | ---
File (JSON) |  | Not shareable between servers except if used in conjunction with SOAP or with a shared file system (NFS,…). Selected by default during installation.
SQL (RDBI/CDBI) | ✔ |
LDAP | ✔ |
MongoDB | ✔ |
SOAP | ✔ | Proxy backend to be used in conjunction with another configuration backend. Can be used to secure another backend for remote servers.

You can not start with an empty configuration, so read how to change configuration backend to convert your existing configuration into another one.

### Sessions database

Sessions are stored using Apache::Session modules family. All Apache::Session style modules are useable except for some features.

Backend | Shareable | Session explorer | Session restrictions | Session expiration | Comment
--- | --- | --- | --- | --- | ---
File |  | ✔ | ✔ | ✔ | Not shareable between servers except if used in conjunction with SOAP session backend or with a shared file system (NFS,…). Selected by default during installation.
SQL | ✔ | ✔ | ✔ | ✔ | Unoptimized for session explorer and single session features.
LDAP | ✔ | ✔ | ✔ | ✔
Redis | ✔ | ✔ | ✔ | ✔ | The faster. Must be secured by network access control.
MongoDB | ✔ | ✔ | ✔ | ✔ | Must be secured by network access control.
Browseable (SQL, Redis or LDAP) | ✔ | ✔ | ✔ | ✔ | Optimized for session explorer and single session features.
SOAP | ✔ | ✔ | ✔ | ✔ | Proxy backend to be used in conjunction with another session backend. Can be used to secure another backend for remote servers.

### Identity provider

- All identity provider protocols can be used simultaneously
- LemonLDAP::NG can be used as a proxy between those protocols

- CAS 1.0 / 2.0 / 3.0
- SAML 2.0 / Shibboleth
- OpenID 2.0 (obsolete)
- OpenID Connect
- Get parameters provider

## Applications protection

- Writing rules and headers
- Variables that can be used in rules and headers
- Integrate vendor applications
- Integrate self-made applications
- Form replay
- Custom Handlers

### Well known compatible applications

Here is a list of well known applications that are compatible with LL::NG. A full list is available on vendor applications page.

## Advanced features

- Notifications system
- Store password in session
- Cross Domain Authentication (CDA)
- Role Based Access Control (RBAC)
- Use custom functions
- Use extended functions
- Reset password by mail (self service)
- Create an account (self service)
- Forward logout to applications
- Secure Token Handler
- LemonLDAP::NG kubernetes controller
- Safe jail
- Login history
- AuthBasic Handler
- Fast CGI support
- See full parameters list

## Mini howtos

- Modify Manager protection
- Configuration and sessions in MySQL
- Configuration and sessions in LDAP
- Configuration and sessions access by SOAP
- Integration in Active Directory (LDAP and Kerberos)
- Create a protocol proxy (SAML to OpenID, CAS to SAML ,…)
- Convert HTTP header into environment variable

## Exploitation

- Performances
- Security
- SELinux
- Handler status page
- MRTG monitoring
- Logs settings
- Error messages
- High Availability