LemonLDAP NG 2.23.4

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Pick LemonLDAP::NG 2.23.4 on Ubuntu 24.04 as the software version and select your Region. Choose Launch through EC2, then select m5.large, your key pair and a security group as described above.

To launch with the AWS CLI, replace the values in angle brackets:

aws ec2 run-instances --image-id <ami-id-from-the-listing> --instance-type m5.large \
  --key-name <your-key-pair> --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=lemonldap-ng}]'

First boot takes about fifteen seconds after cloud-init has run. It names the portal after the instance's public DNS name (or its public or private address). To use your own name from the start, put it in /etc/sac/lemonldap-ng-host.preset with user data, for example a cloud-init write_files entry. You can also change the name later (Step 11).

The directory base DN is dc=example,dc=com. To use another one (dc=...,dc=...), put it in /etc/sac/lemonldap-ng-basedn.preset before the first boot.

Operating system SSH user

Ubuntu 24.04 ubuntu

ssh -i <your-key.pem> ubuntu@<public-ip>

systemctl is-active lemonldap-ng-firstboot slapd lemonldap-ng-fastcgi-server nginx

active active active active

Only SSH, HTTP and HTTPS are public. OpenLDAP listens on the loopback address. LemonLDAP::NG's FastCGI server listens on a local socket that only www-data can reach:

sudo ss -tln | awk '{print $4}' | grep -E ':(22|80|389|443|636)$' | sort -u sudo ls -ld /run/llng-fastcgi-server

0.0.0.0:22 0.0.0.0:443 0.0.0.0:80 127.0.0.1:389 [::]:22 [::]:443 [::]:80 drwxr-x--- 2 www-data www-data 80 Oct 31 17:32 /run/llng-fastcgi-server

First boot saves everything it generated in a root-only file (mode 0600). Show the file without the password lines first:

sudo grep -v PASSWORD /root/lemonldap-ng-credentials.txt

# LemonLDAP::NG 2.23.4 - written on first boot by lemonldap-ng-firstboot.service. Unique to this instance. PORTAL_URL=https://ec2-44-202-253-56.compute-1.amazonaws.com/ MANAGER_URL=https://ec2-44-202-253-56.compute-1.amazonaws.com/manager/ LLNG_ADMIN_USERNAME=llngadmin OIDC_ISSUER=https://ec2-44-202-253-56.compute-1.amazonaws.com SAML_METADATA_URL=https://ec2-44-202-253-56.compute-1.amazonaws.com/saml/metadata LDAP_URL=ldap://127.0.0.1:389 LDAP_BASE_DN=dc=example,dc=com LDAP_PEOPLE_DN=ou=people,dc=example,dc=com LDAP_ADMIN_DN=cn=admin,dc=example,dc=com LDAP_CONFIG_DN=cn=admin,cn=config LDAP_LLNG_BIND_DN=cn=llng,ou=services,dc=example,dc=com TLS_SHA256=9D:1C:14:F9:33:52:10:16:5B:37:EC:84:59:38:39:C7:2F:78:4E:54:E9:1F:7D:22:74:CB:EE:11:3A:A6:91:1E TLS_SPKI_SHA256=8zK1rsq9/E8/RmRkSF4WU7jWvWFu6+ncCMyggJz4MhM=
#
# Sign in at PORTAL_URL as LLNG_ADMIN_USERNAME; the Manager (MANAGER_URL) admits members of cn=llng-admins only.
# Add a directory user:
sudo lemonldap-ng-add-user alice (add --admin for Manager access)
# Register an OIDC client:
sudo lemonldap-ng-add-oidc-rp my-app https://my-app.example.com/callback
# Directory tools as the directory administrator:
sudo sac-ldap ldapsearch -b dc=example,dc=com uid
# The LemonLDAP::NG cipher key and the OIDC/SAML signing keys are unique to this instance and live in its configuration
# (/var/lib/lemonldap-ng/conf, www-data only). OpenLDAP listens on 127.0.0.1 only.
# The HTTPS certificate is self-signed and unique to this instance: compare its SHA-256 fingerprint (TLS_SHA256), or
# replace it with a CA-issued certificate for your own name. Your own name:
sudo lemonldap-ng-set-host sso.example.com
# User guide: https://secureanycloud.com/stacks/lemonldap-ng-2-23-4/

The file also holds LLNG_ADMIN_PASSWORD (the portal administrator), LDAP_ADMIN_PASSWORD, LDAP_CONFIG_PASSWORD and LDAP_LLNG_BIND_PASSWORD. Read only the one you need, when you need it, for example sudo grep '^LLNG_ADMIN_PASSWORD=' /root/lemonldap-ng-credentials.txt. The session cipher key and the OpenID Connect and SAML signing keys are in LemonLDAP::NG's configuration (/var/lib/lemonldap-ng/conf, readable only by root and www-data).

