docs: added SAML documentation.

- Remove few obsolete replaces
- update authentication docs
- cleanups and fixes

docs/auth/auth-saml-duosecurity.rst

@@ -0,0 +1,105
+.. _config-saml-duosecurity-ref:
+
+
+SAML 2.0 with Duo Security
+--------------------------
+
+**This plugin is available only in EE Edition.**
+
+|RCE| supports SAML 2.0 Authentication with Duo Security provider. This allows
+users to log-in to RhodeCode via SSO mechanism of external identity provider
+such as Duo. The login can be triggered either by the external IDP, or internally
+by clicking specific authentication button on the log-in page.
+
+
+Configuration steps
+^^^^^^^^^^^^^^^^^^^
+
+To configure Duo Security SAML authentication, use the following steps:
+
+1. From the |RCE| interface, select
+   :menuselection:`Admin --> Authentication`
+2. Activate the `Duo Security` plugin and select :guilabel:`Save`
+3. Go to newly available menu option called `Duo Security` on the left side.
+4. Check the `enabled` check box in the plugin configuration section,
+   and fill in the required SAML information and :guilabel:`Save`, for more details,
+   see :ref:`config-saml-duosecurity`
+
+
+.. _config-saml-duosecurity:
+
+
+Example SAML Duo Security configuration
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Example configuration for SAML 2.0 with Duo Security provider::
+
+    *option*: `enabled` => `True`
+    # Enable or disable this authentication plugin.
+
+    *option*: `cache_ttl` => `0`
+    # Amount of seconds to cache the authentication and permissions check response call for this plugin.
+    # Useful for expensive calls like LDAP to improve the performance of the system (0 means disabled).
+
+    *option*: `debug` => `True`
+    # Enable or disable debug mode that shows SAML errors in the RhodeCode logs.
+
+    *option*: `entity_id` => `http://rc-app.com/dag/saml2/idp/metadata.php`
+    # Identity Provider entity/metadata URI.
+    # E.g. https://duo-gateway.com/dag/saml2/idp/metadata.php
+
+    *option*: `sso_service_url` => `http://rc-app.com/dag/saml2/idp/SSOService.php?spentityid=http://rc.local.pl/_admin/auth/duosecurity/saml-metadata`
+    # SSO (SingleSignOn) endpoint URL of the IdP. This can be used to initialize login
+    # E.g. https://duo-gateway.com/dag/saml2/idp/SSOService.php?spentityid=<metadata_entity_id>
+
+    *option*: `slo_service_url` => `http://rc-app.com/dag/saml2/idp/SingleLogoutService.php?ReturnTo=http://rc-app.com/dag/module.php/duosecurity/logout.php`
+    # SLO (SingleLogout) endpoint URL of the IdP.
+    # E.g. https://duo-gateway.com/dag/saml2/idp/SingleLogoutService.php?ReturnTo=http://duo-gateway.com/_admin/saml/sign-out-endpoint
+
+    *option*: `x509cert` => `<CERTIFICATE_STRING>`
+    # Identity provider public x509 certificate. It will be converted to single-line format without headers
+
+    *option*: `name_id_format` => `sha-1`
+    # The format that specifies how the NameID is sent to the service provider.
+
+    *option*: `signature_algo` => `sha-256`
+    # Type of Algorithm to use for verification of SAML signature on Identity provider side
+
+    *option*: `digest_algo` => `sha-256`
+    # Type of Algorithm to use for verification of SAML digest on Identity provider side
+
+    *option*: `cert_dir` => `/etc/saml/`
+    # Optional directory to store service provider certificate and private keys.
+    # Expected certs for the SP should be stored in this folder as:
+    #  * sp.key     Private Key
+    #  * sp.crt     Public cert
+    #  * sp_new.crt Future Public cert
+    #
+    # Also you can use other cert to sign the metadata of the SP using the:
+    #  * metadata.key
+    #  * metadata.crt
+
+    *option*: `user_id_attribute` => `PersonImmutableID`
+    # User ID Attribute name. This defines which attribute in SAML response will be used to link accounts via unique id.
+    # Ensure this is returned from DuoSecurity for example via duo_username
+
+    *option*: `username_attribute` => `User.username`
+    # Username Attribute name. This defines which attribute in SAML response will map to an username.
+
+    *option*: `email_attribute` => `User.email`
+    # Email Attribute name. This defines which attribute in SAML response will map to an email address.
+
+
+Below is example setup from DUO Administration page that can be used with above config.
+
+.. image:: ../images/saml-duosecurity-service-provider-example.png
+   :alt: DUO Security SAML setup example
+   :scale: 50 %
+
+
+Below is an example attribute mapping set for IDP provider required by the above config.
+
+
+.. image:: ../images/saml-duosecurity-attributes-example.png
+   :alt: DUO Security SAML setup example
+   :scale: 50 %
  No newline at end of file

docs/auth/auth-saml-generic.rst

@@ -0,0 +1,18
+.. _config-saml-generic-ref:
+
+
+SAML 2.0 Authentication
+-----------------------
+
+
+**This plugin is available only in EE Edition.**
+
+RhodeCode Supports standard SAML 2.0 SSO for the web-application part.
+
+Please check for reference two example providers:
+
+.. toctree::
+
+   auth-saml-duosecurity
+   auth-saml-onelogin
+

