diff --git a/doc/sources/admin/applications.rst b/doc/sources/admin/applications.rst
index 68c8cd46c..8ce53e0da 100644
--- a/doc/sources/admin/applications.rst
+++ b/doc/sources/admin/applications.rst
@@ -35,42 +35,42 @@ Application list
 ================================================================= ==================================================== ============ ================ === ==== ====
 Application                                                       Configuration guide                                  HTTP headers Specific Handler CAS SAML OIDC
 ================================================================= ==================================================== ============ ================ === ==== ====
-.. image:: applications/microsoft-adfs.png                        :doc:`ADFS<applications/adfs>`                                                         ✔   
-.. image:: applications/alfresco_logo.png                         :doc:`Alfresco<applications/alfresco>`               ✔                                 ✔   
-.. image:: applications/logo_amazon_web_services.jpg              :doc:`Amazon Web Services<applications/aws>`                                           ✔   
-.. image:: applications/logo-awx.png                              :doc:`AWX (Ansible Tower)<applications/awx>`                                           ✔   
-.. image:: applications/bugzilla_logo.png                         :doc:`Bugzilla<applications/bugzilla>`               ✔                                     
-.. image:: applications/csod_logo.png                             :doc:`Cornerstone<applications/cornerstone>`                                           ✔   
+.. image:: applications/microsoft-adfs.png                        :doc:`ADFS<applications/adfs>`                                                         ✔
+.. image:: applications/alfresco_logo.png                         :doc:`Alfresco<applications/alfresco>`               ✔                                 ✔
+.. image:: applications/logo_amazon_web_services.jpg              :doc:`Amazon Web Services<applications/aws>`                                           ✔
+.. image:: applications/logo-awx.png                              :doc:`AWX (Ansible Tower)<applications/awx>`                                           ✔
+.. image:: applications/bugzilla_logo.png                         :doc:`Bugzilla<applications/bugzilla>`               ✔
+.. image:: applications/csod_logo.png                             :doc:`Cornerstone<applications/cornerstone>`                                           ✔
 .. image:: applications/discourse.jpg                             :doc:`Discourse<applications/discourse>`                                               ✔    ✔
-.. image:: applications/django_logo.png                           :doc:`Django<applications/django>`                   ✔                                     
-.. image:: applications/dokuwiki_logo.png                         :doc:`Dokuwiki<applications/dokuwiki>`               ✔                                     
-.. image:: applications/drupal_logo.png                           :doc:`Drupal<applications/drupal>`                   ✔                                     
-.. image:: applications/fusiondirectory-logo.jpg                  :doc:`FusionDirectory<applications/fusiondirectory>` ✔                                     
+.. image:: applications/django_logo.png                           :doc:`Django<applications/django>`                   ✔
+.. image:: applications/dokuwiki_logo.png                         :doc:`Dokuwiki<applications/dokuwiki>`               ✔
+.. image:: applications/drupal_logo.png                           :doc:`Drupal<applications/drupal>`                   ✔
+.. image:: applications/fusiondirectory-logo.jpg                  :doc:`FusionDirectory<applications/fusiondirectory>` ✔
 .. image:: applications/gitlab_logo.png                           :doc:`Gitlab<applications/gitlab>`                                                     ✔    ✔
-.. image:: applications/glpi_logo.png                             :doc:`GLPI<applications/glpi>`                       ✔                                     
-.. image:: applications/googleapps_logo.png                       :doc:`Google Apps<applications/googleapps>`                                            ✔   
+.. image:: applications/glpi_logo.png                             :doc:`GLPI<applications/glpi>`                       ✔
+.. image:: applications/googleapps_logo.png                       :doc:`Google Apps<applications/googleapps>`                                            ✔
 .. image:: applications/grafana_logo.png                          :doc:`Grafana<applications/grafana>`                                                        ✔
-.. image:: applications/grr_logo.png                              :doc:`GRR<applications/grr>`                         ✔                                     
+.. image:: applications/grr_logo.png                              :doc:`GRR<applications/grr>`                         ✔
 .. image:: applications/guacamole.png                             :doc:`Apache Guacamole<applications/guacamole>`      ✔                             ✔        ✔
 .. image:: applications/humhub_logo.png                           :doc:`HumHub<applications/humhub>`                                                          ✔
-.. image:: applications/logo-jitsimeet.png                        :doc:`Jitsi Meet<applications/jitsimeet>`            ✔                                     
-.. image:: applications/liferay_logo.png                          :doc:`Liferay<applications/liferay>`                 ✔                                     
-.. image:: applications/limesurvey_logo.png                       :doc:`LimeSurvey<applications/limesurvey>`           ✔                                     
+.. image:: applications/logo-jitsimeet.png                        :doc:`Jitsi Meet<applications/jitsimeet>`            ✔
+.. image:: applications/liferay_logo.png                          :doc:`Liferay<applications/liferay>`                 ✔
+.. image:: applications/limesurvey_logo.png                       :doc:`LimeSurvey<applications/limesurvey>`           ✔
 .. image:: applications/mattermost_logo.png                       :doc:`Mattermost<applications/mattermost>`                                                  ✔
-.. image:: applications/mediawiki_logo.png                        :doc:`Mediawiki<applications/mediawiki>`             ✔                                     
-.. image:: applications/nextcloud-logo.png                        :doc:`NextCloud<applications/nextcloud>`                                               ✔   
-.. image:: applications/obm_logo.png                              :doc:`OBM<applications/obm>`                         ✔                                     
-.. image:: applications/logo_office_365.png                       :doc:`Office 365<applications/office365>`                                              ✔   
-.. image:: applications/phpldapadmin_logo.png                     :doc:`phpLDAPAdmin<applications/phpldapadmin>`       ✔                                     
-.. image:: applications/roundcube_logo.png                        :doc:`Roundcube<applications/roundcube>`             ✔                                     
-.. image:: applications/salesforce-logo.jpg                       :doc:`SalesForce<applications/salesforce>`                                             ✔   
-.. image:: applications/SAPLogo.gif                               :doc:`SAP<applications/sap>`                         ✔                                 ✔   
-.. image:: applications/simplesamlphp_logo.png                    :doc:`simpleSAMLphp<applications/simplesamlphp>`                                       ✔   
-.. image:: applications/spring_logo.png                           :doc:`Spring<applications/spring>`                   ✔                                     
-.. image:: applications/symfony_logo.png                          :doc:`Symfony<applications/symfony>`                 ✔                                     
-.. image:: applications/sympa_logo.png                            :doc:`Sympa<applications/sympa>`                     ✔                                     
-.. image:: applications/tomcat_logo.png                           :doc:`Tomcat<applications/tomcat>`                   ✔                                     
-.. image:: applications/wordpress_logo.png                        :doc:`Wordpress<applications/wordpress>`                                           ✔       
-.. image:: applications/xwiki.png                                 :doc:`XWiki<applications/xwiki>`                     ✔                                     
-.. image:: applications/zimbra_logo.png                           :doc:`Zimbra<applications/zimbra>`                                ✔                        
+.. image:: applications/mediawiki_logo.png                        :doc:`Mediawiki<applications/mediawiki>`             ✔
+.. image:: applications/nextcloud-logo.png                        :doc:`NextCloud<applications/nextcloud>`                                               ✔
+.. image:: applications/obm_logo.png                              :doc:`OBM<applications/obm>`                         ✔
+.. image:: applications/logo_office_365.png                       :doc:`Office 365<applications/office365>`                                              ✔
+.. image:: applications/phpldapadmin_logo.png                     :doc:`phpLDAPAdmin<applications/phpldapadmin>`       ✔
+.. image:: applications/roundcube_logo.png                        :doc:`Roundcube<applications/roundcube>`             ✔
+.. image:: applications/salesforce-logo.jpg                       :doc:`SalesForce<applications/salesforce>`                                             ✔
+.. image:: applications/SAPLogo.gif                               :doc:`SAP<applications/sap>`                         ✔                                 ✔
+.. image:: applications/simplesamlphp_logo.png                    :doc:`simpleSAMLphp<applications/simplesamlphp>`                                       ✔
+.. image:: applications/spring_logo.png                           :doc:`Spring<applications/spring>`                   ✔
+.. image:: applications/symfony_logo.png                          :doc:`Symfony<applications/symfony>`                 ✔
+.. image:: applications/sympa_logo.png                            :doc:`Sympa<applications/sympa>`                     ✔
+.. image:: applications/tomcat_logo.png                           :doc:`Tomcat<applications/tomcat>`                   ✔
+.. image:: applications/wordpress_logo.png                        :doc:`Wordpress<applications/wordpress>`                                           ✔
+.. image:: applications/xwiki.png                                 :doc:`XWiki<applications/xwiki>`                     ✔
+.. image:: applications/zimbra_logo.png                           :doc:`Zimbra<applications/zimbra>`                                ✔
 ================================================================= ==================================================== ============ ================ === ==== ====
diff --git a/doc/sources/admin/applications/adfs.rst b/doc/sources/admin/applications/adfs.rst
index 6f5c3fff2..aaa48eeda 100644
--- a/doc/sources/admin/applications/adfs.rst
+++ b/doc/sources/admin/applications/adfs.rst
@@ -11,7 +11,7 @@ Identity/Service Provider, compatible with several protocols, including
 SAML 2.0.
 
 
-.. important:: 
+.. important::
 
     This documentation does not explains how to setup ADFS,
     but give only tricks to make it works with LL::NG
diff --git a/doc/sources/admin/applications/alfresco.rst b/doc/sources/admin/applications/alfresco.rst
index 135b63580..db0f72d1f 100644
--- a/doc/sources/admin/applications/alfresco.rst
+++ b/doc/sources/admin/applications/alfresco.rst
@@ -17,7 +17,7 @@ Authentication against LL::NG can be done trough:
 -  SAML 2 (LL::NG as SAML2 IDP)
 
 
-.. tip:: 
+.. tip::
 