The certificate is self-signed and unique to your instance. Do not add it to a trust store. Instead, compare its fingerprint (TLS_SHA256) with the one your browser shows, or replace it with a CA-issued certificate (Step 11).

sudo lemonldap-ng-selftest

The self-test runs these checks:

• Signs in to the portal as the administrator over HTTPS.
• Checks that a wrong password and the upstream demo accounts are refused.
• Opens the Manager as the administrator and checks that an anonymous request is sent to the sign-in page.
• Registers a temporary OpenID Connect client and runs an authorization-code sign-in with it.
• Verifies the ID token's signature against the portal's published keys (a tampered token fails).
• Checks the SAML metadata.
• Deletes the temporary client again.

portal 200; llngadmin signs in; wrong password + dwho/rtyler/msmith refused; Manager 200 (admin) / 302 (anonymous) JWT_VERIFY OK kid=432dca08 iss=https://ec2-44-202-253-56.compute-1.amazonaws.com sub=llngadmin; tampered token refused; SAML metadata entityID + certificate LEMONLDAP_NG_SELFTEST_OK

Open PORTAL_URL (https://<your-name>/) in a browser. Accept the certificate after comparing its fingerprint, then sign in as llngadmin with LLNG_ADMIN_PASSWORD.

A wrong user name or password is refused with a message. LemonLDAP::NG's brute-force protection is on. After three failed attempts, an account is locked for 30 seconds, then for longer each time.

After you sign in, the application menu shows the WebSSO Manager and a sample page protected by the LemonLDAP::NG handler.

Choose WebSSO Manager (or open MANAGER_URL). The Manager edits the whole configuration: authentication backends, virtual hosts and their access rules, OpenID Connect relying parties, SAML service providers, sessions and second factors. Each save creates a new numbered configuration that you can compare with or roll back to.

The Sessions tab lists active single sign-on sessions, which you can inspect and end.

One rule controls who may open the Manager. It is kept in /etc/sac/lemonldap-ng-manager-protection and written into /etc/lemonldap-ng/lemonldap-ng.ini before every start of the LemonLDAP::NG FastCGI server:

sudo cat /etc/sac/lemonldap-ng-manager-protection
sudo awk '/^\[manager\]/{m=1;next} /^\[/{m=0} m && /^(protection|staticPrefix)/' /etc/lemonldap-ng/lemonldap-ng.ini

inGroup("llng-admins") protection = inGroup("llng-admins") staticPrefix = /manager-static

To let another person administer LemonLDAP::NG, add them with --admin (Step 8). To change the rule itself (any LemonLDAP::NG rule expression on session attributes), edit that file and run sudo systemctl restart lemonldap-ng-fastcgi-server.

Anonymous requests never reach the Manager, whatever the URL looks like. They are sent to the sign-in page (302) or refused outright (400):

H=$(head -1 /etc/sac/lemonldap-ng-host) for p in /manager/ /manager/confs/latest /MANAGER/ '/manager;x=1/' '//manager/' '/%6Danager/' '/x/../manager/'; do printf '%-22s %s\n' "$p" "$(curl -s -o /dev/null -w '%{http_code}' --path-as-is --cacert /etc/sac/tls/lemonldap-ng.crt --resolve "$H:443:127.0.0.1" "https://$H$p")" done | tee /run/manager-probe.txt; ! grep -q ' 200$' /run/manager-probe.txt; R=$?; rm -f /run/manager-probe.txt; [ "$R" -eq 0 ]

/manager/ 302 /manager/confs/latest 302 /MANAGER/ 302 /manager;x=1/ 400 //manager/ 400 /%6Danager/ 302 /x/../manager/ 302

sudo lemonldap-ng-add-user jane --name "Jane Example" --mail jane@example.com
sudo ls -l /root/lemonldap-ng-user-jane.password

user jane added; password in /root/lemonldap-ng-user-jane.password (root only) -rw------- 1 root root 24 Oct 31 17:33 /root/lemonldap-ng-user-jane.password

The password is generated on the instance, stored in the directory as an Argon2 hash, and written only to that root-only file. Give it to the user over a secure channel. The user can change it in the portal (Password). Add --admin to make a user a Manager administrator (member of cn=llng-admins).