docs/auth/auth-saml-onelogin.rst

@@ -0,0 +1,106
+.. _config-saml-onelogin-ref:
+
+
+SAML 2.0 with One Login
+-----------------------
+
+**This plugin is available only in EE Edition.**
+
+|RCE| supports SAML 2.0 Authentication with OneLogin provider. This allows
+users to log-in to RhodeCode via SSO mechanism of external identity provider
+such as OneLogin. The login can be triggered either by the external IDP, or internally
+by clicking specific authentication button on the log-in page.
+
+
+Configuration steps
+^^^^^^^^^^^^^^^^^^^
+
+To configure OneLogin SAML authentication, use the following steps:
+
+1. From the |RCE| interface, select
+   :menuselection:`Admin --> Authentication`
+2. Activate the `OneLogin` plugin and select :guilabel:`Save`
+3. Go to newly available menu option called `OneLogin` on the left side.
+4. Check the `enabled` check box in the plugin configuration section,
+   and fill in the required SAML information and :guilabel:`Save`, for more details,
+   see :ref:`config-saml-onelogin`
+
+
+.. _config-saml-onelogin:
+
+
+Example SAML OneLogin configuration
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Example configuration for SAML 2.0 with OneLogin provider::
+
+    *option*: `enabled` => `True`
+    # Enable or disable this authentication plugin.
+
+    *option*: `cache_ttl` => `0`
+    # Amount of seconds to cache the authentication and permissions check response call for this plugin.
+    # Useful for expensive calls like LDAP to improve the performance of the system (0 means disabled).
+
+    *option*: `debug` => `True`
+    # Enable or disable debug mode that shows SAML errors in the RhodeCode logs.
+
+    *option*: `entity_id` => `https://app.onelogin.com/saml/metadata/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`
+    # Identity Provider entity/metadata URI.
+    # E.g. https://app.onelogin.com/saml/metadata/<onelogin_connector_id>
+
+    *option*: `sso_service_url` => `https://customer-domain.onelogin.com/trust/saml2/http-post/sso/xxxxxx`
+    # SSO (SingleSignOn) endpoint URL of the IdP. This can be used to initialize login
+    # E.g. https://app.onelogin.com/trust/saml2/http-post/sso/<onelogin_connector_id>
+
+    *option*: `slo_service_url` => `https://customer-domain.onelogin.com/trust/saml2/http-redirect/slo/xxxxxx`
+    # SLO (SingleLogout) endpoint URL of the IdP.
+    # E.g. https://app.onelogin.com/trust/saml2/http-redirect/slo/<onelogin_connector_id>
+
+    *option*: `x509cert` => `<CERTIFICATE_STRING>`
+    # Identity provider public x509 certificate. It will be converted to single-line format without headers
+
+    *option*: `name_id_format` => `sha-1`
+    # The format that specifies how the NameID is sent to the service provider.
+
+    *option*: `signature_algo` => `sha-256`
+    # Type of Algorithm to use for verification of SAML signature on Identity provider side
+
+    *option*: `digest_algo` => `sha-256`
+    # Type of Algorithm to use for verification of SAML digest on Identity provider side
+
+    *option*: `cert_dir` => `/etc/saml/`
+    # Optional directory to store service provider certificate and private keys.
+    # Expected certs for the SP should be stored in this folder as:
+    #  * sp.key     Private Key
+    #  * sp.crt     Public cert
+    #  * sp_new.crt Future Public cert
+    #
+    # Also you can use other cert to sign the metadata of the SP using the:
+    #  * metadata.key
+    #  * metadata.crt
+
+    *option*: `user_id_attribute` => `PersonImmutableID`
+    # User ID Attribute name. This defines which attribute in SAML response will be used to link accounts via unique id.
+    # Ensure this is returned from OneLogin for example via Internal ID
+
+    *option*: `username_attribute` => `User.username`
+    # Username Attribute name. This defines which attribute in SAML response will map to an username.
+
+    *option*: `email_attribute` => `User.email`
+    # Email Attribute name. This defines which attribute in SAML response will map to an email address.
+
+
+
+Below is example setup that can be used with OneLogin SAML authentication that can be used with above config..
+
+.. image:: ../images/saml-onelogin-config-example.png
+   :alt: OneLogin SAML setup example
+   :scale: 50 %
+
+
+Below is an example attribute mapping set for IDP provider required by the above config.
+
+
+.. image:: ../images/saml-onelogin-attributes-example.png
+   :alt: OneLogin SAML setup example
+   :scale: 50 %
  No newline at end of file

docs/admin/adding-anonymous-user.rst

@@ -3,19 +3,19
 Anonymous Users
 ---------------
 
-By default, |RCM| provides |repo| access for registered users only. It can be
+By default, |RCE| provides |repo| access for registered users only. It can be
 configured to be **world-open** in terms of read and write permissions. This
-configuration is called "Anonymous Access" and allows |RCM| to be used as a
+configuration is called "Anonymous Access" and allows |RCE| to be used as a
 public hub where unregistered users have access to your |repos|.
 
 Anonymous access is useful for open source projects, universities,
 or if running inside a restricted internal corporate network to serve
 documents to all employees. Anonymous users get the default user permission
-settings that are applied across the whole |RCM| system.
+settings that are applied across the whole |RCE| system.
 
