github.com/tiredofit/docker-lemonldap

About

This will build a Docker Image LemonLDAP::NG an elegant web based manager for Authentication (SAML, OpenID Connect, CAS) served by Nginx.

• Sane defaults to have a working solution by just running the image
• Automatically generates configuration files on startup, or option to use your own
• Option to just use image as a Handler for external servers
• Handler Option to use file base socket or listen on TCP
• Fail2ban Included for blocking brute force attacks.
• Ready to work out the box for SAML, OpenID, 2FA/2OTP
• Additional modules compiled for Redis, Mysql, Postgres, LDAP Session/Config Storage
• Choice of Logging (Console, File, Syslog)

This is an incredibly complex piece of software and this image tries to get you up and running with sane defaults, you will need to switch eventually over to manually configuring the configuration file when depending on your usage case

Maintainer

• Dave Conroy

Table of Contents

• About
• Maintainer
• Table of Contents
• Prerequisites and Assumptions
• Installation
  • Build from Source
  • Prebuilt Images
• Configuration
  • Quick Start
  • Persistent Storage
  • Environment Variables
  • Base Images used
  • REST Settings
  • Portal Settings
  • Handler Settings
  • Manager Options
  • Networking
• Maintenance
  • Shell Access
• Support
  • Usage
  • Bugfixes
  • Feature Requests
  • Updates
• License
• References

Prerequisites and Assumptions

• Assumes you are using some sort of SSL terminating reverse proxy such as:
  • Traefik
  • Nginx
  • Caddy
• You must have access to create records on your DNS server to be able to setup the demo installation before configuration.

Installation

Build from Source

Clone this repository and build the image with docker build -t (imagename) .

Prebuilt Images

Builds of the image are available on Docker Hub

docker pull docker.io/tiredofit/lemonldap:(imagetag)

Builds of the image are also available on the Github Container Registry

docker pull ghcr.io/tiredofit/docker-lemonldap:(imagetag)

The following image tags are available along with their tagged release based on what's written in the Changelog:

Configuration

Quick Start

• The quickest way to get started is using docker-compose. See the examples folder for a working compose.yml that can be modified for development or production use.
• If you'd like to just use it in Handler mode, you will find another sample handler-compose.yml file that should get you started.
• Add records for your main, and manager names into DNS (ie handler.sso.example.com. api.manager.sso.example.com, manager.sso.example.com, sso.example.com, test.sso.example.com)
• Set various environment variables to understand the capabilities of this image. A Sample docker-compose.yml is provided that will work right out of the box for most people without any fancy optimizations.
• Map persistent storage for access to configuration and data files for backup.
• Once run, visit the Manager URL and login as dwho/dwho

Persistent Storage

The following directories should be mapped for persistent storage in order to utilize the container effectively.

Environment Variables

Base Images used

This image relies on an Alpine Linux base image that relies on an init system for added capabilities. Outgoing SMTP capabilities are handlded via msmtp. Individual container performance monitoring is performed by zabbix-agent. Additional tools include: bash,curl,less,logrotate, nano.

Be sure to view the following repositories to understand all the customizable options:

There are a huge amount of configuration variables and it is recommended that you get comfortable for a few hours with the LemonLDAP::NG Documentation

You will eventually based on your usage case switch over to SETUP_TYPE=MANUAL and edit your own lemonldap-ng.ini. While I've tried to make this as easy to use as possible, once in production you'll find much better success with large implementations with this approach.

By Default this image is ready to run out of the box, without having to alter any of the settings with the exception of the _HOSTNAME vars. You can also change the majority of these settings from within the Manager. There are instances where these variables would want to be set if you are running multiple handlers or need to enforce a Global Setting for one specific installation.

REST Settings

Depending if REST was chosen for CONFIG_TYPE, these variables would be used.

Portal Settings

• With impersonation, if you enable it, it will add a new field to your login screen, which may not be what you want if this is a production system. You will need to create two custom themes (one as a replica of bootstrap, and one for impersonation). In the custom theme, make modifications to login.tpl to stop it from loading impersonation.tpl, yet in your impersonation theme, leave it in there. Then, when one of your admin/support team visits the custom IMPERSONATE_HOSTNAME you have defined it will load the full theme with allows to impersonate, where as the default theme will not show this.

Handler Settings

Manager Options

Networking

The following ports are exposed.

Maintenance

Shell Access

For debugging and maintenance purposes you may want access the containers shell.

bash docker exec -it (whatever your container name is) bash

Support

These images were built to serve a specific need in a production environment and gradually have had more functionality added based on requests from the community.

Usage

• The Discussions board is a great place for working with the community on tips and tricks of using this image.
• Sponsor me for personalized support

  Bugfixes

• Please, submit a Bug Report if something isn't working as expected. I'll do my best to issue a fix in short order.

Feature Requests

• Feel free to submit a feature request, however there is no guarantee that it will be added, or at what timeline.
• Sponsor me regarding development of features.

Updates

• Best effort to track upstream changes, More priority if I am actively using the image in a production environment.
• Sponsor me for up to date releases.

License

MIT. See LICENSE for more details.

References

• https://lemonldap-ng.org