LemonLDAP::NG 2.21 LTS

Why the cloudimg image

A default LemonLDAP::NG installation selects its demo authentication backend, and that backend is not a placeholder with a weak password: it accepts any user whose password matches their username, and one of the accounts it resolves is granted the Manager, the full administration console. A stock install therefore ships a working administrator. This image does not. First boot moves authentication onto a directory created on your own machine, mints a per machine administrator password, and generates the SAML signing certificate, the OpenID Connect signing key, the session cipher key and the TLS certificate there too, so no customer shares a signing key with any other. Before release the demo accounts were confirmed refused while the per machine credential signed in and reached the Manager, and two machines from the image were compared label by label with all fifteen per machine secrets differing. Off box ports are 22 and 443 only, the directory is bound to loopback, and it is paired with a deployment guide and cloudimg support. SAML is shipped with published metadata carrying this machine's own signing certificate; a full browser SAML round trip needs an external service provider and was not performed, while OpenID Connect and CAS were each proven end to end.