     Alfresco now recommends SAML2 method
 
@@ -30,10 +30,10 @@ Alfresco
 ~~~~~~~~
 
 
-.. tip:: 
+.. tip::
 
     The official documentation can be found here:
-    http://docs.alfresco.com/4.0/tasks/auth-alfrescoexternal-sso.html\ 
+    http://docs.alfresco.com/4.0/tasks/auth-alfrescoexternal-sso.html\
 
 You need to find the following files in your Alfresco installation:
 
@@ -102,7 +102,7 @@ the ``<endpoint>``, change ``<connector-id>`` value to
 You need to restart Tomcat to apply changes.
 
 
-.. warning:: 
+.. warning::
 
     Now you can log in with a simple HTTP header. You need to
     restrict access to Alfresco to LL::NG.
@@ -171,13 +171,13 @@ Edit then ``share-config-custom.xml``:
        ...
            <config evaluator="string-compare" condition="CSRFPolicy" replace="true">
 
-        
+
 
            <!--
                If using https make a CSRFPolicy with replace="true" and override the properties section.
                Note, localhost is there to allow local checks to succeed.
 
-        
+
 
                I.e.
                <properties>
@@ -187,15 +187,15 @@ Edit then ``share-config-custom.xml``:
                </properties>
            -->
 
-        
+
 
                <filter>
 
-        
+
 
                    <!-- SAML SPECIFIC CONFIG -  START -->
 
-        
+
 
                    <!--
                     Since we have added the CSRF filter with filter-mapping of "/*" we will catch all public GET to avoid them
@@ -208,7 +208,7 @@ Edit then ``share-config-custom.xml``:
                        </request>
                    </rule>
 
-        
+
 
                    <!-- Incoming posts from IDPs do not require a token -->
                    <rule>
@@ -218,15 +218,15 @@ Edit then ``share-config-custom.xml``:
                        </request>
                    </rule>
 
-        
+
 
                    <!-- SAML SPECIFIC CONFIG -  STOP -->
 
-        
+
 
                    <!-- EVERYTHING BELOW FROM HERE IS COPIED FROM share-security-config.xml -->
 
-        
+
 
                    <!--
                     Certain webscripts shall not be allowed to be accessed directly form the browser.
@@ -241,7 +241,7 @@ Edit then ``share-config-custom.xml``:
                        </action>
                    </rule>
 
-        
+
 
                    <!--
                     Certain Repo webscripts should be allowed to pass without a token since they have no Share knowledge.
@@ -260,7 +260,7 @@ Edit then ``share-config-custom.xml``:
                        </action>
                    </rule>
 
-        
+
 
                    <!--
                     Certain Surf POST requests from the WebScript console must be allowed to pass without a token since
@@ -279,7 +279,7 @@ Edit then ``share-config-custom.xml``:
                        </action>
                    </rule>
 
-        
+
 
                    <!-- Certain Share POST requests does NOT require a token -->
                    <rule>
@@ -295,7 +295,7 @@ Edit then ``share-config-custom.xml``:
                        </action>
                    </rule>
 
-        
+
 
                    <!-- Assert logout is done from a valid domain, if so clear the token when logging out -->
                    <rule>
@@ -315,7 +315,7 @@ Edit then ``share-config-custom.xml``:
                        </action>
                    </rule>
 
-        
+
 
                    <!-- Make sure the first token is generated -->
                    <rule>
@@ -332,7 +332,7 @@ Edit then ``share-config-custom.xml``:
                        </action>
                    </rule>
 
-        
+
 
                    <!-- Refresh token on new "page" visit when a user is logged in -->
                    <rule>
@@ -350,7 +350,7 @@ Edit then ``share-config-custom.xml``:
                        </action>
                    </rule>
 
-        
+
 
                    <!--
                     Verify multipart requests from logged in users contain the token as a parameter
@@ -376,7 +376,7 @@ Edit then ``share-config-custom.xml``:
                        </action>
                    </rule>
 
-        
+
 
                    <!--
                     Verify that all remaining state changing requests from logged in users' requests contains a token in the
diff --git a/doc/sources/admin/applications/authbasic.rst b/doc/sources/admin/applications/authbasic.rst
index f5c913bb9..864bc0ebe 100644
--- a/doc/sources/admin/applications/authbasic.rst
+++ b/doc/sources/admin/applications/authbasic.rst
@@ -7,7 +7,7 @@ Presentation
 ------------
 
 
-.. important:: 
+.. important::
 
     For now, this feature is only supported by Apache
     handler.
@@ -63,7 +63,7 @@ So the above example can also be written like this:
    Authorization => basic($uid,$_password)
 
 
-.. tip:: 
+.. tip::
 
     The ``basic`` function will also force conversion from UTF-8
     to ISO-8859-1, which should be accepted by most of HTTP servers.
diff --git a/doc/sources/admin/applications/aws.rst b/doc/sources/admin/applications/aws.rst
index 3aef14b49..5d7f0f745 100644
--- a/doc/sources/admin/applications/aws.rst
+++ b/doc/sources/admin/applications/aws.rst
@@ -29,7 +29,7 @@ SAML
    name so people know which account is which.
 
 
-.. important:: 
+.. important::
 
     If you have only one role, the configuration is simple. If you
     have multiple roles for different people, it is a little trickier. As
@@ -41,15 +41,15 @@ SAML
     user has attributes which are used quite heavily for dynamic groups and
     authorisation. You will want something similar, using whatever attribute
     makes sense to you. For example:
-    
+
     .. code::
-    
+
          dn: uid=user,ou=people,dc=your,dc=com
          ...
          ou: sysadmin
          ou: database
          ou: root
-    
+
 
 
 -  Assuming you use the web interface to manage lemonldap, go to General
diff --git a/doc/sources/admin/applications/bugzilla.rst b/doc/sources/admin/applications/bugzilla.rst
index 2c02c58cc..026b5267d 100644
--- a/doc/sources/admin/applications/bugzilla.rst
+++ b/doc/sources/admin/applications/bugzilla.rst
@@ -48,7 +48,7 @@ Configure Bugzilla virtual host like other
           PerlHeaderParserHandler Lemonldap::NG::Handler
 
           ...
-          
+
    </VirtualHost>
 
 -  For Nginx:
@@ -71,8 +71,8 @@ Configure Bugzilla virtual host like other
        fastcgi_param HOST $http_host;
        # Keep original request (LLNG server will received /llauth)
        fastcgi_param X_ORIGINAL_URI  $request_uri;
-     } 
-    
+     }
+
      # Client requests
      location / {
        auth_request /lmauth;
@@ -80,9 +80,9 @@ Configure Bugzilla virtual host like other
        auth_request_set $lmlocation $upstream_http_location;
        error_page 401 $lmlocation;
        try_files $uri $uri/ =404;
-    
+
        ...
-    
+
        include /etc/lemonldap-ng/nginx-lua-headers.conf;
      }
      location / {
@@ -96,9 +96,9 @@ Bugzilla virtual host in Manager
 Go to the Manager and :doc:`create a new virtual host<../configvhost>`
 for Bugzilla.
 
-Configure the :doc:`access rules<../writingrulesand_headers>`.
+Configure the :ref:`rules<rules>`.
 
-Configure the following :doc:`headers<../writingrulesand_headers>`.
+Configure the following :ref:`header<headers>`.
 
 -  **Auth-User**: $uid
 -  **Auth-Mail**: $mail
diff --git a/doc/sources/admin/applications/cornerstone.rst b/doc/sources/admin/applications/cornerstone.rst
index 7e9993cf4..5224fc642 100644
--- a/doc/sources/admin/applications/cornerstone.rst
+++ b/doc/sources/admin/applications/cornerstone.rst
@@ -56,7 +56,7 @@ Now we will add CSOD as a new SAML Service Provider:
    </md:EntityDescriptor>
 
 
-.. important:: 
+.. important::
 
     Change **mycompanyid** (in ``AssertionConsumerService``
     markup, parameter ``Location``) into your CSOD company ID and put the
diff --git a/doc/sources/admin/applications/dokuwiki.rst b/doc/sources/admin/applications/dokuwiki.rst
index 770cf4d0d..79a5fd6f7 100644
--- a/doc/sources/admin/applications/dokuwiki.rst
+++ b/doc/sources/admin/applications/dokuwiki.rst
@@ -14,7 +14,7 @@ readable outside the Wiki and eases the creation of structured texts.
 All data is stored in plain text files – no database is required.
 
 
-.. tip:: 
+.. tip::
 
     LemonLDAP::NG wiki uses Dokuwiki!
 
@@ -57,7 +57,7 @@ Configure Dokuwiki virtual host like other
           PerlHeaderParserHandler Lemonldap::NG::Handler
 
           ...
-          
+
    </VirtualHost>
 
 -  For Nginx:
@@ -80,8 +80,8 @@ Configure Dokuwiki virtual host like other
        fastcgi_param HOST $http_host;
        # Keep original request (LLNG server will received /llauth)
        fastcgi_param X_ORIGINAL_URI  $request_uri;
-     } 
-    
+     }
+
      # Client requests
      location / {
        auth_request /lmauth;
@@ -89,9 +89,9 @@ Configure Dokuwiki virtual host like other
        auth_request_set $lmlocation $upstream_http_location;
        error_page 401 $lmlocation;
        try_files $uri $uri/ =404;
-    
+
        ...
-    
+
        include /etc/lemonldap-ng/nginx-lua-headers.conf;
      }
      location / {
@@ -105,9 +105,9 @@ Dokuwiki virtual host in Manager
 Go to the Manager and :doc:`create a new virtual host<../configvhost>`
 for Dokuwiki.
 
-Configure the :doc:`access rules<../writingrulesand_headers>`.
+Configure the :ref:`access rules<rules>`.
 
-Configure the :doc:`headers<../writingrulesand_headers>`:
+Configure the :ref:`headers<headers>`:
 
 -  Auth-User $uid
 -  Auth-Cn: $cn
@@ -115,7 +115,7 @@ Configure the :doc:`headers<../writingrulesand_headers>`:
 -  Auth-Groups: encode_base64($groups,"")
 
 
-.. important:: 
+.. important::
 
     To allow execution of encode_base64() method, you must
     deactivate the :doc:`Safe jail<../safejail>`.
diff --git a/doc/sources/admin/applications/drupal.rst b/doc/sources/admin/applications/drupal.rst
index 919a738fb..3e36e0a6f 100644
--- a/doc/sources/admin/applications/drupal.rst
+++ b/doc/sources/admin/applications/drupal.rst
@@ -34,7 +34,7 @@ Configure Drupal virtual host like other
 :doc:`protected virtual host<../configvhost>`.
 
 
-.. important:: 
+.. important::
 
     If you are protecting Drupal with LL::NG as reverse
     proxy,
@@ -50,7 +50,7 @@ Configure Drupal virtual host like other
           PerlHeaderParserHandler Lemonldap::NG::Handler
 
           ...
-          
+
    </VirtualHost>
 
 -  For Nginx:
@@ -73,8 +73,8 @@ Configure Drupal virtual host like other
        fastcgi_param HOST $http_host;
        # Keep original request (LLNG server will received /llauth)
        fastcgi_param X_ORIGINAL_URI  $request_uri;
-     } 
-    
+     }
+
      # Client requests
      location / {
        auth_request /lmauth;
@@ -82,9 +82,9 @@ Configure Drupal virtual host like other
        auth_request_set $lmlocation $upstream_http_location;
        error_page 401 $lmlocation;
        try_files $uri $uri/ =404;
-    
+
        ...
-    
+
        include /etc/lemonldap-ng/nginx-lua-headers.conf;
      }
      location / {
@@ -98,10 +98,10 @@ Drupal virtual host in Manager
 Go to the Manager and :doc:`create a new virtual host<../configvhost>`
 for Drupal.
 
-Just configure the :doc:`access rules<../writingrulesand_headers>`.
+Just configure the :ref:`access rules<rules>`.
 
 If using LL::NG as reverse proxy, configure the ``Auth-User``
-:doc:`header<../writingrulesand_headers>`, else no headers are needed.
+:ref:`header<headers>`, else no headers are needed.
 
 Protect only the administration pages
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -110,7 +110,7 @@ With the above solution, all the Drupal site will be protected, so no
 anonymous access will be allowed.
 
 
-.. important:: 
+.. important::
 
     You cannot use the ``unprotect`` rule because Drupal
     navigation is based on query strings (?q=admin, ?q=user, etc.), and
diff --git a/doc/sources/admin/applications/gitlab.rst b/doc/sources/admin/applications/gitlab.rst
index 198256654..a6202e75c 100644
--- a/doc/sources/admin/applications/gitlab.rst
+++ b/doc/sources/admin/applications/gitlab.rst
@@ -51,15 +51,15 @@ Find the gitlab.rb file and add these settings:
    ]
 
 
-.. tip:: 
+.. tip::
 
     To get the fingerprint of IDP certificate, copy SAML
     certificate from LL::NG configuration in a file and use openssl:
-    
+
     ::
-    
+
        openssl x509 -in CERT.pem -noout -fingerprint
-    
+
 
 
 You can force SAML by default with this option:
@@ -96,7 +96,7 @@ Register them in LL::NG and send these SAML attributes:
 -  cn => name
 
 
-.. important:: 
+.. important::
 
     The value from LL::NG mail session attribute must be the
     email of the user in Gitlab database, in order to associate
@@ -180,10 +180,10 @@ Add an OpenID Connect RP to LemonLDAP::NG
    LemonLDAP::NG session is mapped to the ``email`` claim.
 
 
-.. important:: 
+.. important::
 
     You need to set a key identifier, or you will get a
-    *JSON::JWK::Set::KidNotFound* error on Gitlab 
+    *JSON::JWK::Set::KidNotFound* error on Gitlab
 
 .. |image0| image:: /applications/gitlab_logo.png
    :class: align-center
diff --git a/doc/sources/admin/applications/googleapps.rst b/doc/sources/admin/applications/googleapps.rst
index aee2e949c..cdadb22f4 100644
--- a/doc/sources/admin/applications/googleapps.rst
+++ b/doc/sources/admin/applications/googleapps.rst
@@ -26,7 +26,7 @@ Google Apps control panel
 ~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
-.. important:: 
+.. important::
 
     This part is based on `SimpleSAMLPHP
     documentation <http://simplesamlphp.org/docs/1.6/simplesamlphp-googleapps>`__.
@@ -55,7 +55,7 @@ Now configure all SAML parameters:
    Example: http://auth.example.com
 
 
-.. important:: 
+.. important::
 
     You must check the option
     ``Use a specific domain transmitter`` to force Google Apps to send the
@@ -79,10 +79,10 @@ use openssl to generate an auto-signed certificate:
 You can now the upload the certificate (``cert.pem``) on Google Apps.
 
 
-.. tip:: 
+.. tip::
 
     You can also use the certificate instead of public key in SAML
-    metadata, see :doc:`SAML service configuration<../samlservice>`\ 
+    metadata, see :doc:`SAML service configuration<../samlservice>`\
 
 New Service Provider
 ~~~~~~~~~~~~~~~~~~~~
@@ -112,7 +112,7 @@ Now we will add Google Apps as a new SAML Service Provider:
    </md:EntityDescriptor>
 
 
-.. important:: 
+.. important::
 
     Change **mydomain.org** (in ``AssertionConsumerService``
     markup, parameter ``Location``) into your Google Apps domain. Also adapt
@@ -134,7 +134,7 @@ You need to adapt some parameters:
    ``On`` to always display it
 
 
-.. important:: 
+.. important::
 
     Change **mydomain.org** into your Google Apps
     domain
@@ -155,7 +155,7 @@ To manage the other way (LL::NG → Google Apps), you can add a dedicated
    GoogleApps => http://www.google.com/calendar/hosted/mydomain.org/logout
 
 
-.. important:: 
+.. important::
 
     Change **mydomain.org** into your Google Apps
     domain
diff --git a/doc/sources/admin/applications/grafana.rst b/doc/sources/admin/applications/grafana.rst
index a3cd817b0..a26b22027 100644
--- a/doc/sources/admin/applications/grafana.rst
+++ b/doc/sources/admin/applications/grafana.rst
@@ -31,9 +31,9 @@ Your configuration file will have to look something like this:
    client_id = CHOOSE_A_CLIENT_ID
    client_secret = CHOOSE_A_CLIENT_SECRET
    scopes = openid email profile
-   auth_url = https://auth.example.com/oauth2/authorize 
-   token_url = https://auth.example.com/oauth2/token 
-   api_url = https://auth.example.com/oauth2/userinfo 
+   auth_url = https://auth.example.com/oauth2/authorize
+   token_url = https://auth.example.com/oauth2/token
+   api_url = https://auth.example.com/oauth2/userinfo
    allow_sign_up = true
    name = LemonLDAP::NG
    send_client_credentials_via_post = false
diff --git a/doc/sources/admin/applications/guacamole.rst b/doc/sources/admin/applications/guacamole.rst
index f227f68a2..42e5e5e7e 100644
--- a/doc/sources/admin/applications/guacamole.rst
+++ b/doc/sources/admin/applications/guacamole.rst
@@ -43,11 +43,11 @@ Your Guacamole configuration directory will look something like this.
    └── guacamole.properties
 
 
-.. warning:: 
+.. warning::
 
     Make sure to rename the JAR in a way that `ensures that it
     will be loaded
-    first <https://lists.apache.org/thread.html/b781a5c4e4d14f7ce297200ba6886d888df4333f83836220ac8b69f1@%3Cuser.guacamole.apache.org%3E>`__\ 
+    first <https://lists.apache.org/thread.html/b781a5c4e4d14f7ce297200ba6886d888df4333f83836220ac8b69f1@%3Cuser.guacamole.apache.org%3E>`__\
 
 And ``guacamole.properties`` should contain at least
 
@@ -61,7 +61,7 @@ And ``guacamole.properties`` should contain at least
    openid-username-claim-type: sub
 
 
-.. tip:: 
+.. tip::
 
     Remplace the ``redirect uri`` with your Guacamole server's URL
 
diff --git a/doc/sources/admin/applications/humhub.rst b/doc/sources/admin/applications/humhub.rst
index fce70fbbf..a3a66a1e7 100644
--- a/doc/sources/admin/applications/humhub.rst
+++ b/doc/sources/admin/applications/humhub.rst
@@ -23,7 +23,7 @@ authenticated by LemonLDAP::NG will be registered in HumHub upon their
 first login.
 