 To enable anonymous access to your |repos|, use the following steps:
 
-1. From the |RCM| interface, select :menuselection:`Admin --> Permissions`.
+1. From the |RCE| interface, select :menuselection:`Admin --> Permissions`.
 2. On the Application tab, check the :guilabel:`Allow anonymous access` box.
 3. Select :guilabel:`Save`.
 4. To set the anonymous user access permissions, which are based on the

docs/admin/admin-tricks.rst

@@ -166,7 +166,7 2. Add your custom hook details, you can
    ``pretxnchangegroup.example`` with value ``python:/path/to/custom_hook.py:my_func_name``
 3. Select :guilabel:`Save`
 
-Also, see the |RC| Extensions section of the :ref:`rc-tools` guide. |RC|
+Also, see the RhodeCode Extensions section of the :ref:`rc-tools` guide. RhodeCode
 Extensions can be used to add additional hooks to your instance and comes
 with a number of pre-built plugins if you chose to install them.
 

docs/admin/apache-wsgi-coding.rst

@@ -3,7 +3,7
 Apache WSGI Configuration
 ^^^^^^^^^^^^^^^^^^^^^^^^^
 
-|RCM| can also be set up with Apache under ``mod_wsgi``. To configure this
+|RCE| can also be set up with Apache under ``mod_wsgi``. To configure this
 use the following steps.
 
 1. Install ``mod_wsgi`` using the following command:
@@ -50,6 +50,6 The following is an example ``wsgi`` dis
 .. note::
 
    When using `mod_wsgi` the same version of |hg| must be running in your
-   system's |PY| environment and on |RCM|. To check the |RCM| version,
+   system's |PY| environment and on |RCE|. To check the |RCE| version,
    on the interface go to
    :menuselection:`Admin --> Settings --> System Info`

docs/admin/config-files-overview.rst

@@ -67,7 +67,7 sections.
         Default location: :file:`/home/{user}/.rccontrol/cache/MANIFEST`
 
         |RCC| uses this file to source the latest available builds from the
-        secure |RC| download channels. The only reason to mess with this file
+        secure RhodeCode download channels. The only reason to mess with this file
         is if you need to do an offline installation,
         see the :ref:`Offline Installation<control:offline-installer-ref>`
         instructions, otherwise |RCC| will completely manage this file.

docs/admin/glossary.rst

@@ -33,7 +33,7 Glossary
         Adding more machines or workers into your pool of resources.
 
     Instance
-        A single installed version of one of the |RC| products. It could
+        A single installed version of one of the RhodeCode products. It could
         refer to |RCE| or the VCS server depending on the context.
 
     Plugin

docs/admin/indexing.rst

@@ -3,7 +3,7
 Full-text Search
 ----------------
 
-By default |RC| is configured to use `Whoosh`_ to index |repos| and
+By default RhodeCode is configured to use `Whoosh`_ to index |repos| and
 provide full-text search.
 
 |RCE| also provides support for `Elasticsearch`_ as a backend for scalable
@@ -46,7 +46,7 Configure the ``.rhoderc`` File
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
 |RCT| uses the :file:`/home/{user}/.rhoderc` file for connection details
-to |RCM| instances. If this file is not automatically created,
+to |RCE| instances. If this file is not automatically created,
 you can configure it using the following example. You need to configure the
 details for each instance you want to index.
 
@@ -62,7 +62,7 details for each instance you want to in
      - VERSION: 1.5.0
      - URL: http://127.0.0.1:10000
 
-To get your API Token, on the |RCM| interface go to
+To get your API Token, on the |RCE| interface go to
 :menuselection:`username --> My Account --> Auth tokens`
 
 .. code-block:: ini

docs/admin/public-access.rst

@@ -3,7 +3,7
 Public Access
 -------------
 
-By default |RCM| allows users to read all **public** |repos|. User
+By default |RCE| allows users to read all **public** |repos|. User
 permissions and |repo| access can be configured explicitly,
 and those permissions will override any default settings. The default
 settings can be found under the following section:

docs/admin/setting-default-permissions.rst

@@ -3,7 +3,7
 Setting Default Permissions
 ---------------------------
 
-Default permissions allow you to configure |RCM| so that when a new |repo|, user group,
+Default permissions allow you to configure |RCE| so that when a new |repo|, user group,
 or user is created their permissions are already defined. To set default permissions you need administrator
 privileges. See the following sections for setting up your permissions system:
 
@@ -19,7 +19,7 Setting User defaults
 
 To set default user permissions, use the following steps.
 
-1. From the |RCM| interface, select :menuselection:`Admin --> Permissions`
+1. From the |RCE| interface, select :menuselection:`Admin --> Permissions`
 2. Select the :guilabel:`Global` tab from the left-hand menu. The permissions
    set on this screen apply to users and user-groups across the whole instance.
 3. Save your changes
@@ -31,7 +31,7 Setting User Group defaults
 
 To set default user group permissions, use the following steps.
 
-1. From the |RCM| interface, select :menuselection:`Admin --> User groups`
+1. From the |RCE| interface, select :menuselection:`Admin --> User groups`
 2. Select :guilabel:`Permissions`, and configure the default user
    permissions. All users will get these permissions unless
    individually set.
@@ -48,7 +48,7 Setting Repository defaults
 
 To set default |repo| permissions, use the following steps.
 
-1. From the |RCM| interface, select :menuselection:`Admin --> Permissions`
+1. From the |RCE| interface, select :menuselection:`Admin --> Permissions`
 2. Select the :guilabel:`Object` tab from the left-hand menu and set the
    |perm| permissions
 3. Save your changes
@@ -60,7 +60,7 Setting Repository Group defaults
 
 To set default Repository Group permissions, use the following steps.
 