Jane can sign in to the portal and open the protected sample page, but the Manager refuses her (403):

H=$(head -1 /etc/sac/lemonldap-ng-host) A="$(sudo python3 -I /usr/local/lib/sac/lemonldap-ng/probe.py get "$H" jane /root/lemonldap-ng-user-jane.password /protected/)" M="$(sudo python3 -I /usr/local/lib/sac/lemonldap-ng/probe.py manager "$H" jane /root/lemonldap-ng-user-jane.password /manager/)" echo "$A"; echo "$M"; [[ "$A" == "GET 200 "* && "$M" == "MANAGER 403 "* ]]

GET 200 593 login=ok MANAGER 403 402 login=ok

Manage the directory itself with the standard OpenLDAP tools. Bind as the directory administrator with the password from the credentials file, and never put the password on the command line:

sudo sac-ldap ldapsearch -LLL -b ou=people,dc=example,dc=com uid cn mail

dn: ou=people,dc=example,dc=com dn: uid=jane,ou=people,dc=example,dc=com uid: jane cn: Jane Example mail: jane@example.com dn: uid=llngadmin,ou=people,dc=example,dc=com uid: llngadmin cn: LemonLDAP::NG administrator

Register a relying party, which is a confidential client that uses the authorization-code flow with RS256-signed ID tokens. The client secret is generated on the instance and written only to a root-only file:

sudo lemonldap-ng-add-oidc-rp my-app https://app.example.com/callback

OIDC client my-app registered; its secret is in /root/lemonldap-ng-oidc-my-app.secret (root only)

Point your application at the issuer's discovery document:

H=$(head -1 /etc/sac/lemonldap-ng-host)
curl -s --cacert /etc/sac/tls/lemonldap-ng.crt --resolve "$H:443:127.0.0.1" "https://$H/.well-known/openid-configuration" \
  | jq '{issuer, authorization_endpoint, token_endpoint, jwks_uri}'

{ "issuer": "https://ec2-44-202-253-56.compute-1.amazonaws.com", "authorization_endpoint": "https://ec2-44-202-253-56.compute-1.amazonaws.com/oauth2/authorize", "token_endpoint": "https://ec2-44-202-253-56.compute-1.amazonaws.com/oauth2/token", "jwks_uri": "https://ec2-44-202-253-56.compute-1.amazonaws.com/oauth2/jwks" }

To see a sign-in end to end on the instance itself, run the image's probe. It signs Jane in, approves the consent screen, exchanges the code for tokens, and saves the ID token and the published keys. It then checks the ID token's signature against the keys. Each LemonLDAP::NG worker picks up a new configuration within a few seconds, which is why the probe pauses briefly after a client is registered.

sleep 5
H=$(head -1 /etc/sac/lemonldap-ng-host);
D=$(sudo mktemp -d /run/oidc-demo.XXXXXX)
sudo python3 -I /usr/local/lib/sac/lemonldap-ng/probe.py oidc "$H" jane /root/lemonldap-ng-user-jane.password \
  my-app /root/lemonldap-ng-oidc-my-app.secret https://app.example.com/callback "$D" \
  && sudo python3 -I /usr/local/lib/sac/lemonldap-ng/jwt-verify.py "$D/id_token" "$D/jwks.json" "https://$H"; OK=$?
sudo rm -rf "$D"; [ "$OK" -eq 0 ]

OIDC_TOKEN_OK sub=jane aud=my-app JWT_VERIFY OK kid=432dca08 iss=https://ec2-44-202-253-56.compute-1.amazonaws.com sub=jane

Every instance has its own signing key, so tokens from one instance never verify against another's keys. Remove a client with sudo lemonldap-ng-add-oidc-rp --delete my-app, or manage clients in the Manager under OpenID Connect Relying Parties.

The portal is also a SAML 2.0 identity provider. Give your service providers its metadata, which carries this instance's own signing certificate:

H=$(head -1 /etc/sac/lemonldap-ng-host)
curl -s --cacert /etc/sac/tls/lemonldap-ng.crt --resolve "$H:443:127.0.0.1" "https://$H/saml/metadata" \
  | grep -o 'entityID="[^"]*"\|<ds:X509Certificate>' | sort | uniq -c

6 <ds:X509Certificate> 1 entityID="https://ec2-44-202-253-56.compute-1.amazonaws.com/saml/metadata"

Register service providers in the Manager under SAML Service Providers. The CAS issuer is off. Switch it on in the Manager (General Parameters > Issuer modules > CAS) only together with an explicit list of CAS applications.