 
-.. warning:: 
+.. warning::
 
     HumHub retrieves a user from his username and the
     authentication service he came through. As a result, a former local or
@@ -36,12 +36,12 @@ OpenID Connect
 --------------
 
 
-.. note:: 
+.. note::
 
     This set-up works with option enablePrettyUrl activated in
     Humhub. If not activated, rewrite URL in Humhub HTTP server and allowed
     redirect URL in LemonLDAP needs to be adapted to work with the non
-    pretty URL format. 
+    pretty URL format.
 
 Configuring HumHub
 ~~~~~~~~~~~~~~~~~~
@@ -82,10 +82,10 @@ composer :
    composer update worteks/humhub-auth-oidc  --no-dev --prefer-dist -vvv
 
 
-.. note:: 
+.. note::
 
     If you just need to update the connector, change its version
-    in composer.json and run the above composer update command. 
+    in composer.json and run the above composer update command.
 
 ::
 
@@ -142,7 +142,7 @@ can set up a redirection in the http server in front of the application
 
 ::
 
-   if ($query_string !~ "nosso"){                                                                       
+   if ($query_string !~ "nosso"){
      rewrite ^/user/auth/login$ /user/auth/external?authclient=lemonldapng permanent;
    }
 
diff --git a/doc/sources/admin/applications/jitsimeet.rst b/doc/sources/admin/applications/jitsimeet.rst
index 804de80c9..7fdc2ba06 100644
--- a/doc/sources/admin/applications/jitsimeet.rst
+++ b/doc/sources/admin/applications/jitsimeet.rst
@@ -95,23 +95,23 @@ Jitsi Meet Virtual host in Manager
 Go to the Manager and :doc:`create a new virtual host<../configvhost>`
 for Jitsi Meet.
 
-Configure the :doc:`access rules<../writingrulesand_headers>`.
+Configure the :ref:`access rules<rules>`.
 
 ::
 
      * Don't forget to configure the /logout/ URL
 
-Configure the following :doc:`headers<../writingrulesand_headers>`.
+Configure the following :ref:`headers<headers>`.
 
 -  **mail**: $mail
 -  **displayName**: $cn
 
 
-.. warning:: 
+.. warning::
 
     Jitsi meet expects to find a ``mail`` HTTP header, it
     will ignore REMOTE_USER and only use the mail value to identify the
-    user. 
+    user.
 
 .. |image0| image:: /applications/logo-jitsimeet.png
    :class: align-center
diff --git a/doc/sources/admin/applications/liferay.rst b/doc/sources/admin/applications/liferay.rst
index c9596ba72..faa2056ea 100644
--- a/doc/sources/admin/applications/liferay.rst
+++ b/doc/sources/admin/applications/liferay.rst
@@ -18,7 +18,7 @@ Of course, integration will be full if you use the LDAP directory as
 users backend for LL::NG and Liferay.
 
 
-.. important:: 
+.. important::
 
     If the user is not created, or can not be created via
     LDAP import, the connection to Liferay will be refused. With LDAP,
@@ -59,7 +59,7 @@ In ``General``, fill at least the following information:
 -  **How do users authenticate?**: by login
 
 
-.. tip:: 
+.. tip::
 
     We advice to deactivate other options, cause users will use
     LL::NG portal to modify or reset their password.
@@ -67,16 +67,16 @@ In ``General``, fill at least the following information:
 |image6|
 
 
-.. important:: 
+.. important::
 
     You need to activate LDAP authentication, else SSO
     authentication will not work. Do this in the control panel or in the
     configuration file:
-    
+
     ::
-    
+
        ldap.auth.enabled=true
-    
+
 
 
 Then use the ``SiteMinder`` tab to configure SSO:
@@ -88,7 +88,7 @@ Then use the ``SiteMinder`` tab to configure SSO:
 |image7|
 
 
-.. important:: 
+.. important::
 
     Do not forget to save your changes!
 
@@ -108,7 +108,7 @@ Configure Liferay virtual host like other
           PerlHeaderParserHandler Lemonldap::NG::Handler
 
           ...
-          
+
    </VirtualHost>
 
 -  For Nginx:
@@ -131,8 +131,8 @@ Configure Liferay virtual host like other
        fastcgi_param HOST $http_host;
        # Keep original request (LLNG server will received /llauth)
        fastcgi_param X_ORIGINAL_URI  $request_uri;
-     } 
-    
+     }
+
      # Client requests
      location / {
        auth_request /lmauth;
@@ -140,9 +140,9 @@ Configure Liferay virtual host like other
        auth_request_set $lmlocation $upstream_http_location;
        error_page 401 $lmlocation;
        try_files $uri $uri/ =404;
-    
+
        ...
-    
+
        include /etc/lemonldap-ng/nginx-lua-headers.conf;
      }
      location / {
@@ -156,14 +156,14 @@ Liferay virtual host in Manager
 Go to the Manager and :doc:`create a new virtual host<../configvhost>`
 for Liferay.
 
-Just configure the :doc:`access rules<../writingrulesand_headers>`. You
+Just configure the :ref:`access rules<rules>`. You
 can add a rule for logout:
 
 ::
 
     ^/c/portal/logout => logout_sso
 
-Configure the ``Auth-User`` :doc:`header<../writingrulesand_headers>`.
+Configure the ``Auth-User`` :ref:`header<headers>`.
 
 .. |image0| image:: /applications/liferay_logo.png
    :class: align-center
diff --git a/doc/sources/admin/applications/limesurvey.rst b/doc/sources/admin/applications/limesurvey.rst
index 70be1c48a..288e3e98e 100644
--- a/doc/sources/admin/applications/limesurvey.rst
+++ b/doc/sources/admin/applications/limesurvey.rst
@@ -19,7 +19,7 @@ To have a stronger integration, we will configure LimeSurvey to
 autocreate unknown users and use HTTP headers to fill name and mail.
 
 
-.. important:: 
+.. important::
 
     We suppose that LimeSurvey is installed in
     /var/www/html/limesurvey
@@ -35,15 +35,15 @@ manager. Select the WebServer module and configure it.
 This is enough for the authentication part.
 
 
-.. tip:: 
+.. tip::
 
     If you are blocked, you can deactivate the plugin with this
     request in database:
-    
+
     ::
-    
+
        update lime_plugins SET active=0 where name="Authwebserver";
-    
+
 
 
 To configure account autocreation, you need to edit
@@ -106,15 +106,15 @@ Default   default     Allow only users with a LimeSurvey role
 ========= =========== ========================================
 
 
-.. tip:: 
+.. tip::
 
     You can set the default access to:
-    
+
     ::
-    
+
         * **accept**: all authenticated users will access surveys
-        * **unprotect**: no authentication will be asked to access surveys 
-    
+        * **unprotect**: no authentication will be asked to access surveys
+
 
 
 .. |image0| image:: /applications/limesurvey_logo.png
diff --git a/doc/sources/admin/applications/mattermost.rst b/doc/sources/admin/applications/mattermost.rst
index 258899b0a..609f03361 100644
--- a/doc/sources/admin/applications/mattermost.rst
+++ b/doc/sources/admin/applications/mattermost.rst
@@ -30,10 +30,10 @@ integrated with LemonLDAP::NG without having to use a
 :doc:`Gitlab<gitlab>` server.
 
 
-.. warning:: 
+.. warning::
 
     The following configuration requires your user database
-    to expose a unique numeric identifier for every user. 
+    to expose a unique numeric identifier for every user.
 
 Configuring Mattermost Team Edition
 -----------------------------------
@@ -106,16 +106,16 @@ with the following parameters:
          * ''id'': session attribute containing the user's numeric ID
 
 
-.. warning:: 
+.. warning::
 
     Mattermost absolutely needs to receive a numerical value
     in the ``id`` claim. If you are using a LDAP server, you could use the
     ``uidNumber`` LDAP attribute. If you use something else, you will have
     to find a trick to assign a unique numeric ID to each Mattermost user.
-    
+
     The ``id`` attribute has to be different for each user, since this is
     the field Mattermost will use internally to map Gitlab identities to
-    Mattermost accouts. 
+    Mattermost accouts.
 
 Troubleshooting
 ~~~~~~~~~~~~~~~
diff --git a/doc/sources/admin/applications/mediawiki.rst b/doc/sources/admin/applications/mediawiki.rst
index f4a97a2b1..cb407e104 100644
--- a/doc/sources/admin/applications/mediawiki.rst
+++ b/doc/sources/admin/applications/mediawiki.rst
@@ -87,7 +87,7 @@ Add then extension configuration, for example:
    $wgHooks['PersonalUrls'][] = 'StripLogin';
 
 
-.. warning:: 
+.. warning::
 
     In last version of Auth_remoteuser and Mediawiki, empty
     passwords are not authorized, so you may need to patch the extension
@@ -100,7 +100,7 @@ Add then extension configuration, for example:
    sed -i "s/'wpPassword' => ''/'wpPassword' => 'none'/" extensions/Auth_remoteuser/Auth_remoteuser.body.php
 
 
-.. warning:: 
+.. warning::
 
     In last version of Auth_remoteuser and Mediawiki,
     auto-provisioning requires REMOTE_USER to match the normalized mediawiki
@@ -121,7 +121,7 @@ Configure MediaWiki virtual host like other
 :doc:`protected virtual host<../configvhost>`.
 
 
-.. important:: 
+.. important::
 
     If you are protecting MediaWiki with LL::NG as reverse
     proxy,
@@ -137,7 +137,7 @@ Configure MediaWiki virtual host like other
           PerlHeaderParserHandler Lemonldap::NG::Handler
 
           ...
-          
+
    </VirtualHost>
 
 -  For Nginx:
@@ -160,8 +160,8 @@ Configure MediaWiki virtual host like other
        fastcgi_param HOST $http_host;
        # Keep original request (LLNG server will received /llauth)
        fastcgi_param X_ORIGINAL_URI  $request_uri;
-     } 
-    
+     }
+
      # Client requests
      location / {
        auth_request /lmauth;
@@ -169,9 +169,9 @@ Configure MediaWiki virtual host like other
        auth_request_set $lmlocation $upstream_http_location;
        error_page 401 $lmlocation;
        try_files $uri $uri/ =404;
-    
+
        ...
-    
+
        include /etc/lemonldap-ng/nginx-lua-headers.conf;
      }
      location / {
@@ -185,7 +185,7 @@ MediaWiki virtual host in Manager
 Go to the Manager and :doc:`create a new virtual host<../configvhost>`
 for MediaWiki.
 
-Just configure the :doc:`access rules<../writingrulesand_headers>`. You
+Just configure the :ref:`access rules<rules>`. You
 can also add a rule for logout:
 
 ::
@@ -201,7 +201,7 @@ extension configuration):
    Auth-Mail => $mail
 
 If using LL::NG as reverse proxy, configure also the ``Auth-User``
-:doc:`header<../writingrulesand_headers>`,
+:ref:`header<headers>`,
 
 .. |image0| image:: /applications/mediawiki_logo.png
    :class: align-center
diff --git a/doc/sources/admin/applications/nextcloud.rst b/doc/sources/admin/applications/nextcloud.rst
index 9c8eb479a..4603f9ae5 100644
--- a/doc/sources/admin/applications/nextcloud.rst
+++ b/doc/sources/admin/applications/nextcloud.rst
@@ -25,18 +25,18 @@ You need to `install the
 software <https://docs.nextcloud.com/server/10/admin_manual/installation/index.html>`__.
 
 
-.. tip:: 
+.. tip::
 
     If your NextCloud is behind a proxy (thus having a private
     IP), metadata generated by NextCloud won't work.
-    
+
     Consider changing the configuration of NextCloud to force the domain, in
     **$nextcloudrootwww/config/config.php**, add the following:
-    
+
     .. code:: php
-    
+
        'overwritehost' => 'nextcloud.example.com',
-    
+
 
 
 You also need to enable the "SAML authentication" plugin in your
diff --git a/doc/sources/admin/applications/nginx.rst b/doc/sources/admin/applications/nginx.rst
index 020653aa6..391dfb444 100644
--- a/doc/sources/admin/applications/nginx.rst
+++ b/doc/sources/admin/applications/nginx.rst
@@ -2,7 +2,7 @@ Nginx
 =====
 
 
-.. important:: 
+.. important::
 
     Nginx is fully supported by LemonLDAP::NG since version
     1.9.
diff --git a/doc/sources/admin/applications/obm.rst b/doc/sources/admin/applications/obm.rst
index f3fd931ba..28b89c839 100644
--- a/doc/sources/admin/applications/obm.rst
+++ b/doc/sources/admin/applications/obm.rst
@@ -123,14 +123,14 @@ Edit also OBM configuration to enable LL::NG Handler:
 
    <VirtualHost *:80>
        ServerName obm.example.com
-       
+
        # SSO protection
        PerlHeaderParserHandler Lemonldap::NG::Handler
 
        DocumentRoot /usr/share/obm/php
 
        ...
-       
+
    </VirtualHost>
 
 -  For Nginx:
@@ -153,8 +153,8 @@ Edit also OBM configuration to enable LL::NG Handler:
        fastcgi_param HOST $http_host;
        # Keep original request (LLNG server will received /llauth)
        fastcgi_param X_ORIGINAL_URI  $request_uri;
-     } 
-    
+     }
+
      # Client requests
      location ~ \.php$ {
        auth_request /lmauth;
@@ -164,7 +164,7 @@ Edit also OBM configuration to enable LL::NG Handler:
        try_files $uri $uri/ =404;
 
        ...
-    
+
        include /etc/lemonldap-ng/nginx-lua-headers.conf;
      }
      location / {
@@ -191,7 +191,7 @@ To add these attributes, go in Manager, ``Variables`` »
 ``Exported Variables``.
 
