LemonLDAP::NG

What LemonLDAP::NG is

LemonLDAP::NG is free, self-hosted software for web single sign-on, access management and identity federation. It handles authentication, application access rules for authorization, and user identity in logs for accounting. Authentication sources include LDAP, Active Directory, Kerberos, databases, SSL, social networks, CAS, SAML and OpenID Connect. The software implements CAS, SAML and OpenID Connect for identity federation and can act as a gateway between those protocols.

Applications can integrate through HTTP headers, CAS, SAML, OpenID Connect, HTTP Basic replay or form replay. REST and SOAP APIs support direct communication with custom applications. Built-in multi-factor authentication and adaptive access are listed capabilities. The Manager includes a session explorer and rules based on session count, IP address or user-per-IP. Portal and Manager run on FastCGI- or PSGI-compatible servers; Apache and Nginx are documented examples. Supported distributions include Debian, Ubuntu, RHEL, Rocky Linux and AlmaLinux. Downloads include RHEL/CentOS RPM repositories, Debian packages, Docker images and source tarballs. The project states that it is FranceConnect certified, and describes its ANSSI OpenID Connect mode as compliant with ANSSI security guidelines. Handler deployments require applications to share the SSO server DNS suffix unless Cross Domain Authentication is used, and centralized traffic needs sizing to avoid a bottleneck.

Who it suits

LemonLDAP::NG suits teams that need self-hosted single sign-on, access rules and identity federation across applications using protocols such as CAS, SAML or OpenID Connect. It also fits deployments that need integrations through APIs, directory services or supported Linux distributions.

Limits

Handler deployments require applications to share the SSO server DNS suffix unless Cross Domain Authentication is used. Centralized traffic needs to be sized to avoid a bottleneck; Long Term Support versions receive security fixes without software updates.

Getting started

1. Visit https://lemonldap-ng.org/.
2. Choose a deployment route: Debian package, RHEL/CentOS RPM repository, Docker image or source tarball.
3. Deploy on a supported distribution such as Debian, Ubuntu, RHEL, Rocky Linux or AlmaLinux.
4. Run the Portal and Manager on a FastCGI- or PSGI-compatible server, such as Apache or Nginx.
5. Configure authentication sources and application integrations for the protocols in use.

Verdict

Choose LemonLDAP::NG if you need free, self-hosted SSO and federation across applications, with several integration methods and directory options. Check the DNS suffix requirement for handler deployments and size centralized traffic carefully. Long Term Support versions receive security fixes but no software updates.