# documentation:2.0:start
Keywords: documentation,2.0,start

# Documentation for LemonLDAP::NG 2.0

## Installation

### Before installation

- Prerequisites and dependencies
- Upgrade notes

### Installation

- Installation from the tarball
- Installation on Debian/Ubuntu with packages
- Installation on RHEL/CentOS with packages
- Installation on Suse Linux Enterprise Server with packages
- Run in LemonLDAP::NG in Docker
- Node.js handler

### After installation

- Deploy Nginx configuration (recommended configuration)
- Deploy Apache configuration

## Configuration

### First steps

- Configuration overview
- Configure Single Sign On cookie and portal URL
- Parameter redirections
- Set exported variables
- Manage virtual hosts
- Configure sessions specificities

### Portal

- Presentation
- Portal customization
- Portal menu
- Captcha
- Public pages

#### Authentication, users and password databases

Official Backends | Authentication | Users | Password
--- | --- | --- | ---
Active Directory | ✔ | ✔ | ✔
Apache (Basic, NTLM, OTP, ...) | ✔ |  |
CAS | ✔ |  |
SQL Databases | ✔ | ✔ | ✔
Demonstration | ✔ | ✔ | ✔
Facebook | ✔ | ✔ |
Kerberos | ✔ | ✔ | ✔
LDAP | ✔ | ✔ | ✔
Null | ✔ | ✔ | ✔
OpenID Connect | ✔ | ✔ |
PAM | ✔ |  |
Proxy LL::NG | ✔ | ✔ |
Radius | ✔ |  |
REST | ✔ | ✔ | ✔
SAML 2.0 / Shibboleth | ✔ | ✔ |
Slave | ✔ | ✔ |
SSL | ✔ |  |
Twitter | ✔ |  |
WebID | ✔ | ✔ |
Yubikey | ✔ |  |
Custom modules | ✔ | ✔ | ✔
Combo Backends | Authentication | Users | Password
Choice by users | ✔ | ✔ | ✔
Combination of auth schemes | ✔ | ✔ |
Multiple backends stack | Deprecated, replaced by Combination
Obsolete Backends | Authentication | Users | Password
OpenID | ✔ | ✔ |
Remote LL::NG | ✔ | ✔ |
Second factor | Authentication |  |
U2F | ✔ |  |
External Second Factor (OTP, SMS,…) | ✔ |  |

#### Identity provider

- All identity provider protocols can be used simultaneously
- LemonLDAP::NG can be used as a proxy between those protocols

Protocol | Service Provider | Identity Provider
--- | --- | ---
CAS 1.0 / 2.0 / 3.0 | ✔ | ✔
SAML 2.0 / Shibboleth | ✔ | ✔
OpenID 2.0 (obsolete) | ✔ | ✔
OpenID Connect | ✔ | ✔
Get parameters provider (for poor applications) | ✔ |

### Handlers

Handlers are software control agents to install on your web servers (Nginx, Apache or Node.js).

Handler type | Apache | Nginx | Node.js | Comment |
Main (default handler) | ✔ | ✔ | Partial (*) |  |
AuthBasic | ✔ | ✔ |  | Designed for some server-to-server applications |
CDA | ✔ | ✔ |  | For Cross Domain Authentication |
DevOps | ✔ | ✔ |  | Allows application developers to define their rules within the application |
Secure Token | ✔ | ✔ |  | Designed to secure dialog between a LLNG reverse-proxy and a remote app |
Service Token (Server-to-Server) | ✔ | ✔ |  | Designed to permits underlying requests (API-Based Infrastructure) |
Zimbra PreAuth | ✔ | ✔ |  |

(*): Node.js handler has not yet reached the same level of functionality.

### LLNG databases

#### Configuration database

LL::NG needs a storage system to store its own configuration (managed by the manager). Choose one of the following:

Backend | Shareable | Comment
--- | --- | ---
File (JSON) |  | Not shareable between servers except if used in conjunction with SOAP or with a shared file system (NFS,…). Selected by default during installation.
YAML |  | Same as File in YAML format instead of JSON
SQL (RDBI/CDBI) | ✔ | Recommended for large-scale systems. Prefer CDBI.
LDAP | ✔ |
MongoDB | ✔ |
SOAP | ✔ | Proxy backend to be used in conjunction with another configuration backend. Can be used to secure another backend for remote servers.