 
-.. important:: 
+.. important::
 
     If you plan to forward user's password to OBM, then you
     have to :doc:`keep the password in session<../passwordstore>`.
@@ -200,9 +200,9 @@ You may also create these macros to manage OBM administrator account
 (``Variables`` » ``Macros``):
 
 ===== ====================================================== =============================== == ==============================
-field value                                                                                    
+field value
 ===== ====================================================== =============================== == ==============================
-uidR  ($uid =~ /^admin0/i)[0] ? "admin0\@global.virt" : $uid                                   
+uidR  ($uid =~ /^admin0/i)[0] ? "admin0\@global.virt" : $uid
 mailR %%($uid =~ /                                           admin0/i)[0] ? "" : ($mail =~ / ([ @]+)/)[0] . "\@example.com" %%
 ===== ====================================================== =============================== == ==============================
 
diff --git a/doc/sources/admin/applications/phpldapadmin.rst b/doc/sources/admin/applications/phpldapadmin.rst
index b10fdf1c3..a35b0fcd3 100644
--- a/doc/sources/admin/applications/phpldapadmin.rst
+++ b/doc/sources/admin/applications/phpldapadmin.rst
@@ -15,7 +15,7 @@ phpLDAPadmin will be protected by LemonLDAP::NG with specific access
 rules.
 
 
-.. warning:: 
+.. warning::
 
     phpLDAPadmin will have no idea of the user connected to
     the WebSSO. So a simple user can have admin rights on the LDAP directory
@@ -52,7 +52,7 @@ Configure phpLDAPadmin virtual host like other
           PerlHeaderParserHandler Lemonldap::NG::Handler
 
           ...
-          
+
    </VirtualHost>
 
 -  For Nginx:
@@ -75,8 +75,8 @@ Configure phpLDAPadmin virtual host like other
        fastcgi_param HOST $http_host;
        # Keep original request (LLNG server will received /llauth)
        fastcgi_param X_ORIGINAL_URI  $request_uri;
-     } 
-    
+     }
+
      # Client requests
      location / {
        auth_request /lmauth;
@@ -84,9 +84,9 @@ Configure phpLDAPadmin virtual host like other
        auth_request_set $lmlocation $upstream_http_location;
        error_page 401 $lmlocation;
        try_files $uri $uri/ =404;
-    
+
        ...
-    
+
        include /etc/lemonldap-ng/nginx-lua-headers.conf;
      }
      location / {
@@ -100,9 +100,9 @@ phpLDAPadmin virtual host in Manager
 Go to the Manager and :doc:`create a new virtual host<../configvhost>`
 for phpLDAPadmin.
 
-Just configure the :doc:`access rules<../writingrulesand_headers>`.
+Just configure the :ref:`access rules<rules>`.
 
-No :doc:`headers<../writingrulesand_headers>` are required.
+No :ref:`headers<headers>` are required.
 
 .. |image0| image:: /applications/phpldapadmin_logo.png
    :class: align-center
diff --git a/doc/sources/admin/applications/roundcube.rst b/doc/sources/admin/applications/roundcube.rst
index 138b813b1..3137826b8 100644
--- a/doc/sources/admin/applications/roundcube.rst
+++ b/doc/sources/admin/applications/roundcube.rst
@@ -26,10 +26,10 @@ LemonLDAP::NG
 -  in HTTP headers, you need Auth-User ($mail) and Auth-Pw ($_password).
 
 
-.. important:: 
+.. important::
 
     To be able to forward password to RoundCube, see
-    :doc:`how to store password in session<../passwordstore>`\ 
+    :doc:`how to store password in session<../passwordstore>`\
 
 -  Configure :doc:`Apache or Nginx virtual host<../configvhost>`
 
diff --git a/doc/sources/admin/applications/salesforce.rst b/doc/sources/admin/applications/salesforce.rst
index 04dd09d83..25f258af0 100644
--- a/doc/sources/admin/applications/salesforce.rst
+++ b/doc/sources/admin/applications/salesforce.rst
@@ -46,7 +46,7 @@ Finally, just ensure that at least:
 match with the correct values. (adapt the domain if necessary)
 
 
-.. important:: 
+.. important::
 
     For now, the authentication service parameter has no
     domain available. You must come back later to fill this parameter. Once
@@ -54,7 +54,7 @@ match with the correct values. (adapt the domain if necessary)
     the login form, and you'll have an automatic redirection to your
     Identity Provider (no need for the user to click). Note that you can
     always access Salesforce by the general login page:
-    https://login.salesforce.com\ 
+    https://login.salesforce.com\
 
 SAML settings
 ~~~~~~~~~~~~~
diff --git a/doc/sources/admin/applications/simplesamlphp.rst b/doc/sources/admin/applications/simplesamlphp.rst
index a1f4994e3..092f1b270 100644
--- a/doc/sources/admin/applications/simplesamlphp.rst
+++ b/doc/sources/admin/applications/simplesamlphp.rst
@@ -90,7 +90,7 @@ Then set some attributes that will be sent to simpleSAMLphp:
 |image2|
 
 
-.. tip:: 
+.. tip::
 
     Set ``Mandatory`` to ``On`` to force attributes in
     authentication response.
@@ -120,7 +120,7 @@ internal PHP representation. Copy the ``saml20-idp-remote`` content:
    ?>
 
 
-.. tip:: 
+.. tip::
 
     Don't forget PHP start and end tag to have a valid PHP
     file.
@@ -183,7 +183,7 @@ And create a default IDP configuration:
    ?>
 
 
-.. important:: 
+.. important::
 
     You need to configure your own certificates and
     authentication scheme
@@ -198,7 +198,7 @@ List attributes you want to collect:
 |image6|
 
 
-.. tip:: 
+.. tip::
 
     You can keep ``Mandatory`` to ``Off`` to not fail if attribute
     is not sent by IDP
@@ -227,7 +227,7 @@ internal PHP representation. Copy the ``saml20-sp-remote`` content:
    ?>
 
 
-.. tip:: 
+.. tip::
 
     Don't forget PHP start and end tag to have a valid PHP
     file.
diff --git a/doc/sources/admin/applications/sympa.rst b/doc/sources/admin/applications/sympa.rst
index 537bb7be5..986302c9a 100644
--- a/doc/sources/admin/applications/sympa.rst
+++ b/doc/sources/admin/applications/sympa.rst
@@ -13,7 +13,7 @@ URL is protected by LL::NG, Sympa will display a button for users who
 wants to use this feature.
 
 
-.. tip:: 
+.. tip::
 
     Since version 1.9 of LLNG, old Auto-Login feature has been
     removed since it works only with Sympa-5 which has been deprecated
@@ -44,11 +44,11 @@ And fill it:
            logout_url                          http://sympa.example.com/wws/logout
 
 
-.. tip:: 
+.. tip::
 
     You can also disable internal Sympa authentication to keep
     only LemonLDAP::NG by removing user_table paragraph
-    
+
     Note that if you use FastCGI, you must restart Apache to enable changes.
 
 
@@ -63,7 +63,7 @@ Configure Sympa virtual host like other
 authentication URL.
 
 
-.. tip:: 
+.. tip::
 
     The location URL end is based on the ``service_id`` defined in
     Sympa apache configuration.
@@ -78,9 +78,9 @@ authentication URL.
           <Location /wws/sso_login/lemonldapng>
           PerlHeaderParserHandler Lemonldap::NG::Handler
           </Location>
-          
+
           ...
-          
+
    </VirtualHost>
 
 -  For Nginx:
@@ -103,8 +103,8 @@ authentication URL.
        fastcgi_param HOST $http_host;
        # Keep original request (LLNG server will received /llauth)
        fastcgi_param X_ORIGINAL_URI  $request_uri;
-     } 
-    
+     }
+
      # Client requests
      location /wws/sso_login/lemonldapng {
        auth_request /lmauth;
@@ -112,9 +112,9 @@ authentication URL.
        auth_request_set $lmlocation $upstream_http_location;
        error_page 401 $lmlocation;
        try_files $uri $uri/ =404;
-       
+
        ...
-        
+
        include /etc/lemonldap-ng/nginx-lua-headers.conf;
      }
      location / {
@@ -128,8 +128,8 @@ Sympa virtual host in Manager
 Go to the Manager and :doc:`create a new virtual host<../configvhost>`
 for Sympa.
 
-Configure the :doc:`access rules<../writingrulesand_headers>` and define
-the following :doc:`headers<../writingrulesand_headers>`:
+Configure the :ref:`access rules<rules>` and define
+the following :ref:`headers<headers>`:
 
 -  Auth-User
 -  Mail
diff --git a/doc/sources/admin/applications/tomcat.rst b/doc/sources/admin/applications/tomcat.rst
index 93a6fd00d..f85afe9b8 100644
--- a/doc/sources/admin/applications/tomcat.rst
+++ b/doc/sources/admin/applications/tomcat.rst
@@ -4,7 +4,7 @@ Apache Tomcat
 |image0|
 
 
-.. important:: 
+.. important::
 
     The Tomcat Valve is only available for tomcat 5.5 or
     greater.
@@ -32,7 +32,7 @@ authentication:
      <user username="role1" password="tomcat" roles="role1"/>
      <user username="both" password="tomcat" roles="tomcat,role1"/>
    </tomcat-users>
-    
+
 
 LL::NG provides a valve, available on :doc:`download page</download>`.
 This valve will check an HTTP header to set the authenticated user on
@@ -48,7 +48,7 @@ Copy ``ValveLemonLDAPNG.jar`` in ``<TOMCAT_HOME>/server/lib``:
    cp ValveLemonLDAPNG.jar server/lib/
 
 
-.. tip:: 
+.. tip::
 
     If needed, you can
     :doc:`recompile the valve from the sources<>`.
@@ -79,7 +79,7 @@ Configure attributes:
    present, a 403 error is sent.
 
 
-.. tip:: 
+.. tip::
 
     For debugging, this valve can print some helpful information
     in debug level. See `how configure logging in
@@ -100,15 +100,15 @@ Required :
 Configure your tomcat home in ``build.properties`` files.
 
 
-.. important:: 
+.. important::
 
     Be careful for Windows user, path must contains "/".
     Example:
-    
+
     ::
-    
+
        c:/my hardisk/tomcat/
-    
+
 
 
 Next run ant command:
diff --git a/doc/sources/admin/applications/wekan.rst b/doc/sources/admin/applications/wekan.rst
index 50ef65a5c..4b6927678 100644
--- a/doc/sources/admin/applications/wekan.rst
+++ b/doc/sources/admin/applications/wekan.rst
@@ -31,11 +31,11 @@ theses :
      * **OAUTH2_ID_MAP**: ''sub''
 
 
-.. warning:: 
+.. warning::
 
     Be careful to the / in server_url and endpoints, the
     complete URL need to be valid, ie auth.example.com/ for url & oauth2/xxx
-    for endpoints, OR, auth.example.com & /oauth2/xxx for endpoints. 
+    for endpoints, OR, auth.example.com & /oauth2/xxx for endpoints.
 
 Configuring LemonLDAP
 ~~~~~~~~~~~~~~~~~~~~~
@@ -59,11 +59,11 @@ with the following parameters:
 ^^^^^^^^^^^^^^^^^^
 
 
-.. warning:: 
+.. warning::
 
     OIDC login fails when an user as a multi-valued email
     attribute, this need to be fixed on wekan's side, we can bypass that by
-    telling lemonldap to only send one email 
+    telling lemonldap to only send one email
 
 Create a new macro, name it (_singleMail is an example), the macro
 should contain ``(split(/; /,$mail))[1]``
diff --git a/doc/sources/admin/applications/xwiki.rst b/doc/sources/admin/applications/xwiki.rst
index d4a155b49..715263889 100644
--- a/doc/sources/admin/applications/xwiki.rst
+++ b/doc/sources/admin/applications/xwiki.rst
@@ -71,9 +71,9 @@ Xwiki virtual host in Manager
 Go to the Manager and :doc:`create a new virtual host<../configvhost>`
 for Xwiki.
 
-Configure the :doc:`access rules<../writingrulesand_headers>`.
+Configure the :ref:`access rules<rules>`.
 
-Configure the :doc:`headers<../writingrulesand_headers>`:
+Configure the :ref:`headers<headers>`:
 
 -  remote_user: $uid
 -  remote_groups: encode_base64($groups,'')
diff --git a/doc/sources/admin/applications/zimbra.rst b/doc/sources/admin/applications/zimbra.rst
index 8c14da844..ead4b8e10 100644
--- a/doc/sources/admin/applications/zimbra.rst
+++ b/doc/sources/admin/applications/zimbra.rst
@@ -21,7 +21,7 @@ SSO on its application. This protocol is implemented in an LL::NG
 specific Handler.
 