Point a DNS name at the instance, then run the following command. Replace sso.example.com with your name:

sudo lemonldap-ng-set-host sso.example.com

This command renders nginx for the name (other names are refused) and issues a new per-instance certificate for it. It also updates the portal URL, the OpenID Connect issuer and the SAML entity ID in LemonLDAP::NG's configuration. The update creates a new configuration version, and everything else you configured is kept. Update any relying parties and service providers registered against the old issuer.

The --cookie-domain example.com option shares the single sign-on cookie with other hosts in that domain. The default is a host-only cookie.

To use a certificate from a certificate authority, replace /etc/sac/tls/lemonldap-ng.crt and /etc/sac/tls/lemonldap-ng.key (root-only key) with yours and run sudo systemctl reload nginx.

nginx has an optional source-address list for /manager in addition to LemonLDAP::NG's own rule:

sudo cat /etc/nginx/sac/lemonldap-ng-manager-access.conf

# sac LemonLDAP::NG: optional source-address list for /manager (in addition to LemonLDAP::NG's own rule, # inGroup("llng-admins"), which applies to every manager request). Example: # allow 203.0.113.0/24; # deny all;

Add allow <your-network>; lines followed by deny all;, then sudo nginx -t && sudo systemctl reload nginx.

The directory refuses anonymous access:

ldapsearch -x -H ldap://127.0.0.1 -b dc=example,dc=com -s base dn 2>&1 | tail -1 || true

additional info: anonymous bind disallowed

The instance itself can reach the metadata service, but none of the LemonLDAP::NG, nginx or OpenLDAP services can. The Manager's server-side URL loader imports SAML metadata and discovery documents. It fails for the metadata address and works for other addresses:

curl -s -m 5 -o /dev/null -w 'host root shell, IMDS token request: %{http_code}\n' -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 60' http://169.254.169.254/latest/api/token for u in lemonldap-ng-fastcgi-server nginx slapd; do printf '%-28s %s\n' $u "$(systemctl show -p IPAddressDeny --value $u)"; done
H=$(head -1 /etc/sac/lemonldap-ng-host);
F=$(sudo mktemp /run/adm.XXXXXX)
sudo sh -c "sed -n 's/^LLNG_ADMIN_PASSWORD=//p' /root/lemonldap-ng-credentials.txt | tr -d '\n' > $F" P="$(sudo python3 -I /usr/local/lib/sac/lemonldap-ng/probe.py prx "$H" llngadmin "$F" http://169.254.169.254/latest/meta-data/)"
sudo shred -u "$F"; echo "$P"; [[ "$P" == "PRX 400 login=ok"*"timed out"* ]]

host root shell, IMDS token request: 200 lemonldap-ng-fastcgi-server ::ffff:169.254.169.254/128 168.63.129.16/32 169.254.169.254/32 fd00:ec2::254/128 nginx ::ffff:169.254.169.254/128 168.63.129.16/32 169.254.169.254/32 fd00:ec2::254/128 slapd ::ffff:169.254.169.254/128 168.63.129.16/32 169.254.169.254/32 fd00:ec2::254/128 PRX 400 login=ok Received unexpected HTTP status code 500 (Can't connect to 169.254.169.254:80 (Connection timed out)) when trying to load content from http://169.254.169.254/la

• LemonLDAP::NG's configuration is in /var/lib/lemonldap-ng/conf, with one JSON file per configuration version. The files contain the signing keys and the cipher key, so protect the backups. Run sudo -u www-data /usr/share/lemonldap-ng/bin/lemonldap-ng-cli save > conf.json to export the current version.
• The directory is in /var/lib/ldap. Export it with sudo slapcat -n 1 > directory.ldif.
• Keep /root/lemonldap-ng-credentials.txt with the backups. Sessions in /var/lib/lemonldap-ng/sessions are short-lived and need no backup.

LemonLDAP::NG is licensed under the GNU General Public License, version 2 or later. The image runs the unmodified packages from the project's repository:

cat /usr/share/doc/sac-lemonldap-ng/SOURCE.txt dpkg-query -W -f='${Package} ${Version}\n' liblemonldap-ng-portal-perl lemonldap-ng-fastcgi-server slapd nginx perl -MCryptX -MCrypt::JWT -e 'print "CryptX $CryptX::VERSION, Crypt::JWT $Crypt::JWT::VERSION\n"'

