LemonLDAP::NG (lemonldap-ng)
WebSSO of the platform, alternative to Keycloak: OpenID Connect provider of the portal and of the Control Plane over the LDAP or Active Directory of the bank, roles from the groups, TOTP, sessions shared in PostgreSQL.
Generated from catalog/services/lemonldap-ng.yaml: do not edit by hand.
Summary
| |
|---|
| Version | 2.23.4 |
| Use | install and configure, configure and connect |
| Layer | functional (AI catalog) |
| Category | Identity and secrets |
| Installation methods | podman |
| External connection | oidc |
| Sandbox only | no |
Licence
Packages and artifacts
A package the project of the service publishes (its image, its binary archive, its Python or OS package) carries the licence of the service; a third-party package carries the licence written on its row, read from the official upstream metadata.
| Kind | Package | Version | Licence | Details |
|---|
| container image | docker.io/lemonldapng/lemonldap-ng | 2.23.4 | GPL-2.0-or-later | image key lemonldap-ng, used by schema, portal, digest sha256:f5286ec04f74ab91a17cb1b52ed23dea07a6b964dc027740889b579b0d9711b6 |
Images are pinned by tag in the descriptor, and by digest when the descriptor declares one (the offline bundle then refuses a pulled image that does not carry it); the digest is recorded in the mirror of the Manager when the offline bundle is imported, and every pull or load is checked against it.
Supported systems and architectures
| Method | Operating systems | Architectures |
|---|
podman | RHEL family (dnf), Debian family (apt), Arch Linux (pacman) | x86_64, aarch64 (not restricted by the descriptor) |
Certified host systems: RHEL 8/9/10, Rocky Linux 8/9/10, AlmaLinux 8/9/10, Oracle Linux 8/9, CentOS Stream 9/10, Ubuntu 22.04/24.04, Debian 12, Arch Linux (rolling). The host preflight accepts these systems (other releases of a known family give a warning, end of life releases are refused) and the x86_64 and aarch64 architectures.
Prerequisites
Host
- at least 1024 MB of memory (blocking,
memory).
Network and ports
| Component | Port name | Port | Opened in the host firewall |
|---|
portal | http | 8543/tcp | yes |
Services and connections needed
Details and resolution: see Dependencies.
Installation methods and modes
| Method | Default | What the method uses |
|---|
podman | yes | the container images of the descriptor, run by Podman under systemd |
Components
| Component | Kind | Installation methods | Ports |
|---|
Session tables (schema) | one shot | podman | - |
Portal (portal) | master | podman | 8543/tcp |
Single node (standalone) (default)
One portal node.
What the mode deploys:
| Component | Placement |
|---|
schema | min 1, max 1 |
portal | min 1, max 1 |
Cluster (cluster)
Several portal nodes behind a load balancer, sharing the sessions in PostgreSQL; the public URL is the one of the load balancer.
What the mode deploys:
| Component | Placement |
|---|
schema | min 1, max 1 |
portal | min 2, recommended 2 |
Install this service
The install wizard of the Navin Manager plans, validates and runs the installation; you need the services:install permission on the cluster.
-
Open the wizard. In Clusters, choose the row action Install services of the target cluster. The wizard opens on its first step, Service.
-
Choose the service. On the Service step, select LemonLDAP::NG. The card shows the licence GPL-2.0-or-later and the dependencies the installation needs. To register an existing oidc service of your organisation instead, turn on Use an existing external service.
-
Choose the hosts and the mode. On the Hosts step, tick the hosts, then choose the Mode: standalone (default), cluster. Each mode deploys the components listed in Installation methods and modes. With several components, place each one on its hosts in Component placement (Suggest placement proposes a placement that respects the cardinalities).
-
Bind the dependencies. On the Bindings step, choose for each dependency (database, directory) Install with the platform or Use an existing connection; an optional dependency can stay on No binding.
-
Configure. On the Configure step, review the parameters (see Configuration parameters); the required ones are users_base. Passwords left empty with a generated default are generated and sealed by the Manager.
-
Review and install. On the Install step the Manager validates the plan and shows the installation order; when it says "The plan is valid. Ready to install.", choose Install. A highly available mode is installed only when its HA checks pass.
-
Verify. The operation ends when the health checks of every instance pass (see Health checks); the service then shows as running in Services.