 
-.. tip:: 
+.. tip::
 
     Zimbra can also be connected to LL::NG via
     :doc:`SAML protocol<../idpsaml>` (see `Zimbra
@@ -77,20 +77,20 @@ Zimbra parameters are the following:
    (by default: ^/zimbrasso$)
 
 
-.. important:: 
+.. important::
 
     Due to Handler API change in 1.9, you need to set these
     attributes in ``lemonldap-ng.ini`` and not in Manager, for example:
-    
+
     .. code:: ini
-    
+
        [handler]
        zimbraPreAuthKey = XXXX
        zimbraAccountKey = uid
        zimbraBy =id
        zimbraUrl = /service/preauth
        zimbraSsoUrl = ^/zimbrasso$
-    
+
 
 
 Multi-domain issues
diff --git a/doc/sources/admin/authad.rst b/doc/sources/admin/authad.rst
index 6b1c416ce..c788f6029 100644
--- a/doc/sources/admin/authad.rst
+++ b/doc/sources/admin/authad.rst
@@ -44,7 +44,7 @@ policy:
    specified in LemonLDAP::NG to do so.
 
 
-.. important:: 
+.. important::
 
     Note: since AD 2012, each user can have a specific
     password expiration policy. Then, the "maximum password age" can have
diff --git a/doc/sources/admin/authapache.rst b/doc/sources/admin/authapache.rst
index df32de201..668b2f2d8 100644
--- a/doc/sources/admin/authapache.rst
+++ b/doc/sources/admin/authapache.rst
@@ -4,7 +4,7 @@ Apache
 ============== ===== ========
 Authentication Users Password
 ============== ===== ========
-✔                   
+✔
 ============== ===== ========
 
 Presentation
@@ -16,14 +16,14 @@ module <http://httpd.apache.org/docs/current/howto/auth.html>`__, for
 example Kerberos, Radius, OTP, etc.
 
 
-.. important:: 
+.. important::
 
     To authenticate users using Kerberos, you can now use
     the new :doc:`Kerberos authentication module<authkerberos>` which allow
-    one to chain Kerberos in a :doc:`combination<authcombination>`\ 
+    one to chain Kerberos in a :doc:`combination<authcombination>`\
 
 
-.. tip:: 
+.. tip::
 
     Apache authentication module will set the ``REMOTE_USER``
     environment variable, which will be used by LL::NG to get authenticated
@@ -47,7 +47,7 @@ the Apache authentication fails. Use then the
    Apache;LDAP
 
 
-.. tip:: 
+.. tip::
 
     In this case, the Apache authentication module should not
     require a valid user and not be authoritative, else Apache server will
@@ -77,7 +77,7 @@ The Kerberos configuration is quite complex. You can find some
 configuration tips :doc:`on this page<kerberos>`.
 
 
-.. tip:: 
+.. tip::
 
     Prefer new :doc:`Kerberos<authkerberos>` module.
 
@@ -93,8 +93,8 @@ In this case, you can add in the Apache authentication module:
 
 .. code:: apache
 
-         Satisfy any 
-         Order allow,deny 
+         Satisfy any
+         Order allow,deny
          allow from APPLICATIONS_IP
 
 This will bypass the authentication module for request from
diff --git a/doc/sources/admin/authcas.rst b/doc/sources/admin/authcas.rst
index 7b4aa494e..cefdd0087 100644
--- a/doc/sources/admin/authcas.rst
+++ b/doc/sources/admin/authcas.rst
@@ -4,7 +4,7 @@ CAS
 ============== ===== ========
 Authentication Users Password
 ============== ===== ========
-✔                   
+✔
 ============== ===== ========
 
 Presentation
@@ -14,7 +14,7 @@ LL::NG can delegate authentication to a CAS server. This requires `Perl
 CAS module <http://sourcesup.cru.fr/projects/perlcas/>`__.
 
 
-.. tip:: 
+.. tip::
 
     LL::NG can also act as :doc:`CAS server<idpcas>`, that allows
     one to interconnect two LL::NG systems.
@@ -23,13 +23,12 @@ LL::NG can also request proxy tickets for its protected services. Proxy
 tickets will be collected at authentication phase and stored in user
 session under the form:
 
-``_casPT``\ **serviceID** = **Proxy ticket value**
+``_casPT<serviceID>`` = **Proxy ticket value**
 
 They can then be forwarded to applications trough
-:doc:`HTTP headers<writingrulesand_headers>`.
+:ref:`HTTP headers<headers>`.
 
-
-.. tip:: 
+.. tip::
 
     CAS authentication will automatically add a
     :doc:`logout forward rule<logoutforward>` on CAS server logout URL in
@@ -42,23 +41,23 @@ In Manager, go in ``General Parameters`` > ``Authentication modules``
 and choose CAS for authentication.
 
 
-.. tip:: 
+.. tip::
 
     You can then choose any other module for users and
     password.
 
 
-.. important:: 
+.. important::
 
     Browser implementations of formAction directive are
     inconsistent (e.g. Firefox doesn't block the redirects whereas Chrome
     does). Administrators may have to modify formAction value with wildcard
     likes \*.
-    
+
     In Manager, go in :
-    
+
     ``General Parameters`` > ``Advanced Parameters`` > ``Security`` >
-    ``Content Security Policy`` > ``Form destination`` 
+    ``Content Security Policy`` > ``Form destination``
 
 Then, go in ``CAS parameters``:
 
@@ -83,7 +82,7 @@ Then create the list of CAS servers in the manager. For each, set:
    -  **Value** Service URL (CAS service identifier)
 
 
-.. tip:: 
+.. tip::
 
     If no proxied services defined, CAS authentication will not
     activate the CAS proxy mode with this CAS server.
diff --git a/doc/sources/admin/authchoice.rst b/doc/sources/admin/authchoice.rst
index 489780363..7028305a2 100644
--- a/doc/sources/admin/authchoice.rst
+++ b/doc/sources/admin/authchoice.rst
@@ -40,7 +40,7 @@ In Manager, go in ``General Parameters`` > ``Authentication modules``
 and choose Choice for authentication.
 
 
-.. important:: 
+.. important::
 
     When ``Choice`` is selected for authentication, values
     for Users and Password modules are also forced to ``Choice``.
@@ -75,29 +75,29 @@ Define here:
    $env->{urldc} =~ /test1\.example\.com/
 
 
-.. important:: 
+.. note::
 
     Authentication request to an another URL than Portal URL can lead
     to a persistent loop between Portal and a redirection URL (pdata is not
     removed because domains mismatch). To avoid this, you have to set pdata
     cookie domain by editing ``lemonldap-ng.ini`` in section [portal]:
-    
+
     .. code:: ini
-    
+
        [portal]
        pdataDomain = example.com
-    
 
 
 
-.. tip:: 
+
+.. tip::
 
     You can prefix the key name with a digit to order them. The
     digit will not be shown on portal page. Underscore characters are also
     replaced by spaces.
 
 
-.. tip:: 
+.. tip::
 
     You can also override some LLNG parameters for each chain. See
     :doc:`Parameter list<parameterlist>` to have the key names to use
diff --git a/doc/sources/admin/authcombination.rst b/doc/sources/admin/authcombination.rst
index e6557a6bf..817daef11 100644
--- a/doc/sources/admin/authcombination.rst
+++ b/doc/sources/admin/authcombination.rst
@@ -4,7 +4,7 @@ Combination of authentication schemes
 ============== ===== ========
 Authentication Users Password
 ============== ===== ========
-✔              ✔    
+✔              ✔
 ============== ===== ========
 
 Presentation
@@ -42,7 +42,7 @@ must set:
    ldapServer,...
 
 
-.. important:: 
+.. note::
 
     To overload parameters, you must select a module, add a parameter
     and set its value.  For example:
@@ -50,7 +50,7 @@ must set:
 ==== ==== ============ ===========================
 Name Type Scope        Parameters
 ==== ==== ============ ===========================
-DB1  DBI  Auth only   
+DB1  DBI  Auth only
 DB2  DBI  User DB only dbiAuthChain => "mysql:..."
 ==== ==== ============ ===========================
 
@@ -71,7 +71,7 @@ JSON value:
    {"cn" => "cn", "uid" => "sAMAccounName", "mail" => "mail"}
 
 
-.. important:: 
+.. important::
 
     If your JSON is corrupted, LLNG will use it as string
     and just report a warning in logs.
@@ -104,11 +104,11 @@ Example                                 Explanation
 ======================================= =============================================================================
 
 
-.. important:: 
+.. important::
 
     Note that "or" can't be used inside a scheme. If you
     think to "[mySSL or myLDAP, myLDAP]", you must write
-    ``[mySSL, myLDAP] or [myLDAP, myLDAP]`` 
+    ``[mySSL, myLDAP] or [myLDAP, myLDAP]``
 
 ================================================== =========================================================
 Example                                            Explanation
@@ -118,13 +118,13 @@ Example                                            Explanation
 ================================================== =========================================================
 
 
-.. important:: 
+.. important::
 
     You can't use brackets in a boolean expression and "and"
     has precedence on "or".
-    
+
     If you think to "( [myLDAP] or [myDBI1] ) and [myDBI2]", you must write
-    ``[myLDAP] and [myDBI2] or [myDBI1] and [myDBI2]`` 
+    ``[myLDAP] and [myDBI2] or [myDBI1] and [myDBI2]``
 
 Tests
 ^^^^^
@@ -140,12 +140,12 @@ Example
 ======================================================================================================================= ==============================================================================
 
 
-.. important:: 
+.. important::
 
     Note that brackets can't be used except to enclose test.
-    
+
     If you wants to write ``if(...) then if...``, you must write
-    ``if(not ...) then ... else if(...)...`` 
+    ``if(not ...) then ... else if(...)...``
 
 Let's be crazy
 ^^^^^^^^^^^^^^
@@ -199,8 +199,8 @@ steps.
 ================================= =================================== ========================================================================
 Bad expression                    Solution                            Explanation
 ================================= =================================== ========================================================================
-*``[SAML] and [LDAP]``*           ``[SAML, SAML and LDAP]``           Authentication is done by SAML only but user must match an LDAP entry
-*``[SAML] and [LDAP] or [LDAP]``* ``[SAML, SAML and LDAP] or [LDAP]`` Authentication is done by SAML or LDAP but user must match an LDAP entry
+``[SAML] and [LDAP]``             ``[SAML, SAML and LDAP]``           Authentication is done by SAML only but user must match an LDAP entry
+``[SAML] and [LDAP] or [LDAP]``   ``[SAML, SAML and LDAP] or [LDAP]`` Authentication is done by SAML or LDAP but user must match an LDAP entry
 ================================= =================================== ========================================================================
 
 Auth::Apache authentication
@@ -212,7 +212,7 @@ behaviour: if the auth module fails, Apache returns 401. So it can be
 used only with a "and" boolean expression.
 
 
-.. tip:: 
+.. tip::
 
     The new :doc:`Kerberos authentication module<authkerberos>`
     solve this for Kerberos: you just have to use it instead of Apache and
diff --git a/doc/sources/admin/authcustom.rst b/doc/sources/admin/authcustom.rst
index 0e4c1372c..e9b70c7b6 100644
--- a/doc/sources/admin/authcustom.rst
+++ b/doc/sources/admin/authcustom.rst
@@ -14,10 +14,10 @@ This artifact allows one to define its own modules (authentication, user
 database, password or register database).
 
 
-.. tip:: 
+.. tip::
 
     The developer documentation is available in Portal manpages.
-    See Auth.pod and UserDB.pod 
+    See Auth.pod and UserDB.pod
 
 Configuration
 -------------
@@ -33,16 +33,18 @@ You can define your own customAuth module icon. Icon must be in
 site/htdocs/static/common/modules/icon.png
 
 
-.. tip:: 
+.. tip::
 
     ::Auth::My::Dev.pm means Lemonldap::NG::Portal::Auth::My::Dev
 
 
 
-.. important:: 
+.. important::
 
     Be careful. Don' t use an already attributed name in
-    configuration.  These parameters are available in your plugins
-    using ``$self->conf->{customAddParams}->{//customName//}``.
+    configuration.
+
+These parameters are available in your plugins using
+``$self->conf->{customAddParams}->{<customName>}``.
 
 Read portal manpages to see how to write these plugins.
diff --git a/doc/sources/admin/authdbi.rst b/doc/sources/admin/authdbi.rst
index e44859336..555a26160 100644
--- a/doc/sources/admin/authdbi.rst
+++ b/doc/sources/admin/authdbi.rst
@@ -34,7 +34,7 @@ LL::NG can use two tables:
 -  User table: where user data are stored (mail, name, etc.)
 
 
-.. tip:: 
+.. tip::
 
     Authentication table and user table can be the same.
 
@@ -105,15 +105,15 @@ Authentication level
 The authentication level given to users authenticated with this module.
 