You can not start with an empty configuration, so read how to change configuration backend to convert your existing configuration into another one.

#### Sessions database

Sessions are stored using Apache::Session modules family. All Apache::Session style modules are usable except for some features.

If you plan to use LLNG in a large-scale system, take a look at Performance Test to choose the right backend. A Browseable SQL backend is generally a good choice.

Backend | Shareable | Session explorer | Session restrictions | Session expiration | Comment
--- | --- | --- | --- | --- | ---
File |  | ✔ | ✔ | ✔ | Not shareable between servers except if used in conjunction with SOAP session backend or with a shared file system (NFS,…). Selected by default during installation.
SQL | ✔ | ✔ | ✔ | ✔ | Unoptimized for session explorer and single session features.
LDAP | ✔ | ✔ | ✔ | ✔
Redis | ✔ | ✔ | ✔ | ✔ | The faster. Must be secured by network access control.
MongoDB | ✔ | ✔ | ✔ | ✔ | Must be secured by network access control.
Browseable (SQL, Redis or LDAP) | ✔ | ✔ | ✔ | ✔ | Optimized for session explorer and single session features.
REST | ✔ | ✔ | ✔ | ✔ | Proxy backend to be used in conjunction with another session backend. Can be used to secure another backend for remote servers.
SOAP | ✔ | ✔ | ✔ | ✔ | Proxy backend to be used in conjunction with another session backend. Can be used to secure another backend for remote servers.

## Applications protection

- Writing rules and headers
- Variables that can be used in rules and headers
- Integrate vendor applications
- Integrate self-made applications
- Form replay
- Custom Handlers

### Well known compatible applications

Here is a list of well known applications that are compatible with LL::NG. A full list is available on vendor applications page.

## Advanced features

- Notifications system
- Store password in session
- Cross Domain Authentication (CDA)
- Role Based Access Control (RBAC)
- Use custom functions
- Use extended functions
- Reset password by mail (self service)
- Create an account (self service)
- Forward logout to applications
- Secure Token Handler
- AuthBasic Handler
- DevOps Handler
- Handling server webservice calls
- Safe jail
- Login history
- Fast CGI support
- See full parameters list

## Mini howtos

- Modify Manager protection
- Configuration and sessions in MySQL
- Configuration and sessions in LDAP
- Configuration and sessions access by SOAP
- Integration in Active Directory (LDAP and Kerberos)
- Create a protocol proxy (SAML to OpenID, CAS to SAML ,…)
- Convert HTTP header into environment variable

## Exploitation

- Performances
- Security
- SELinux
- Handler status page
- Monitoring
- Logs settings
- Error messages
- High Availability

## Developer corner

To develop an handler, see:

- Handler architecture
- Custom handlers

To develop a portal plugin, see manpages:

- Lemonldap::NG::Portal
- Lemonldap::NG::Portal::Auth::Base
- Lemonldap::NG::Portal::Main::Issuer
- Lemonldap::NG::Portal::Main::Plugin

To add a new language (XX must be replace by your language code):

- Manager: translate `lemonldap-ng-manager/site/htdocs/static/languages/en.json` in `lemonldap-ng-manager/site/htdocs/static/languages/XX.json` and enable it in “lemonldap-ng.ini” file
- Portal: translate `lemonldap-ng-portal/site/htdocs/static/languages/en.json` in `lemonldap-ng-portal/site/htdocs/static/languages/XX.json` and enable it in “lemonldap-ng.ini” file
- Portal Mails: translate `lemonldap-ng-portal/site/templates/common/mail/en.json` in `lemonldap-ng-portal/site/templates/common/mail/XX.json`

To translate this doc (Manager help):

- Install OmegaT
- Launch “make XX-translation” and translate all
- Launch “make XX-doc” to build doc