Connect an existing service
| |
|---|
| Schemes | https, http |
| Default port | 443 |
| Authentication | required |
| Health check | /.well-known/openid-configuration |
| Authentication method | Fields | Description |
|---|
client_credentials | client_id, client_secret | Confidential OpenID Connect client of the portal (client ID and secret, authentication client_secret_basic): the Manager checks them at the token endpoint; the client credentials grant does not need to be allowed. |
Official documentation: https://lemonldap-ng.org/documentation/latest/idpopenidconnect.html
High availability
Prerequisites
| Prerequisite | Must be highly available | Modes | Description |
|---|
database | yes | modes of level ha or cluster | Highly available PostgreSQL holding the sessions of every portal node. |
Topology per mode
| Modes | Highest catalog level | Distribution | Quorum component | Fault domains | Description |
|---|
standalone | standalone (standalone) | single (single) | - | 1 | One portal node, no fault tolerance. |
cluster | ha (ha) | active-active (active-active) | - | 2 | Portal nodes with the same configuration, sharing the sessions in PostgreSQL, behind a load balancer. |
Notes
- The portal nodes do not talk to each other: their availability is the one of PostgreSQL, of the directory and of the load balancer.
- In mode cluster the nodes keep no local cache of the sessions: every session, code and token is read from PostgreSQL, so a request may reach any node. Each node purges the expired sessions every hour.
Configuration parameters
Network
| Parameter | Type | Default | Allowed values | Required | Secret | Restart | Description |
|---|
Portal port (port) | port | 8543 | - | no | no | yes | Port of the login pages and of the OpenID Connect endpoints (HTTPS when TLS is on, else HTTP). |
TLS (tls_enabled) | bool | true | - | no | no | yes | Serve HTTPS with a certificate of the Manager CA (plain HTTP only behind a TLS load balancer). |
Public URL (public_url) | url | https://{{ host.fqdn }}:{{ config.port }} | - | no | no | no | Address of the portal for the browsers and the Control Plane, the issuer of the tokens (the load balancer in mode cluster). |
Directory
| Parameter | Type | Default | Allowed values | Required | Secret | Restart | Description |
|---|
Users base DN (users_base) | string | - | - | yes | no | no | Subtree of the directory searched for the users, for example ou=people,dc=bank,dc=internal. |
Directory kind (directory_kind) | enum | openldap | openldap, active_directory | no | no | no | openldap: inetOrgPerson users (uid) and groupOfNames groups; active_directory: person users (sAMAccountName), group groups and the password rules of Active Directory. |
Login attribute (login_attribute) | string | (empty) | ^([A-Za-z][A-Za-z0-9-]{0,63})?$ | no | no | no | Attribute matched with the login typed by the user (empty: uid, or sAMAccountName for Active Directory). |
User filter (user_filter) | string | (empty) | - | no | no | no | LDAP filter of the users, $user being the login (empty: the login attribute and the object class of the directory kind). |
Groups base DN (groups_base) | string | (empty) | - | no | no | no | Subtree searched for the groups of a user (empty: the users base DN). |
Group object class (group_object_class) | string | (empty) | ^([A-Za-z][A-Za-z0-9-]{0,63})?$ | no | no | no | Object class of the groups (empty: groupOfNames, or group for Active Directory). |
Member attribute (group_member_attribute) | string | member | ^[A-Za-z][A-Za-z0-9-]{0,63}$ | no | no | no | Attribute of a group listing its members: their DN (member, uniqueMember), or their login for memberUid. |
Nested groups (nested_groups) | bool | false | - | no | no | no | Also give the groups that contain the groups of the user. |
Roles of the groups (role_groups) | json | {"platform_admin": "navin-platform-admins", "tenant_admin": "navin-tenant-admins", "security_officer": "navin-security-officers", "finops": "navin-finops", "developer": "navin-developers", "auditor": "navin-auditors"} | - | no | no | no | Platform role given to the members of each directory group (role: name of the group); every user also has the role viewer. |
Organisation attribute (tenant_attribute) | string | (empty) | ^([A-Za-z][A-Za-z0-9-]{0,63})?$ | no | no | no | Directory attribute holding the identifier (slug) of the organisation of the user, given in the claim tenant. |
Default organisation (default_tenant) | string | (empty) | ^([a-z0-9][a-z0-9-]{0,62})?$ | no | no | no | Organisation (slug) of the users whose organisation attribute is empty (empty: none). |