 
-.. important:: 
+.. important::
 
     As DBI is a login/password based module, the
     authentication level can be:
-    
+
     -  increased (+1) if portal is protected by SSL (HTTPS)
     -  decreased (-1) if the portal autocompletion is allowed (see
        :doc:`portal customization<portalcustom>`)
-    
+
 
 
 Exported variables
@@ -126,7 +126,7 @@ Connection
 ~~~~~~~~~~
 
 
-.. tip:: 
+.. tip::
 
     Connection settings can be configured differently for
     authentication process and user process. This allows one to use
@@ -181,22 +181,22 @@ Password
    non-salted schemes" or "Supported salted schemes".
 
 
-.. important:: 
+.. important::
 
     The SQL function MUST have hexadecimal values as input
     AND output
 
 
-.. tip:: 
+.. tip::
 
     Here is an example for creating a postgreSQL SHA256 function.
     1. Install postgresql-contrib. 2. Activate extension:
     ``CREATE EXTENSION pgcrypto;`` 3. Create the hash function:
-    
+
     ::
-    
+
        CREATE OR REPLACE FUNCTION sha256(varchar) returns text AS $$
        SELECT encode(digest(decode($1, 'hex'), 'sha256'), 'hex')
        $$ LANGUAGE SQL STRICT IMMUTABLE;
-    
+
 
diff --git a/doc/sources/admin/authdemo.rst b/doc/sources/admin/authdemo.rst
index e120f2ba9..8f7e75483 100644
--- a/doc/sources/admin/authdemo.rst
+++ b/doc/sources/admin/authdemo.rst
@@ -14,7 +14,7 @@ This mode allow one to test LemonLDAP::NG without any third-party
 software.
 
 
-.. warning:: 
+.. warning::
 
     This mode must not be used for other purpose than test and
     demonstration!
@@ -30,7 +30,7 @@ dwho   dwho     dwho@badwolf.org   administrator
 ====== ======== ================== =============
 
 
-.. important:: 
+.. note::
 
     As you may have guessed, these accounts are famous characters from
     the TV show `Doctor
diff --git a/doc/sources/admin/authfacebook.rst b/doc/sources/admin/authfacebook.rst
index 2b63c2abe..0eaae8a65 100644
--- a/doc/sources/admin/authfacebook.rst
+++ b/doc/sources/admin/authfacebook.rst
@@ -4,7 +4,7 @@ Facebook
 ============== ===== ========
 Authentication Users Password
 ============== ===== ========
-✔              ✔    
+✔              ✔
 ============== ===== ========
 
 Presentation
@@ -56,27 +56,27 @@ variables:
    -  sn => last_name
 
 
-.. important:: 
+.. important::
 
     Do not query user field in exported variables, as it is
     already registered by the authentication module in ``$_user``.
 
 
-.. important:: 
+.. important::
 
     Browser implementations of formAction directive are
     inconsistent (e.g. Firefox doesn't block the redirects whereas Chrome
     does). Administrators may have to modify formAction value with wildcard
     likes \*.
-    
+
     In Manager, go in :
-    
+
     ``General Parameters`` > ``Advanced Parameters`` > ``Security`` >
-    ``Content Security Policy`` > ``Form destination`` 
+    ``Content Security Policy`` > ``Form destination``
 
 
-.. tip:: 
+.. tip::
 
     You can use the same Facebook access token in your
     applications. It is stored in session datas under the name
-    ``$_facebookToken``\ 
+    ``$_facebookToken``\
diff --git a/doc/sources/admin/authgithub.rst b/doc/sources/admin/authgithub.rst
index 4447d4668..4c1dd34fb 100644
--- a/doc/sources/admin/authgithub.rst
+++ b/doc/sources/admin/authgithub.rst
@@ -4,7 +4,7 @@ GitHub
 ============== ===== ========
 Authentication Users Password
 ============== ===== ========
-✔                   
+✔
 ============== ===== ========
 
 Presentation
@@ -35,20 +35,20 @@ Then, go in ``GitHub parameters``:
    https://developer.github.com/apps/building-oauth-apps/understanding-scopes-for-oauth-apps/
 
 
-.. tip:: 
+.. tip::
 
     Collected fields are stored in session in ``github_``
     keys
 
 
-.. important:: 
+.. important::
 
     Browser implementations of formAction directive are
     inconsistent (e.g. Firefox doesn't block the redirects whereas Chrome
     does). Administrators may have to modify formAction value with wildcard
     likes \*.
-    
+
     In Manager, go in:
-    
+
     ``General Parameters`` > ``Advanced Parameters`` > ``Security`` >
-    ``Content Security Policy`` > ``Form destination`` 
+    ``Content Security Policy`` > ``Form destination``
diff --git a/doc/sources/admin/authgpg.rst b/doc/sources/admin/authgpg.rst
index 4fded9bb7..d51116fe8 100644
--- a/doc/sources/admin/authgpg.rst
+++ b/doc/sources/admin/authgpg.rst
@@ -4,7 +4,7 @@ Databases
 ============== ===== ========
 Authentication Users Password
 ============== ===== ========
-✔                   
+✔
 ============== ===== ========
 
 Presentation
@@ -24,7 +24,7 @@ you just have to set GPG database. For example
 ``/usr/share/keyrings/debian-keyring.gpg``
 
 
-.. tip:: 
+.. tip::
 
     You can then choose any other module for users and
     password.
diff --git a/doc/sources/admin/authkerberos.rst b/doc/sources/admin/authkerberos.rst
index b91ab87c6..10f806457 100644
--- a/doc/sources/admin/authkerberos.rst
+++ b/doc/sources/admin/authkerberos.rst
@@ -4,7 +4,7 @@ Kerberos
 ============== ===== ========
 Authentication Users Password
 ============== ===== ========
-✔                   
+✔
 ============== ===== ========
 
 Presentation
@@ -36,18 +36,18 @@ and configure the following parameters:
    value and remove the '@domain'.
 
 
-.. important:: 
+.. important::
+
+
 
-    
-    
     -  Due to a perl GSSAPI issue, you may need to copy the keytab in
        /etc/krb5.keytab which is the default location hardcoded in the
        library
     -  As Kerberos ticket is passed inside Authorization header, you may
-       need to set CGIPassAuth on in Apache *(with old Apache, use
+       need to set CGIPassAuth on in Apache (with old Apache, use
        ``RewriteCond %{HTTP:Authorization}`` followed by
-       ``RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]``)*
-    
+       ``RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]``)
+
 
 
 Kerberos configuration
diff --git a/doc/sources/admin/authldap.rst b/doc/sources/admin/authldap.rst
index 5d8e90a0b..c4a81096f 100644
--- a/doc/sources/admin/authldap.rst
+++ b/doc/sources/admin/authldap.rst
@@ -38,7 +38,7 @@ In Manager, go in ``General Parameters`` > ``Authentication modules``
 and choose LDAP for authentication, users and/or password modules.
 
 
-.. tip:: 
+.. tip::
 
     For :doc:`Active Directory<authad>`, choose
     ``Active Directory`` instead of ``LDAP``.
@@ -49,15 +49,15 @@ Authentication level
 The authentication level given to users authenticated with this module.
 
 
-.. important:: 
+.. important::
 
     As LDAP is a login/password based module, the
     authentication level can be:
-    
+
     -  increased (+1) if portal is protected by SSL (HTTPS)
     -  decreased (-1) if the portal autocompletion is allowed (see
        :doc:`portal customization<portalcustom>`)
-    
+
 
 
 Exported variables
@@ -74,12 +74,12 @@ Connection
 
    -  More than one server can be set here separated by spaces or
       commas. They will be tested in the specified order.
-   -  To use TLS, set ``ldap+tls:%%//%%server`` and to use LDAPS, set
-      ``ldaps:%%//%%server`` instead of server name.
+   -  To use TLS, set ``ldap+tls://server`` and to use LDAPS, set
+      ``ldaps://server`` instead of server name.
    -  If you use TLS, you can set any of the
       `Net::LDAP <http://search.cpan.org/~gbarr/perl-ldap/lib/Net/LDAP.pod>`__
       start_tls() sub like
-      ``ldap+tls:%%//%%server/verify=none&capath=/etc/ssl``. You can
+      ``ldap+tls://server/verify=none&capath=/etc/ssl``. You can
       also use cafile and capath parameters.
 
 -  **Server port**: TCP port used by LDAP server. Can be overridden by
@@ -97,7 +97,7 @@ Connection
    documentation).
 
 
-.. important:: 
+.. important::
 
     LemonLDAP::NG need anonymous access to LDAP Directory
     RootDSE in order to check LDAP connection.
@@ -106,7 +106,7 @@ Filters
 ~~~~~~~
 
 
-.. tip:: 
+.. tip::
 
     In LDAP filters, $user is replaced by user login, and $mail by
     user email.
@@ -121,22 +121,24 @@ Filters
    ``find``)
 
 
-.. tip:: 
+.. tip::
 
     For Active Directory, the default authentication filter is:
-    
+
     ::
-    
+
        (&(sAMAccountName=$user)(objectClass=person))
-    
+
     And the mail filter is:
-    
+
     ::
-    
+
        (&(mail=$mail)(objectClass=person))
-    
 
 
+
+.. _authldap-groups:
+
 Groups
 ~~~~~~
 
@@ -159,17 +161,18 @@ Groups
    used in the link, for recursive group search (default: dn).
 
 
-.. important:: 
+.. note::
 
     The groups that the user belongs to are available as ``$groups``
-    and ``%hGroups``, as documented :doc:`here<exportedvars>` 
+    and ``%hGroups``, as documented :ref:`here<macros_and_groups>`
 
 
-.. important:: 
+.. important::
 
     If your LDAP countains over a thousand groups, you
     should avoid using group processing, check out
-    :doc:`the performance page<performances>` for alternatives 
+    :ref:`the performance page<performances-ldap-performances>` for
+    alternatives 
 
 Password
 ~~~~~~~~
diff --git a/doc/sources/admin/authlinkedin.rst b/doc/sources/admin/authlinkedin.rst
index 00a58c04d..7f10786a4 100644
--- a/doc/sources/admin/authlinkedin.rst
+++ b/doc/sources/admin/authlinkedin.rst
@@ -4,7 +4,7 @@ LinkedIn
 ============== ===== ========
 Authentication Users Password
 ============== ===== ========
-✔                   
+✔
 ============== ===== ========
 
 Presentation
@@ -39,20 +39,20 @@ Then, go in ``LinkedIn parameters``:
    and last name, and ``r_emailaddress`` to get email.
 
 
-.. tip:: 
+.. tip::
 
     Collected fields are stored in session in ``linkedIn_``
     keys
 
 
-.. important:: 
+.. important::
 
     Browser implementations of formAction directive are
     inconsistent (e.g. Firefox doesn't block the redirects whereas Chrome
     does). Administrators may have to modify formAction value with wildcard
     likes \*.
-    
+
     In Manager, go in :
-    
+
     ``General Parameters`` > ``Advanced Parameters`` > ``Security`` >
-    ``Content Security Policy`` > ``Form destination`` 
+    ``Content Security Policy`` > ``Form destination``
diff --git a/doc/sources/admin/authmulti.rst b/doc/sources/admin/authmulti.rst
index 2c6deb689..6ec8a3575 100644
--- a/doc/sources/admin/authmulti.rst
+++ b/doc/sources/admin/authmulti.rst
@@ -2,7 +2,7 @@ Multiple backends stack
 =======================
 
 
-.. important:: 
+.. important::
 
     This module has been removed and replaced by the more
     powerful :doc:`Combination of auth schemes<authcombination>`.
diff --git a/doc/sources/admin/authopenid.rst b/doc/sources/admin/authopenid.rst
index 3ed2308f6..d77f01443 100644
--- a/doc/sources/admin/authopenid.rst
+++ b/doc/sources/admin/authopenid.rst
@@ -4,11 +4,11 @@ OpenID
 ============== ===== ========
 Authentication Users Password
 ============== ===== ========
-✔              ✔    
+✔              ✔
 ============== ===== ========
 
 
-.. warning:: 
+.. warning::
 
     OpenID protocol is deprecated. You should now use
     :doc:`OpenID Connect<authopenidconnect>`.
@@ -22,7 +22,7 @@ module <http://search.cpan.org/~mart/Net-OpenID-Consumer/>`__ with at
 least version 1.0.
 
 
-.. tip:: 
+.. tip::
 
     LL::NG can also act as :doc:`OpenID server<idpopenid>`, that
     allows one to interconnect two LL::NG systems.
@@ -31,7 +31,7 @@ LL::NG will then display a form with an OpenID input, wher users will
 type their OpenID login.
 
 
-.. tip:: 
+.. tip::
 
     OpenID authentication can proposed as an alternate
     authentication scheme using the :doc:`authentication choice<authchoice>`
@@ -79,14 +79,14 @@ define attributes:
 See also :doc:`exported variables configuration<exportedvars>`.
 
 
-.. important:: 
+.. important::
 
     Browser implementations of formAction directive are
     inconsistent (e.g. Firefox doesn't block the redirects whereas Chrome
     does). Administrators may have to modify formAction value with wildcard
     likes \*.
-    
+
     In Manager, go in :
-    
+
     ``General Parameters`` > ``Advanced Parameters`` > ``Security`` >
-    ``Content Security Policy`` > ``Form destination`` 
+    ``Content Security Policy`` > ``Form destination``
diff --git a/doc/sources/admin/authopenidconnect.rst b/doc/sources/admin/authopenidconnect.rst
index bd750f00f..8a951f7a9 100644
--- a/doc/sources/admin/authopenidconnect.rst
+++ b/doc/sources/admin/authopenidconnect.rst
@@ -4,14 +4,14 @@ OpenID Connect
 ============== ===== ========
 Authentication Users Password
 ============== ===== ========
-✔              ✔    
+✔              ✔
 ============== ===== ========
 
 Presentation
 ------------
 
 
-.. important:: 
+.. note::
 
     OpenID Connect is a protocol based on REST, OAuth 2.0 and JOSE
     stacks. It is described here: http://openid.net/connect/.
@@ -34,14 +34,19 @@ You can use this authentication module to link your LL::NG server to any
 OpenID Connect Provider. Here are some examples, witch their specific
 documentation:
 
-================================================ ========================================
-Google                                           France Connect
-================================================ ========================================
-:doc:`google_logo.png<authopenidconnect_google>` :doc:`franceconnect_logo.png<authopenidconnect_franceconnect>`
-================================================ ========================================
+=============== ==================
+Google          France Connect
+=============== ==================
+|google|        |franceconnect|
+=============== ==================
 
+.. |google| image:: applications/google_logo.png
+   :target: authopenidconnect_google.html
 
-.. important:: 
+.. |franceconnect| image:: applications/franceconnect_logo.png
+   :target: authopenidconnect_franceconnect.html
+
+.. important::
 
     OpenID-Connect specification isn't finished for logout
     propagation. So logout initiated by relaying-party will be forward to
@@ -67,23 +72,23 @@ In ``General Parameters`` > ``Authentication modules``, set:
 -  **Users module**: OpenID Connect
 
 
-.. tip:: 
+.. tip::
 
     As passwords will not be managed by LL::NG, you can disable
-    :doc:`menu password module<portalmenu>`.
+    :ref:`menu password module<portalmenu-menu-modules>`.
 