LemonLDAP::NG 2.23.4-1 (GPL-2.0-or-later) - https://lemonldap-ng.org/ ; source https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/tree/v2.23.4 Installed unmodified from upstream's signed apt repository https://lemonldap-ng.org/deb (suite 2.0, component main), signing key 986D22DD43D558F8144B14DA376D233B5AEB361B. Licence texts: /usr/share/doc/liblemonldap-ng-*-perl/copyright. Bundled artwork keeps upstream's licences (see those copyright files). Two artwork sets are not under an OSI licence but are freely redistributable as upstream ships them: static/common/2F/okta-*.png (unDraw licence) and the WebAuthn logo (webauthn.png, used to show built-in WebAuthn support). The Manager's AngularJS 1.7.9 is end-of-life upstream; see the guide. CryptX 0.091 and Crypt::JWT 0.038 (perl_5: Artistic-1.0-Perl OR GPL-1.0-or-later) - https://metacpan.org/release/MIK/ built from https://cpan.metacpan.org/authors/id/M/MI/MIK/CryptX-0.091.tar.gz (sha256 3a82d5cf786985e5de5339d1236ce4b27306db5e6b1ed5fa15038ded6d44859a) and https://cpan.metacpan.org/authors/id/M/MI/MIK/Crypt-JWT-0.038.tar.gz (sha256 160e64e26cfce81556b9f376dab4535ff0a17b80f44d1ffe3f41977a785c51c3) into /usr/local, instead of Ubuntu's libcryptx-perl 0.080 (CVE-2025-40914 fixed only in Ubuntu Pro ESM; CVE-2026-41564, CVE-2026-41565, CVE-2026-13758 unfixed in Ubuntu) and libcrypt-jwt-perl, which are not installed. The installed modules are byte-identical to the tarballs (cpan-modules.sha256); their POD carries upstream's documentation EXAMPLE keys (e.g. Crypt::PK::RSA), listed by exact path + sha256 in cpan-pem-labels.sha256. No man pages are installed. Everything else is unmodified Ubuntu 24.04 packages (nginx, OpenLDAP slapd, Perl and LemonLDAP::NG's Perl dependencies). lemonldap-ng-fastcgi-server 2.23.4-1 liblemonldap-ng-portal-perl 2.23.4-1 nginx 1.24.0-2ubuntu7.19 slapd 2.6.10+dfsg-0ubuntu0.24.04.1 CryptX 0.091, Crypt::JWT 0.038

OpenLDAP is distributed under The OpenLDAP Public License 2.8 (/usr/share/doc/slapd/copyright); nginx, Perl and the Perl modules are Ubuntu packages under their own licences (/usr/share/doc/<package>/copyright). CryptX and Crypt::JWT are under the Perl licence (Artistic License or GPL).

• Advisories. No published LemonLDAP::NG advisory affects 2.23.4. Ubuntu's CryptX 0.080 has four advisories (CVE-2025-40914, fixed only in Ubuntu Pro; CVE-2026-41564, CVE-2026-41565 and CVE-2026-13758, not fixed in Ubuntu); the image therefore runs CryptX 0.091 and Crypt::JWT 0.038 from CPAN instead, and Ubuntu's copies are not installed.
• Perl modules from Ubuntu universe. LemonLDAP::NG needs Perl modules that Ubuntu 24.04 ships only in its community-maintained universe section (for example Plack, Apache::Session, FCGI::ProcManager, Lasso for SAML). The image was checked for fixes available only through Ubuntu Pro (none). Open, unfixed advisories in these modules were checked against how LemonLDAP::NG uses them and are not reachable here: Plack CVE-2026-110332..110336 and CVE-2026-7381 (upload names, URL maps, recursion, error documents, X-Sendfile and the built-in HTTP server are not used; nginx normalises paths and the Manager rule is path-independent), Apache::Session CVE-2025-40931 and CVE-2026-5081 (the MD5 and mod_unique_id session-id generators are not used; LemonLDAP::NG uses its own SHA-256 generator) and CVE-2013-10075 (an expired or unknown session id never becomes a valid session), Crypt::OpenSSL::X509 CVE-2026-58101/58102 (certificate extension helpers are not called).
• The Manager's browser libraries. The Manager's single-page interface uses AngularJS 1.7.9, which is end-of-life upstream and has published advisories with no fixed release. They concern features this Manager does not use (resource-URL allow lists, ng-srcset) or affect only the administrator's own browser (regular-expression slowness), and the Manager is reachable only by llng-admins members (Steps 7 and 12). The bundled documentation pages use Bootstrap 3.4.1.
• Bundled artwork. Two upstream images are under licences that are free to use but not open source: the unDraw illustrations for the Okta second-factor modules and the WebAuthn logo. They ship unmodified, as the project distributes them.
• Hardening in place. Brute-force protection, CSRF tokens on the sign-in form, secure HttpOnly SameSite cookies and a per-client request limit in nginx. Dynamic OpenID Connect client registration, the implicit and hybrid flows and the CAS issuer are off.