-1. From the |RCM| interface, select :menuselection:`Admin --> Repository Groups`
+1. From the |RCE| interface, select :menuselection:`Admin --> Repository Groups`
 2. Select :guilabel:`Edit` beside the |repo| group you wish to configure
 3. On the left-hand pane select :guilabel:`Permissions`
 4. Set the default permissions for all |repos| created in this group

docs/admin/setting-repo-perms.rst

@@ -3,12 +3,12
 Repository Administration
 =========================
 
-Repository permissions in |RCM| can be managed in a number of different ways.
+Repository permissions in |RCE| can be managed in a number of different ways.
 This overview should give you an insight into how you could adopt particular
 settings for your needs:
 
 * Global |repo| permissions: This allows you to set the default permissions
-  for each new |repo| created within |RCM|, see :ref:`repo-default-ref`. All
+  for each new |repo| created within |RCE|, see :ref:`repo-default-ref`. All
   |repos| created will inherit these permissions unless explicitly configured.
 * Individual |repo| permissions: To set individual |repo| permissions,
   see :ref:`set-repo-perms`.

docs/admin/system-overview.rst

@@ -59,7 +59,7 Supported Browsers
 System Requirements
 -------------------
 
-|RCM| performs best on machines with ultra-fast hard disks. Generally disk
+|RCE| performs best on machines with ultra-fast hard disks. Generally disk
 performance is more important than CPU performance. In a corporate production
 environment handling 1000s of users and |repos| you should deploy on a 12+
 core 64GB RAM server. In short, the more RAM the better.
@@ -68,7 +68,7 core 64GB RAM server. In short, the more
 For example:
 
  - for team of 1 - 5 active users you can run on 1GB RAM machine with 1CPU
- - above 250 active users, |RCM| needs at least 8GB of memory.
+ - above 250 active users, |RCE| needs at least 8GB of memory.
    Number of CPUs is less important, but recommended to have at least 2-3 CPUs
 
 
@@ -114,7 +114,7 Connection Methods
 
 * HTTPS
 * SSH
-* |RCM| API
+* |RCE| API
 
 Internationalization Support
 ----------------------------

docs/admin/user-admin.rst

@@ -3,7 +3,7
 User Administration
 ===================
 
-|RCM| enables you to define permissions for the following entities within the
+|RCE| enables you to define permissions for the following entities within the
 system; **users**, **user groups**, **repositories**, **repository groups**.
 
 Within each one of these entities you can set default settings,

docs/admin/vcs-server.rst

@@ -3,13 +3,13
 VCS Server Management
 ---------------------
 
-The VCS Server handles |RCM| backend functionality. You need to configure
-a VCS Server to run with a |RCM| instance. If you do not, you will be missing
-the connection between |RCM| and its |repos|. This will cause error messages
+The VCS Server handles |RCE| backend functionality. You need to configure
+a VCS Server to run with a |RCE| instance. If you do not, you will be missing
+the connection between |RCE| and its |repos|. This will cause error messages
 on the web interface. You can run your setup in the following configurations,
 currently the best performance is one of following:
 
-* One VCS Server per |RCM| instance.
+* One VCS Server per |RCE| instance.
 * One VCS Server handling multiple instances.
 
 .. important::
@@ -49,7 +49,7 To configure a |RCE| instance to use a V
 |RCE| VCS Server Options
 ^^^^^^^^^^^^^^^^^^^^^^^^
 
-The following list shows the available options on the |RCM| side of the
+The following list shows the available options on the |RCE| side of the
 connection to the VCS Server. The settings are configured per
 instance in the
 :file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file.
@@ -75,7 +75,7 instance in the
 
     \vcs.server <host:port>
         Set the host, either hostname or IP Address, and port of the VCS server
-        you wish to run with your |RCM| instance.
+        you wish to run with your |RCE| instance.
 
 .. code-block:: ini
 

docs/api/api.rst

@@ -22,12 +22,12 API access can also be turned on for eac
 decorated with a `@LoginRequired` decorator. To enable API access, change
 the standard login decorator to `@LoginRequired(api_access=True)`.
 
-From |RCM| version 1.7.0 you can configure a white list
+From |RCE| version 1.7.0 you can configure a white list
 of views that have API access enabled by default. To enable these,
-edit the |RCM| configuration ``.ini`` file. The default location is:
+edit the |RCE| configuration ``.ini`` file. The default location is:
 
-* |RCM| Pre-2.2.7 :file:`root/rhodecode/data/production.ini`
-* |RCM| 3.0 :file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini`
+* |RCE| Pre-2.2.7 :file:`root/rhodecode/data/production.ini`
+* |RCE| 3.0 :file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini`
 
 To configure the white list, edit this section of the file. In this
 configuration example, API access is granted to the patch/diff raw file and

docs/auth/auth-crowd.rst

@@ -5,8 +5,8 Crowd
 
 To enable Crowd authentication, use the following steps:
 
-1. From the |RCM| interface, go to :menuselection:`Admin --> Authentication`
-2. Enable the ``rhodecode.lib.auth_modules.auth_crowd`` library and select
+1. From the |RCE| interface, go to :menuselection:`Admin --> Authentication`
+2. Activate the ``rhodecode.lib.auth_modules.auth_crowd`` library and select
    :guilabel:`Save`
 3. On the Crowd plugin settings section, do the following:
 

docs/auth/auth-ldap-groups.rst

@@ -3,25 +3,24
 LDAP/AD With User Groups Sync
 -----------------------------
 
-|RCM| supports LDAP (Lightweight Directory Access Protocol) or
+**This plugin is available only in EE Edition.**
+
+|RCE| supports LDAP (Lightweight Directory Access Protocol) or
 AD (active Directory) authentication.
-All LDAP versions are supported, with the following |RCM| plugins managing each:
-
-* For LDAP/AD with user group sync use ``LDAP + User Groups (egg:rhodecode-enterprise-ee#ldap_group)``
+All LDAP versions are currently supported.
 