 
-.. important:: 
+.. important::
 
     Browser implementations of formAction directive are
     inconsistent (e.g. Firefox doesn't block the redirects whereas Chrome
     does). Administrators may have to modify formAction value with wildcard
     likes \*.
-    
+
     In Manager, go in :
-    
+
     ``General Parameters`` > ``Advanced Parameters`` > ``Security`` >
-    ``Content Security Policy`` > ``Form destination`` 
+    ``Content Security Policy`` > ``Form destination``
 
 Then in ``General Parameters`` > ``Authentication modules`` >
 ``OpenID Connect parameters``, you can set:
@@ -111,7 +116,7 @@ parameter, for example:
 -  http://auth.example.com/?lmAuth=oidc&openidcallback=1
 
 
-.. important:: 
+.. important::
 
     If you use the :doc:`choice backend<authchoice>`, you
     need to add the choice parameter in redirect URL
@@ -169,7 +174,7 @@ automatically if jwks_uri is defined in metadata. Else you can paste the
 content of the JSON file in the textarea.
 
 
-.. tip:: 
+.. tip::
 
     If the OpenID Connect provider only uses symmetric encryption,
     JWKS data is not useful.
diff --git a/doc/sources/admin/authopenidconnect_franceconnect.rst b/doc/sources/admin/authopenidconnect_franceconnect.rst
index 52a9c1bc6..20dbcc7a1 100644
--- a/doc/sources/admin/authopenidconnect_franceconnect.rst
+++ b/doc/sources/admin/authopenidconnect_franceconnect.rst
@@ -10,7 +10,7 @@ Presentation
 authentication platform made by French government.
 
 
-.. important:: 
+.. important::
 
     It is for the moment only in BETA stage. This
     documentation will explain how to configure LL::NG with the developer
diff --git a/doc/sources/admin/authopenidconnect_google.rst b/doc/sources/admin/authopenidconnect_google.rst
index 33e8fb599..861215bea 100644
--- a/doc/sources/admin/authopenidconnect_google.rst
+++ b/doc/sources/admin/authopenidconnect_google.rst
@@ -12,7 +12,7 @@ delegate the authentication of LL::NG to Google:
 https://developers.google.com/identity/protocols/OpenIDConnect
 
 
-.. important:: 
+.. important::
 
     Google does not support logout trough OpenID Connect. If
     you close your session on LL::NG side, your Google session will still be
diff --git a/doc/sources/admin/authpam.rst b/doc/sources/admin/authpam.rst
index bb649838b..40614a8c4 100644
--- a/doc/sources/admin/authpam.rst
+++ b/doc/sources/admin/authpam.rst
@@ -4,7 +4,7 @@ PAM
 ============== ===== ========
 Authentication Users Password
 ============== ===== ========
-✔                   
+✔
 ============== ===== ========
 
 Presentation
@@ -41,7 +41,7 @@ In Manager, go in ``General Parameters`` > ``Authentication modules``
 and choose PAM for authentication.
 
 
-.. tip:: 
+.. tip::
 
     You can then choose any other module for users and
     password.
diff --git a/doc/sources/admin/authproxy.rst b/doc/sources/admin/authproxy.rst
index 2f8ff84a4..768d6281f 100644
--- a/doc/sources/admin/authproxy.rst
+++ b/doc/sources/admin/authproxy.rst
@@ -4,7 +4,7 @@ Proxy
 ============== ===== ========
 Authentication Users Password
 ============== ===== ========
-✔              ✔    
+✔              ✔
 ============== ===== ========
 
 Presentation
@@ -60,6 +60,6 @@ in your lemonldap-ng.ini:
    soapProxyUrn = urn:Lemonldap/NG/Common/CGI/SOAPService
 
 
-.. important:: 
+.. important::
 
     This needs LLNG version 2.0.8 at least
diff --git a/doc/sources/admin/authradius.rst b/doc/sources/admin/authradius.rst
index dcdbdb1a4..4a57a096b 100644
--- a/doc/sources/admin/authradius.rst
+++ b/doc/sources/admin/authradius.rst
@@ -4,7 +4,7 @@ Radius
 ============== ===== ========
 Authentication Users Password
 ============== ===== ========
-✔                   
+✔
 ============== ===== ========
 
 Presentation
@@ -44,7 +44,7 @@ In Manager, go in ``General Parameters`` > ``Authentication modules``
 and choose Radius for authentication.
 
 
-.. tip:: 
+.. tip::
 
     You can then choose any other module for users and
     password.
diff --git a/doc/sources/admin/authremote.rst b/doc/sources/admin/authremote.rst
index 1aa250c4c..3b12aad4c 100644
--- a/doc/sources/admin/authremote.rst
+++ b/doc/sources/admin/authremote.rst
@@ -4,11 +4,11 @@ Remote
 ============== ===== ========
 Authentication Users Password
 ============== ===== ========
-✔              ✔    
+✔              ✔
 ============== ===== ========
 
 
-.. warning:: 
+.. warning::
 
     This module is a LL::NG specific identity federation
     protocol. You may rather use standards protocols like
@@ -44,7 +44,7 @@ Presentation
 #. User can now access to the protected application
 
 
-.. important:: 
+.. note::
 
     Note that if the user is already authenticated on the first
     portal, all redirections are transparent.
diff --git a/doc/sources/admin/authrest.rst b/doc/sources/admin/authrest.rst
index cd1080017..875314d9d 100644
--- a/doc/sources/admin/authrest.rst
+++ b/doc/sources/admin/authrest.rst
@@ -32,7 +32,7 @@ Password change       Password change URL
 ===================== ====================================
 
 
-.. tip:: 
+.. tip::
 
     You can then choose any other module for users and
     password.
@@ -62,9 +62,9 @@ Password change URL       ``{"user":$user,"password":$password}`` ``{"result":tr
 ========================= ======================================= ===================================================
 
 
-.. tip:: 
+.. tip::
 
     To have only one REST call during the login process, you can
     set REST only as an Authentication backend, configure Null as your User
     Database, and make sure the REST authentication URL send all your user
-    attributes in the ``info`` response key 
+    attributes in the ``info`` response key
diff --git a/doc/sources/admin/authsaml.rst b/doc/sources/admin/authsaml.rst
index 7400a6a05..3a31fb7d0 100644
--- a/doc/sources/admin/authsaml.rst
+++ b/doc/sources/admin/authsaml.rst
@@ -4,7 +4,7 @@ SAML
 ============== ===== ========
 Authentication Users Password
 ============== ===== ========
-✔              ✔    
+✔              ✔
 ============== ===== ========
 
 Presentation
@@ -22,7 +22,7 @@ be mandatory, so if they are not returned by IDP, the session will not
 open.
 
 
-.. tip:: 
+.. tip::
 
     LL::NG can also act as :doc:`SAML IDP<idpsaml>`, that allows
     one to interconnect two LL::NG systems.
@@ -36,17 +36,17 @@ SAML Service
 See :doc:`SAML service<samlservice>` configuration chapter.
 
 
-.. important:: 
+.. important::
 
     Browser implementations of formAction directive are
     inconsistent (e.g. Firefox doesn't block the redirects whereas Chrome
     does). Administrators may have to modify formAction value with wildcard
     likes \*.
-    
+
     In Manager, go in :
-    
+
     ``General Parameters`` > ``Advanced Parameters`` > ``Security`` >
-    ``Content Security Policy`` > ``Form destination`` 
+    ``Content Security Policy`` > ``Form destination``
 
 Authentication and UserDB
 ~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -57,10 +57,10 @@ In ``General Parameters`` > ``Authentication modules``, set:
 -  Users module: Same (eq SAML)
 
 
-.. tip:: 
+.. tip::
 
     As passwords will not be managed by LL::NG, you can disable
-    :doc:`menu password module<portalmenu>`.
+    :ref:`menu password module<portalmenu-menu-modules>`.
 
 Register LemonLDAP::NG on partner Identity Provider
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -89,7 +89,7 @@ between your server and the IDP):
 |image0|
 
 
-.. tip:: 
+.. tip::
 
     You can also edit the metadata directly in the textarea
 
@@ -145,8 +145,9 @@ Authentication request
 -  **Requested authentication context**: this context is declared in
    authentication request. When receiving the request, the real
    authentication context will be mapped to an internal authentication
-   level (see :doc:`how configure the mapping<samlservice>`), that you
-   can check to allow or deny session creation.
+   level (see
+   :ref:`how configure the mapping<samlservice-authentication-contexts>`),
+   that you can check to allow or deny session creation.
 -  **Allow URL as RelayState**: Set to On if the RelayState value sent
    by IDP is the URL where the user must be redirected after
    authentication.
@@ -172,7 +173,7 @@ Signature
 '''''''''
 
 These options override service signature options (see
-:doc:`SAML service configuration<samlservice>`).
+:ref:`SAML service configuration<samlservice-general-options>`).
 
 -  **Sign SSO message**: sign SSO message
 -  **Check SSO message signature**: check SSO message signature
@@ -188,7 +189,7 @@ Binding
    http-post, etc.)
 
 
-.. important:: 
+.. note::
 
     If no binding defined, the default binding in IDP metadata will be
     used.
@@ -213,7 +214,7 @@ Used only if you have more than 1 SAML Identity Provider declared
 -  **Order**: Number to sort IDP display
 
 
-.. tip:: 
+.. tip::
 
     The chosen logo must be in Portal icons directory
     (``portal/static/common/``). You can set a custom icon by setting the
diff --git a/doc/sources/admin/authslave.rst b/doc/sources/admin/authslave.rst
index a6b6011b1..8a8589d84 100644
--- a/doc/sources/admin/authslave.rst
+++ b/doc/sources/admin/authslave.rst
@@ -4,7 +4,7 @@ Slave
 ============== ===== ========
 Authentication Users Password
 ============== ===== ========
-✔              ✔    
+✔              ✔
 ============== ===== ========
 
 Presentation
diff --git a/doc/sources/admin/authssl.rst b/doc/sources/admin/authssl.rst
index f8c2f68e8..a6196a7b6 100644
--- a/doc/sources/admin/authssl.rst
+++ b/doc/sources/admin/authssl.rst
@@ -4,7 +4,7 @@ SSL
 ============== ===== ========
 Authentication Users Password
 ============== ===== ========
-✔                   
+✔
 ============== ===== ========
 
 Presentation
@@ -23,9 +23,8 @@ Configuration (as the only authentication module)
 
 By default, SSL is required before the portal is displayed (handled by
 webserver). If you want to display a button to connect to LLNG
-*(compatible with :doc:`Combination<authcombination>`)*, you can
-activate "SSL by Ajax request" in the manager. See "SSL by Ajax"
-below.
+(compatible with :doc:`Combination<authcombination>`), you can
+activate "SSL by Ajax request" in the manager.
 