Clearance attribute (clearance_attribute) | string | (empty) | ^([A-Za-z][A-Za-z0-9-]{0,63})?$ | no | no | no | Directory attribute holding the classification level of the user (public, internal, confidential, restricted or secret), given in the claim clearance (empty: internal for every user). |
Clients
| Parameter | Type | Default | Allowed values | Required | Secret | Restart | Description |
|---|
Portal URL (portal_url) | url | https://{{ host.fqdn }}:3000 | - | no | no | no | Address of the Navin Enterprise portal: its /auth/callback is the only redirect URI of the client portal. |
Portal client (portal_client_id) | string | portal | ^[A-Za-z0-9._-]{1,64}$ | no | no | no | Client identifier of the portal (portal_client_id of Navin Enterprise). |
Control Plane audience (audience) | string | control-plane | ^[A-Za-z0-9._-]{1,64}$ | no | no | no | Audience added to the access tokens of the portal (oidc_audience of Navin Enterprise). |
Other clients (extra_clients) | json | [] | - | no | yes | no | Other OpenID Connect clients, for example the BFF of a sector agent: a list of {"client_id", "redirect_uris", "secret", "audiences", "post_logout_redirect_uris"}; a client without secret is public. Every client uses PKCE S256. |
Security
| Parameter | Type | Default | Allowed values | Required | Secret | Restart | Description |
|---|
TOTP required (mfa_required) | bool | true | - | no | no | no | Every user registers a TOTP application at the first login, then gives a code at each login. |
Session lifetime (s) (session_timeout_s) | int | 36000 | min 900, max 86400 | no | no | no | Maximum lifetime of an SSO session, in seconds. |
Idle timeout (s) (idle_timeout_s) | int | 1800 | min 300, max 28800 | no | no | no | An SSO session without activity for this many seconds ends. |
Token lifetime (s) (access_token_ttl_s) | int | 300 | min 60, max 3600 | no | no | no | Lifetime of the access and ID tokens, in seconds. |
Token signing key (signing_key) | password | generated | - | no | yes | yes | RSA 3072 bit private key that signs the tokens (RS256); its public key is published at /oauth2/jwks. |
Signing key identifier (signing_key_id) | string | generated | - | no | no | yes | Identifier (kid) of the signing key in the tokens and the JWKS. |
Log level (log_level) | enum | notice | error, warn, notice, info, debug | no | no | no | Level of the logs of the portal (journal of the service). |
Dependencies
For each active dependency the Manager takes the first of: the binding chosen in the wizard; a service of the same installation that provides it; a service already installed in the cluster; the only connection of the expected type. Otherwise an optional dependency stays unbound, and a required one is added to the installation in its default mode (the column below names the catalog service added).
| Binding | Provided by | Connection type | Endpoint | Optional | When nothing is bound | Description |
|---|
database | postgresql | postgresql | sql | no | postgresql is added to the installation | Sessions of the portal (SSO, persistent with the TOTP secrets, OpenID Connect), shared by every portal node. |
directory | - | ldap | - | no | the installation is refused (dependency_not_installable) | Directory of the users and of their groups (LDAP or Active Directory), declared as an LDAP connection of the Manager. |
Endpoints
| Endpoint | Scheme | Component | Port | Path | TLS parameter | Binding parameters | Binding secrets | Provisioning command |
|---|
http | http | portal | 8543 (port) | - | tls_enabled | issuer, jwks_url, client_id | - | - |
Client configuration files
Files rendered for the client configuration download:
lemonldap-ng.env (client.env.j2)
Health checks
Liveness (per instance)
| Component | Check | Details |
|---|
portal | HTTP {{ 'https' if config.tls_enabled else 'http' }}://{{ host.fqdn }}:{{ config.port }}/.well-known/openid-configuration | Expected 200; 60 retries; interval 2 s; timeout 5 s |
Readiness (service check)
| Check | Details |
|---|
HTTP {{ config.public_url.rstrip('/') }}/.well-known/openid-configuration | Expected 200; 10 retries; interval 3 s; timeout 5 s |
Preflight checks
| Check | Type | Meaning | Severity | Components |
|---|
memory | memory_mb {"min": 1024} | at least 1024 MB of memory | blocking | every component |
port_free | port_free {"param": "port"} | port 8543 free on the host | blocking | every component |
Uninstall
Paths removed when the data is purged: {{ paths.data }}, {{ paths.log }}.
Quick links
- Login page:
{{ config.public_url.rstrip('/') }}/
- OIDC discovery:
{{ config.public_url.rstrip('/') }}/.well-known/openid-configuration
Upstream documentation