 RhodeCode reads all data defined from plugin and creates corresponding
 accounts on local database after receiving data from LDAP. This is done on
 every user log-in including operations like pushing/pulling/checkout.
 In addition group membership is read from LDAP and following operations are done:
 
-- automatic addition of user to |RCM| user group
-- automatic removal of user from any other  |RCM| user groups not specified in LDAP.
+- automatic addition of user to |RCE| user group
+- automatic removal of user from any other  |RCE| user groups not specified in LDAP.
   The removal is done *only* on groups that are marked to be synced from ldap.
   This setting can be changed in advanced settings on user groups
-- automatic creation of user groups if they aren't yet existing in |RCM|
+- automatic creation of user groups if they aren't yet existing in |RCE|
 - marking user as super-admins if he is a member of any admin group defined in plugin settings
 
-This plugin is available only in EE Edition.
 
 .. important::
 
@@ -39,11 +38,12 LDAP Configuration Steps
 
 To configure |LDAP|, use the following steps:
 
-1. From the |RCM| interface, select
+1. From the |RCE| interface, select
    :menuselection:`Admin --> Authentication`
-2. Enable the ldap+ groups plugin and select :guilabel:`Save`
-3. Select the :guilabel:`Enabled` check box in the plugin configuration section
-4. Add the required LDAP information and :guilabel:`Save`, for more details,
+2. Activate the `LDAP + User Groups` plugin and select :guilabel:`Save`
+3. Go to newly available menu option called `LDAP + User Groups` on the left side.
+4. Check the `enabled` check box in the plugin configuration section,
+   and fill in the required LDAP information and :guilabel:`Save`, for more details,
    see :ref:`config-ldap-groups-examples`
 
 For a more detailed description of LDAP objects, see :ref:`ldap-gloss-ref`:
@@ -52,59 +52,107 For a more detailed description of LDAP
 
 Example LDAP configuration
 ^^^^^^^^^^^^^^^^^^^^^^^^^^
-.. code-block:: bash
+
+Below is example setup that can be used with Active Directory and LDAP server with groups sync::
+
+    *option*: `enabled` => `True`
+    # Enable or disable this authentication plugin.
+
+    *option*: `cache_ttl` => `360`
+    # Amount of seconds to cache the authentication and permissions check response call for this plugin.
+    # Useful for expensive calls like LDAP to improve the performance of the system (0 means disabled).
+
+    *option*: `host` => `192.168.245.143,192.168.1.240`
+    # Host[s] of the LDAP Server
+    # (e.g., 192.168.2.154, or ldap-server.domain.com.
+    #  Multiple servers can be specified using commas
+
+    *option*: `port` => `389`
+    # Custom port that the LDAP server is listening on. Default value is: 389, use 689 for LDAPS(SSL)
+
+    *option*: `timeout` => `300`
+    # Timeout for LDAP connection
+
+    *option*: `dn_user` => `[e-mail]`
+    # Optional user DN/account to connect to LDAP if authentication is required.
+    # e.g., cn=admin,dc=mydomain,dc=com, or uid=root,cn=users,dc=mydomain,dc=com, or [e-mail]
+
+    *option*: `dn_pass` => `SomeSecret`
+    # Password to authenticate for given user DN.
+
+    *option*: `tls_kind` => `PLAIN`
+    # TLS Type
+
+    *option*: `tls_reqcert` => `NEVER`
+    # Require Cert over TLS?. Self-signed and custom certificates can be used when
+    #  `RhodeCode Certificate` found in admin > settings > system info page is extended.
+
+    *option*: `tls_cert_file` => ``
+    # This specifies the PEM-format file path containing certificates for use in TLS connection.
+    # If not specified `TLS Cert dir` will be used
+
+    *option*: `tls_cert_dir` => `/etc/openldap/cacerts`
+    # This specifies the path of a directory that contains individual CA certificates in separate files.
+
+    *option*: `base_dn` => `dc=rhodecode,dc=com`
+    # Base DN to search. Dynamic bind is supported. Add `$login` marker in it to be replaced with current user credentials
+    # (e.g., dc=mydomain,dc=com, or ou=Users,dc=mydomain,dc=com)
+
+    *option*: `user_search_base` => `ou=RC-Users`
+    # User search base will extend the Base DN
+    # (e.g., ou=Users will result in ou=Users,dc=mydomain,dc=com root DN)
 
-        # Auth Cache TTL, Defines the caching for authentication to offload LDAP server.
-        # This means that cache result will be saved for 3600 before contacting LDAP server to verify the user access
-        3600
-        # Host, comma seperated format is optionally possible to specify more than 1 server
-        https://ldap1.server.com/ldap-admin/,https://ldap2.server.com/ldap-admin/
-        # Default LDAP Port, use 689 for LDAPS
-        389
-        # Account, used for SimpleBind if LDAP server requires an authentication
-        e.g [e-mail]
-        # Password used for simple bind
-        ldap-user-password
-        # LDAP connection security
-        LDAPS
-        # Certificate checks level
-        DEMAND
-        # Base DN
-        cn=Rufus Magillacuddy,ou=users,dc=rhodecode,dc=com
-        # User Search Base
-        ou=groups,ou=users
-        # LDAP search filter to narrow the results
-        (objectClass=person)
-        # LDAP search scope
-        SUBTREE
-        # Login attribute
-        sAMAccountName
-        # First Name Attribute to read
-        givenName
-        # Last Name Attribute to read
-        sn
-        # Email Attribute to read email address from
-        mail
-        # group extraction method
-        rfc2307bis
-        # Group search base
-        ou=RC-Groups
-        # Group Name Attribute, field to read the group name from
-        sAMAAccountName
-        # User Member of Attribute, field in which groups are stored
-        memberOf
-        # LDAP Group Search Filter, allows narrowing the results
+    *option*: `user_search_filter` => ``
+    # Filter to narrow results
+    # (e.g., (&(objectCategory=Person)(objectClass=user)), or
+    # (memberof=cn=rc-login,ou=groups,ou=company,dc=mydomain,dc=com)))
+
+    *option*: `search_scope` => `SUBTREE`
+    # How deep to search LDAP. If unsure set to SUBTREE
+
+    *option*: `attr_login` => `sAMAccountName`
+    # LDAP Attribute to map to user name (e.g., uid, or sAMAccountName)
+
+    *option*: `attr_email` => `mail`
+    # LDAP Attribute to map to email address (e.g., mail).
+    # Emails are a crucial part of RhodeCode.
+    # If possible add a valid email attribute to ldap users.
+
+    *option*: `attr_firstname` => `givenName`
+    # LDAP Attribute to map to first name (e.g., givenName)
+
+    *option*: `attr_lastname` => `sn`
+    # LDAP Attribute to map to last name (e.g., sn)
+
+    *option*: `group_extraction_type` => `rfc2307bis`
+    # With rfc2307, group members are listed by name in the memberUid attribute
+    # With rfc2307bis (Microsoft AD compatible) group members are listed by DN and stored in the member attribute
 
