SHSelfHostIndex

LemonLDAP::NG vs Shibboleth Identity Provider

A side-by-side comparison of two self-hosted identity & sso options — licensing, setup difficulty, resource needs, and what each one replaces.

Not the right match-up?
LE LemonLDAP::NG Web single sign-on and access management system VS SH Shibboleth Identity Provider Standards-based SAML identity provider for federations
FeatureLemonLDAP::NGShibboleth Identity Provider
Deploy effortUnder-an-hour setupUnder-an-hour setup
CategoryIdentity & SSOIdentity & SSO
LicenseGPL-2.0Apache-2.0
LanguagePerlJava
Setup difficultyHardHard
Min. RAM1,024 MB1,024 MB
Deploymentdocker, bare-metalbare-metal, docker, source
GitHub stars★ 84★ 200
First released20052003
ReplacesOkta, PingFederateOkta, Ping Identity

What are LemonLDAP::NG and Shibboleth Identity Provider?

LemonLDAP::NG

LemonLDAP::NG is an open-source Web SSO, access management, and identity federation product. It supports SAML, OpenID Connect, and CAS, and protects web applications behind a configurable portal.

  • Web SSO portal
  • SAML and OIDC support
  • CAS protocol
  • Fine-grained access rules

Shibboleth Identity Provider

The Shibboleth Identity Provider is an open-source SAML identity provider widely used in research and education federations. It enables secure single sign-on and attribute release across organizations.

  • SAML 2.0 identity provider
  • Attribute resolution and release policies
  • Federation metadata support
  • Used by academic federations worldwide

LemonLDAP::NG vs Shibboleth Identity Provider: key differences

LemonLDAP::NG is written in Perl, while Shibboleth Identity Provider is built with Java. Licensing differs — GPL-2.0 for LemonLDAP::NG versus Apache-2.0 for Shibboleth Identity Provider. Shibboleth Identity Provider is the more established project (first released 2003), while LemonLDAP::NG arrived in 2005. Shibboleth Identity Provider has the considerably larger community, at 200 GitHub stars versus 84.

Why pick each one

Choose LemonLDAP::NG if…

  • Mature and full-featured
  • Many protocol options

Watch out for

  • Complex configuration
  • Perl stack is uncommon
LemonLDAP::NG details

Choose Shibboleth Identity Provider if…

  • Gold standard for SAML federations
  • Highly configurable

Watch out for

  • Complex setup
  • SAML-centric
Shibboleth Identity Provider details

Frequently asked questions

Is LemonLDAP::NG or Shibboleth Identity Provider better?

Neither is universally better. Shibboleth Identity Provider has the larger community; both share a hard setup difficulty, so the decision comes down to features and licensing.

Are LemonLDAP::NG and Shibboleth Identity Provider free and open-source?

Yes. LemonLDAP::NG is licensed under GPL-2.0 and Shibboleth Identity Provider under Apache-2.0. Both can be self-hosted at no software cost.

Can I run LemonLDAP::NG and Shibboleth Identity Provider with Docker?

LemonLDAP::NG: yes. Shibboleth Identity Provider: yes.

Related comparisons