-        # Admin Groups. Comma separated list of groups. If user is member of
-        # any of those he will be marked as super-admin in RhodeCode
-        admins, management
+    *option*: `group_search_base` => `ou=RC-Groups`
+    # Group search base will extend the Base DN (e.g. ou=Groups will result in ou=Groups,dc=mydomain,dc=com)
 
+    *option*: `group_name_attr` => `sAMAccountName`
+    # LDAP Attribute to map to group name (e.g., cn, or sAMAccountName)
+
+    *option*: `user_member_of` => `memberOf`
+    # Users Attribute used to fetch the group membership.
+    # Use if users have stored group membership inside their attributes
+    # (e.g., memberOf, or userMemberOf)
 
-Below is example setup that can be used with Active Directory and ldap groups.
+    *option*: `group_search_filter` => ``
+    # Filter to narrow results (e.g., (&(objectCategory=Group)(objectClass=group)), etc)
+
+    *option*: `group_member_of` => `memberOf`
+    # LDAP Attribute used to resolve the parent group (e.g., memberOf)
 
-.. image:: ../images/ldap-groups-example.png
-   :alt: LDAP/AD setup example
-   :scale: 50 %
+    *option*: `admin_groups` => `Admins,Management`
+    # A comma separated list of group names that identify users as RhodeCode Administrators (e.g., admins)
+
+    *option*: `admin_groups_sync` => `full`
+    # Way to sync Admin groups.
+    # Full means admin flag is set to on or off according to membership in administrator group defined above.
+    # On-only means the flag is only set to on, and not turned off once user is no longer a member
+
 
 .. toctree::
 

docs/auth/auth-ldap.rst

@@ -3,11 +3,9
 LDAP/AD
 -------
 
-|RCM| supports LDAP (Lightweight Directory Access Protocol) or
+|RCE| supports LDAP (Lightweight Directory Access Protocol) or
 AD (active Directory) authentication.
-All LDAP versions are supported, with the following |RCM| plugins managing each:
-
-* For LDAP or Active Directory use ``LDAP (egg:rhodecode-enterprise-ce#ldap)``
+All LDAP versions are currently supported.
 
 RhodeCode reads all data defined from plugin and creates corresponding
 accounts on local database after receiving data from LDAP. This is done on
@@ -30,11 +28,12 LDAP Configuration Steps
 
 To configure |LDAP|, use the following steps:
 
-1. From the |RCM| interface, select
+1. From the |RCE| interface, select
    :menuselection:`Admin --> Authentication`
-2. Enable the ldap plugin and select :guilabel:`Save`
-3. Select the :guilabel:`Enabled` check box in the plugin configuration section
-4. Add the required LDAP information and :guilabel:`Save`, for more details,
+2. Activate the `LDAP` plugin and select :guilabel:`Save`
+3. Go to newly available menu option called `LDAP` on the left side.
+4. Check the `enabled` check box in the plugin configuration section,
+   and fill in the required LDAP information and :guilabel:`Save`, for more details,
    see :ref:`config-ldap-examples`
 
 For a more detailed description of LDAP objects, see :ref:`ldap-gloss-ref`:
@@ -43,44 +42,73 For a more detailed description of LDAP
 
 Example LDAP configuration
 ^^^^^^^^^^^^^^^^^^^^^^^^^^
-.. code-block:: bash
+
+Below is example setup that can be used with Active Directory/LDAP server::
+
+    *option*: `enabled` => `True`
+    # Enable or disable this authentication plugin.
+
+    *option*: `cache_ttl` => `360`
+    # Amount of seconds to cache the authentication and permissions check response call for this plugin.
+    # Useful for expensive calls like LDAP to improve the performance of the system (0 means disabled).
+
+    *option*: `host` => `192.168.245.143,192.168.1.240`
+    # Host[s] of the LDAP Server
+    # (e.g., 192.168.2.154, or ldap-server.domain.com.
+    #  Multiple servers can be specified using commas
+
+    *option*: `port` => `389`
+    # Custom port that the LDAP server is listening on. Default value is: 389, use 689 for LDAPS(SSL)
+
+    *option*: `timeout` => `300`
+    # Timeout for LDAP connection
+
+    *option*: `dn_user` => `[e-mail]`
+    # Optional user DN/account to connect to LDAP if authentication is required.
+    # e.g., cn=admin,dc=mydomain,dc=com, or uid=root,cn=users,dc=mydomain,dc=com, or [e-mail]
+
+    *option*: `dn_pass` => `SomeSecret`
+    # Password to authenticate for given user DN.
+
+    *option*: `tls_kind` => `PLAIN`
+    # TLS Type
 
-        # Auth Cache TTL, Defines the caching for authentication to offload LDAP server.
-        # This means that cache result will be saved for 3600 before contacting LDAP server to verify the user access
-        3600
-        # Host, comma seperated format is optionally possible to specify more than 1 server
-        https://ldap1.server.com/ldap-admin/,https://ldap2.server.com/ldap-admin/
-        # Default LDAP Port, use 689 for LDAPS
-        389
-        # Account, used for SimpleBind if LDAP server requires an authentication
-        e.g [e-mail]
-        # Password used for simple bind
-        ldap-user-password
-        # LDAP connection security
-        LDAPS
-        # Certificate checks level
-        DEMAND
-        # Base DN
-        cn=Rufus Magillacuddy,ou=users,dc=rhodecode,dc=com
-        # LDAP search filter to narrow the results
-        (objectClass=person)
-        # LDAP search scope
-        SUBTREE
-        # Login attribute
-        sAMAccountName
-        # First Name Attribute to read
-        givenName
-        # Last Name Attribute to read
-        sn
-        # Email Attribute to read email address from
-        mail
+    *option*: `tls_reqcert` => `NEVER`
+    # Require Cert over TLS?. Self-signed and custom certificates can be used when
+    #  `RhodeCode Certificate` found in admin > settings > system info page is extended.
+
+    *option*: `tls_cert_file` => ``
+    # This specifies the PEM-format file path containing certificates for use in TLS connection.
+    # If not specified `TLS Cert dir` will be used
+
+    *option*: `tls_cert_dir` => `/etc/openldap/cacerts`
+    # This specifies the path of a directory that contains individual CA certificates in separate files.
+
+    *option*: `base_dn` => `cn=Rufus Magillacuddy,ou=users,dc=rhodecode,dc=com`
+    # Base DN to search. Dynamic bind is supported. Add `$login` marker in it to be replaced with current user credentials
+    # (e.g., dc=mydomain,dc=com, or ou=Users,dc=mydomain,dc=com)
 
+    *option*: `filter` => `(objectClass=person)`
+    # Filter to narrow results
+    # (e.g., (&(objectCategory=Person)(objectClass=user)), or
+    # (memberof=cn=rc-login,ou=groups,ou=company,dc=mydomain,dc=com)))
 
-Below is example setup that can be used with Active Directory/LDAP server.
+    *option*: `search_scope` => `SUBTREE`
+    # How deep to search LDAP. If unsure set to SUBTREE
+
+    *option*: `attr_login` => `sAMAccountName`
+    # LDAP Attribute to map to user name (e.g., uid, or sAMAccountName)
 
-.. image:: ../images/ldap-example.png
-   :alt: LDAP/AD setup example
-   :scale: 50 %
+    *option*: `attr_email` => `mail`
+    # LDAP Attribute to map to email address (e.g., mail).
+    # Emails are a crucial part of RhodeCode.
+    # If possible add a valid email attribute to ldap users.
+
+    *option*: `attr_firstname` => `givenName`
+    # LDAP Attribute to map to first name (e.g., givenName)
+
+    *option*: `attr_lastname` => `sn`
+    # LDAP Attribute to map to last name (e.g., sn)
 
 
 .. toctree::

docs/auth/auth-pam.rst

@@ -5,8 +5,8 PAM
 
 To enable PAM authentication, use the following steps:
 
-1. From the |RCM| interface, go to :menuselection:`Admin --> Authentication`
-2. Enable the ``rhodecode.lib.auth_modules.auth_pam`` library and select save
+1. From the |RCE| interface, go to :menuselection:`Admin --> Authentication`
+2. Activate the ``rhodecode.lib.auth_modules.auth_pam`` library and select save
 3. On the PAM plugin settings section, do the following:
 
    * Check the :guilabel:`Enable` checkbox

docs/auth/auth-token.rst

@@ -3,7 +3,10
 Authentication Tokens
 ---------------------
 
-|RCE| has 4 different kinds of authentication tokens.
+|RCE| has 4 different kinds of authentication tokens. `API token`, `Feed tokens` work
+without a need to enable any additional authentication. `VCS tokens` require dedicated
+authentication plugin to be activated. `Web Interface tokens` are controlled by the
+white_list configuration.
 
 * *API tokens*: API tokens can only be used to execute |RCE| API operations.
   You can store your API token and assign it to each instance in
@@ -11,15 +14,7 Authentication Tokens
   example in :ref:`indexing-ref` section for more details.
 
 * *Feed tokens*: The feed token can only be used to access the RSS feed.
-   Usually those are safe to store inside your RSS feed reader.
-
-* *VCS tokens*: You can use these to authenticate with |git|, |hg| and |svn|
-  operations instead of a password. They are designed to be used with
-  CI Servers or other third party tools that require |repo| access.
-  They are also a good replacement for SSH based access.
-  To use these tokens you need be enabled special authentication method on
-  |RCE|, as they are disabled by default.
-  See :ref:`enable-vcs-tokens`.
+  Usually those are safe to store inside your RSS feed reader.
 
 * *Web Interface tokens*: These token allows users to access the web
   interface of |RCE| without logging in.
@@ -41,7 +36,16 Authentication Tokens
    https://rhodecode.com/repo/archive/tip.zip?auth_token=<web-api-token>
 
    # To show commit diff without logging into Web UI
-   https://rhodecode.com/repo/changeset-diff/<sha>?auth_token=<web-api-token>
+   https://rhodecode.com/repo/raw-diff/<sha>?auth_token=<web-api-token>
+
+* *VCS tokens*: You can use these to authenticate with |git|, |hg| and |svn|
+  operations instead of a password. They are designed to be used with
+  CI Servers or other third party tools that require |repo| access.
+  They are also a good replacement for SSH based access.
+  To use these tokens you need be enabled special authentication method on
+  |RCE|, as they are disabled by default.
+  See :ref:`enable-vcs-tokens`.
+
 
 .. _enable-vcs-tokens:
 
@@ -51,7 +55,7 Enabling VCS Tokens
 To enable VCS Tokens, use the following steps:
 
 1. Go to :menuselection:`Admin --> Authentication`.
-2. Enable the ``rhodecode.lib.auth_modules.auth_token`` plugin.
+2. Activate the ``rhodecode.lib.auth_modules.auth_token`` plugin.
 3. Click :guilabel:`Save`.
 
 Authentication Token Tips
@@ -67,7 +71,7 Creating Tokens
 
 To create authentication tokens for an user, use the following steps:
 
-1. From the |RCM| interface go to
+1. From the |RCE| interface go to
    :menuselection:`Username --> My Account --> Auth tokens`.
 
 2. Label and Add the tokens you wish to use with |RCE|.

docs/auth/auth.rst

@@ -4,29 +4,31 Authentication Options
 ======================
 
 |RCE| provides a built in authentication against its own database. This is
-implemented using ``rhodecode.lib.auth_rhodecode`` plugin. This plugin is
-enabled by default.
+implemented using ``RhodeCode Internal`` plugin. This plugin is enabled by default.
 Additionally, |RCE| provides a Pluggable Authentication System. This gives the
 administrator greater control over how users authenticate with the system.
 
 .. important::
 
-  You can disable the built in |RCM| authentication plugin
-  ``rhodecode.lib.auth_rhodecode`` and force all authentication to go
+  You can disable the built in |RCE| authentication plugin
+  ``RhodeCode Internal`` and force all authentication to go
   through your authentication plugin of choice e.g LDAP only.
   However, if you do this, and your external authentication tools fails,
-  you will be unable to access |RCM|.
+  accessing |RCE| will be blocked unless a fallback plugin is
+  enabled via :file: rhodecode.ini
 
-|RCM| comes with the following user authentication management plugins:
+
+|RCE| comes with the following user authentication management plugins:
 
 
 .. toctree::
 
+    auth-token
     auth-ldap
     auth-ldap-groups
+    auth-saml-generic
+    auth-saml-onelogin
+    auth-saml-duosecurity
     auth-crowd
     auth-pam
-    auth-token
     ssh-connection
-
-

docs/auth/ldap-active-directory.rst

@@ -3,27 +3,73
 Active Directory
 ----------------
 
-|RCM| can use Microsoft Active Directory for user authentication. This is
+|RCE| can use Microsoft Active Directory for user authentication. This is
 done through an LDAP or LDAPS connection to Active Directory. Use the
 following example LDAP configuration setting to set your Active Directory
-authentication.
-
-.. code-block:: ini
-    
-    # Set the Base DN
-    Base DN              = OU=SBSUsers,OU=Users,OU=MyBusiness,DC=v3sys,DC=local
-    # Set the Active Directory SAM-Account-Name
-    Login Attribute      = sAMAccountName
-    # Set the Active Directory user name
-    First Name Attribute = usernameame
-    # Set the Active Directory user surname
-    Last Name Attribute  = user_surname
-    # Set the Active Directory user email
-    E-mail Attribute     = userEmail
+authentication::
 
 
-Below is example setup that can be used with Active Directory and ldap groups.
+    *option*: `enabled` => `True`
+    # Enable or disable this authentication plugin.
+
+    *option*: `cache_ttl` => `360`
+    # Amount of seconds to cache the authentication and permissions check response call for this plugin.
+    # Useful for expensive calls like LDAP to improve the performance of the system (0 means disabled).
+
+    *option*: `host` => `192.168.245.143,192.168.1.240`
+    # Host[s] of the LDAP Server
+    # (e.g., 192.168.2.154, or ldap-server.domain.com.
+    #  Multiple servers can be specified using commas
+
+    *option*: `port` => `389`
+    # Custom port that the LDAP server is listening on. Default value is: 389, use 689 for LDAPS(SSL)
+
+    *option*: `timeout` => `300`
+    # Timeout for LDAP connection
+
+    *option*: `dn_user` => `[e-mail]`
+    # Optional user DN/account to connect to LDAP if authentication is required.
+    # e.g., cn=admin,dc=mydomain,dc=com, or uid=root,cn=users,dc=mydomain,dc=com, or [e-mail]
+
+    *option*: `dn_pass` => `SomeSecret`
+    # Password to authenticate for given user DN.
+
+    *option*: `tls_kind` => `PLAIN`
+    # TLS Type
+
+    *option*: `tls_reqcert` => `NEVER`
+    # Require Cert over TLS?. Self-signed and custom certificates can be used when
+    #  `RhodeCode Certificate` found in admin > settings > system info page is extended.
 
-.. image:: ../images/ldap-groups-example.png
-   :alt: LDAP/AD setup example
-   :scale: 50 %
  No newline at end of file
+    *option*: `tls_cert_file` => ``
+    # This specifies the PEM-format file path containing certificates for use in TLS connection.
+    # If not specified `TLS Cert dir` will be used
+
+    *option*: `tls_cert_dir` => `/etc/openldap/cacerts`