 With Apache
 ~~~~~~~~~~~
@@ -42,13 +41,13 @@ For CentOS/RHEL:
    yum install mod_ssl
 
 
-.. tip:: 
+.. tip::
 
     In Debian/Ubuntu mod_ssl is already shipped in
     ``apache*-common`` package.
 
 
-.. tip:: 
+.. tip::
 
     For CentOS/RHEL, We advice to disable the default SSL virtual
     host configured in /etc/httpd/conf.d/ssl.conf.
@@ -68,16 +67,16 @@ of /etc/lemonldap-ng/portal-apache2.conf:
    SSLCACertificateFile /etc/httpd/certs/ow2-ca.cert
 
 
-.. important:: 
+.. note::
 
     Put your own files instead of ``ow2.cert``, ``ow2.key``,
     ``ow2-ca.cert``:
-    
+
     -  **SSLCertificateFile**: Server certificate
     -  **SSLCertificateKeyFile**: Server private key
     -  **SSLCACertificateFile**: CA certificate to validate client
        certificates
-    
+
 
 
 If you specify port in virtual host, then declare SSL port:
@@ -161,7 +160,7 @@ Nginx SSL Virtual Host example with uWSGI
 
      ssl_verify_client on;
      ssl_verify_depth 3;
-     
+
      # Full chain CRL is required
      # All CRLs must be concatenated in a single .pem format file
      ssl_crl /etc/nginx/ssl/crl/crls.pem;
@@ -187,12 +186,12 @@ Nginx SSL Virtual Host example with uWSGI
    }
 
 
-.. important:: 
+.. important::
 
     Nginx 1.11.6 change: format of the $ssl_client_s_dn and
     $ssl_client_i_dn variables has been changed to follow RFC 2253 (RFC
     4514); values in the old format are available in the
-    $ssl_client_s_dn_legacy and $ssl_client_i_dn_legacy variables. 
+    $ssl_client_s_dn_legacy and $ssl_client_i_dn_legacy variables.
 
 Configuration of LemonLDAP::NG
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -201,7 +200,7 @@ In Manager, go in ``General Parameters`` > ``Authentication modules``
 and choose SSL for authentication.
 
 
-.. tip:: 
+.. tip::
 
     You can then choose any other module for users and
     password.
@@ -296,7 +295,7 @@ limitation.
            beforeSend:function(){},
            type:"GET",
            dataType:"html",
-           success:function(c,a){ 
+           success:function(c,a){
              if (c !== "") {
                    alert("Carte OK");
                    window.location.href = "https://auth.example.com/sslok/";
@@ -333,12 +332,12 @@ connexion reset:
    ssl_session_timeout 1s;
 
 
-.. warning:: 
+.. warning::
 
     It is incompatible with authentication combination because
     of Apache parameter "SSLVerifyClient", which must have the value
     "require". To enable SSL with :doc:`Combination<authcombination>`, use
-    "SSL by Ajax" 
+    "SSL by Ajax"
 
 Configuration (for Combination/Choice)
 --------------------------------------
@@ -348,59 +347,60 @@ If you enable this feature, you must configure 2 portal virtual hosts:
 -  the main *(which corresponds to portal URL)* with
    ``SSLVerifyClient none``
 -  the second with ``SSLVerifyClient require`` and a
-   ``Header set Allow-Control-Allow-Origin %%https://portal-main-url%%``
+   ``Header set Allow-Control-Allow-Origin https://portal-main-url``
 
 then declare the second URL in SSL options in the Manager. That's all !
-Then you can chain it in a :doc:`combination<authcombination>`. 
-.. important:: 
+Then you can chain it in a :doc:`combination<authcombination>`.
+
+.. note::
+
 
-    
     With :doc:`choice<authchoice>`, the second URL should be also declared
-    in module URL parameter to redirect user to Portal menu.  
+    in module URL parameter to redirect user to Portal menu.
+
+.. note::
 
-.. important:: 
 
-    
     Ajax authentication request can be sent to an another URL than Portal
     URL.
-    
+
     To avoid a persistent loop between Portal and a redirection URL (pdata
     is not removed because domains mismatch), you have to set pdata cookie
     domain by editing ``lemonldap-ng.ini`` in section [portal]:
-    
+
     .. code:: ini
-    
+
        [portal]
        pdataDomain = example.com
-    
+
     To avoid a bad/expired token during session upgrading (Reauthentication)
     if URLs are served by different load balancers, you can force Upgrade
     tokens to be stored into Global Storage by editing ``lemonldap-ng.ini``
     in section [portal]:
-    
+
     .. code:: ini
-    
+
        [portal]
        forceGlobalStorageUpgradeOTT = 1
-    
- 
-.. important:: 
+
+
+.. important::
 
     **Content Security Policy** may prevent to
     submit Ajax Request. To avoid security warning,
-    
+
     Go to :
     ``General Parameters > Advanced Parameters > Security > Content security policy``
-    
+
     and set :
-    
+
     **Default value** => 'self' "Ajax request URL"
-    
+
     **Form destinations** => 'self' "Ajax request URL"
-    
+
     **Ajax destinations** => 'self' "Ajax request URL"
-    
-    **Script source** => 'self' "Ajax request URL" 
+
+    **Script source** => 'self' "Ajax request URL"
 
 Extracting the username attribute
 ---------------------------------
diff --git a/doc/sources/admin/authtwitter.rst b/doc/sources/admin/authtwitter.rst
index e80859c39..abce61bbe 100644
--- a/doc/sources/admin/authtwitter.rst
+++ b/doc/sources/admin/authtwitter.rst
@@ -4,7 +4,7 @@ Twitter
 ============== ===== ========
 Authentication Users Password
 ============== ===== ========
-✔                   
+✔
 ============== ===== ========
 
 Presentation
@@ -30,23 +30,23 @@ In Manager, go in ``General Parameters`` > ``Authentication modules``
 and choose Twitter for authentication module.
 
 
-.. tip:: 
+.. tip::
 
     You can then choose any other module for users and
     password.
 
 
-.. important:: 
+.. important::
 
     Browser implementations of formAction directive are
     inconsistent (e.g. Firefox doesn't block the redirects whereas Chrome
     does). Administrators may have to modify formAction value with wildcard
     likes \*.
-    
+
     In Manager, go in :
-    
+
     ``General Parameters`` > ``Advanced Parameters`` > ``Security`` >
-    ``Content Security Policy`` > ``Form destination`` 
+    ``Content Security Policy`` > ``Form destination``
 
 Then, go in ``Twitter parameters``:
 
diff --git a/doc/sources/admin/authwebid.rst b/doc/sources/admin/authwebid.rst
index afac50b17..00183c1db 100644
--- a/doc/sources/admin/authwebid.rst
+++ b/doc/sources/admin/authwebid.rst
@@ -4,7 +4,7 @@ WebID
 ============== ===== ========
 Authentication Users Password
 ============== ===== ========
-✔              ✔    
+✔              ✔
 ============== ===== ========
 
 Presentation
diff --git a/doc/sources/admin/authyubikey.rst b/doc/sources/admin/authyubikey.rst
index d06d205f9..f15867488 100644
--- a/doc/sources/admin/authyubikey.rst
+++ b/doc/sources/admin/authyubikey.rst
@@ -2,7 +2,7 @@ Yubikey
 =======
 
 
-.. important:: 
+.. important::
 
     This module has been replaced by
-    :doc:`Yubikey Second Factor<yubikey2f>`\ 
+    :doc:`Yubikey Second Factor<yubikey2f>`\
diff --git a/doc/sources/admin/autosignin.rst b/doc/sources/admin/autosignin.rst
index 3f73e0e48..b10050d50 100644
--- a/doc/sources/admin/autosignin.rst
+++ b/doc/sources/admin/autosignin.rst
@@ -18,6 +18,6 @@ dwho           ''$env->{REMOTE_ADDR} eq '192.168.42.42' ''
 ============== ===========================================
 
 
-.. important:: 
+.. important::
 
     Username must be defined in the user database.
diff --git a/doc/sources/admin/behindproxyminihowto.rst b/doc/sources/admin/behindproxyminihowto.rst
index d2f10db5e..5feb8a8e2 100644
--- a/doc/sources/admin/behindproxyminihowto.rst
+++ b/doc/sources/admin/behindproxyminihowto.rst
@@ -39,10 +39,10 @@ uncomment the relevant parts of the configuration file.
        real_ip_header    X-Forwarded-For;
 
 
-.. tip:: 
+.. tip::
 
     Make sure Nginx was compiled with the `http_real_ip
-    module <http://nginx.org/en/docs/http/ngx_http_realip_module.html>`__\ 
+    module <http://nginx.org/en/docs/http/ngx_http_realip_module.html>`__\
 
 -  For Apache:
 
@@ -52,14 +52,14 @@ uncomment the relevant parts of the configuration file.
         RemoteIPInternalProxy 127.0.0.1
 
 
-.. tip:: 
+.. tip::
 
     Make sure the `mod_remoteip
     module <https://httpd.apache.org/docs/2.4/mod/mod_remoteip.html>`__ is
     enabled in your Apache installation
 
 
-.. warning:: 
+.. warning::
 
     Both modules need you to specify the address of your
     reverse proxy. Using the ``http_real_ip`` or ``mod_remoteip`` module
diff --git a/doc/sources/admin/browseablesessionbackend.rst b/doc/sources/admin/browseablesessionbackend.rst
index de00bef44..bd0a8a038 100644
--- a/doc/sources/admin/browseablesessionbackend.rst
+++ b/doc/sources/admin/browseablesessionbackend.rst
@@ -5,16 +5,16 @@ Presentation
 ------------
 
 Browseable session backend
-(`Apache::Session::Browseable <https://metacpan.org/pod/Apache::Session::Browseable>`)
+(`Apache::Session::Browseable <https://metacpan.org/pod/Apache::Session::Browseable>`__)
 works exactly like Apache::Session::\* corresponding module but add
-index that increase :doc:`session explorer<features>` and
-:doc:`session restrictions<features>` performances.
+index that increase :ref:`session explorer<session-explorer>` and
+:ref:`session restrictions<session-restrictions>` performances.
 
 If you use features like SAML (authentication and issuer), CAS (issuer)
 and password reset self-service, you also need to index some fields.
 
 
-.. important:: 
+.. note::
 
     Without index, LL::NG will have to retrieve all sessions stored in
     backend and parse them to find the needed sessions. With index, LL::NG
@@ -37,21 +37,21 @@ SAML Session                           \_saml_id
 See Apache::Session::Browseable man page to see how use indexes.
 
 
-.. important:: 
+.. important::
 
     \ *WHATTOTRACE* must be replaced by the attribute or
     macro configured in the What To Trace parameter (REMOTE_USER). By
-    default: **\_whatToTrace**\ 
+    default: **\_whatToTrace**\
 
 
-.. tip:: 
+.. tip::
 
     It is advised to use separate session backends for standard
     sessions, SAML sessions and CAS sessions, in order to manage index
     separately.
 
 
-.. important:: 
+.. note::
 
     Documentation below explains how set index on ipAddr and
     \_whatToTrace. Adapt it to configure the index you need.
@@ -67,7 +67,7 @@ You then just have to add the ``Index`` parameter in
 ``Apache::Session module`` :
 
 =================== ============ ====================
-Required parameters             
+Required parameters
 =================== ============ ====================
 Name                Comment      Example
 **server**          Redis server 127.0.0.1:6379
@@ -78,30 +78,30 @@ Browseable SQL
 --------------
 
 
-.. important:: 
+.. note::
 
     This documentation concerns PostgreSQL. Some adaptations are
     needed with other databases. When using
     Apache::Session::Browseable::Postgres, it
     is strongly recommended to use version 1.3.1 at least. See `bug
-    1732 <https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/issues/1732>`.
+    1732 <https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/issues/1732>`__.
 
 Prepare database
 ~~~~~~~~~~~~~~~~
 
 Database must be prepared exactly like in
-:doc:`SQL session backend<sqlsessionbackend>` except that a field must
-be added for each data to index.
+:ref:`SQL session backend<sqlsessionbackend-prepare-the-database>`
+except that a field must be added for each data to index.
 
 
-.. important:: 
+.. important::
 
     Data written to UNLOGGED tables is not written to the
     WAL, which makes them considerably faster than ordinary tables. However,
     they are not crash-safe: an unlogged table is automatically truncated
     after a crash or unclean shutdown. The contents of an unlogged table are
     also not replicated to standby servers. Any indexes created on an
-    unlogged table are automatically unlogged as well. 
+    unlogged table are automatically unlogged as well.
 
 Apache::Session::Browseable::Postgres
 example:
@@ -124,7 +124,7 @@ example:
    CREATE INDEX h1   ON sessions (_httpSessionType);
 
 
-.. important:: 
+.. important::
 
     For Session Explorer and one-off sessions, it is
     recommended to use BTREE or any index method that indexes partial
@@ -135,7 +135,7 @@ now recommended SHA256 hash algorithm. See
 :doc:`Sessions<sessions>` for more details.
 
 
-.. tip:: 
+.. tip::
 
     With new
     Apache::Session::Browseable::PgHstore
@@ -153,7 +153,7 @@ for MySQL) in ``General parameters`` » ``Sessions`` »
 parameters (case sensitive):
 
 =================== ================================================= =============================================================
-Required parameters                                                  
+Required parameters
 =================== ================================================= =============================================================
 Name                Comment                                           Example
 **DataSource**      The `DBI <https://metacpan.org/pod/DBI>`__ string dbi:Pg:database=lemonldap-ng
@@ -164,11 +164,11 @@ Name                Comment                                           Example
 =================== ================================================= =============================================================
 
 
-.. tip:: 
+.. tip::
 
     Apache::Session::Browseable::MySQL doesn't use locks so performances are
     keeped.
-    
+
     For databases like PostgreSQL, don't forget to add "Commit" with a value
     of 1
 
@@ -184,7 +184,7 @@ You need to add the ``Index`` field and can also configure the
 values will be stored.
 
 ======================== ================================= ===============================
-Required parameters                                       
+Required parameters
 ======================== ================================= ===============================
 Name                     Comment                           Example
 **ldapServer**           URI of the server                 ldap://localhost
@@ -192,7 +192,7 @@ Name                     Comment                           Example
 **ldapBindDN**           Connection login                  cn=admin,dc=example,dc=password
 **ldapBindPassword**     Connection password               secret
 **Index**                Index list                        \_whatToTrace ipAddr
-Optional parameters                                       
+Optional parameters
 Name                     Comment                           Default value
 **ldapObjectClass**      Objectclass of the entry          applicationProcess
 **ldapAttributeId**      Attribute storing session ID      cn
diff --git a/doc/sources/admin/bruteforceprotection.rst b/doc/sources/admin/bruteforceprotection.rst
index b03fa8dca..568a52c83 100644
--- a/doc/sources/admin/bruteforceprotection.rst
+++ b/doc/sources/admin/bruteforceprotection.rst
@@ -47,11 +47,11 @@ section:
    bruteForceProtectionMaxLockTime = 900
 
 
-.. important:: 
+.. note::
 
     Max lock time value is used by this plugin if a lock time is
     missing (number of failed logins higher than listed lock time values).
-    Lock time values can not be higher than max lock time. 
+    Lock time values can not be higher than max lock time.
 
 Incremental lock time disabled
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -71,7 +71,7 @@ of allowed failed login attempts (3 by default) edit
    bruteForceProtectionMaxFailed = 3
 
 
-.. important:: 
+.. important::
 
     Number of failed login attempts stored in history MUST
     be higher than allowed failed logins for this plugin takes effect.
diff --git a/doc/sources/admin/captcha.rst b/doc/sources/admin/captcha.rst
index 908845fd1..7c6dd46af 100644
--- a/doc/sources/admin/captcha.rst
+++ b/doc/sources/admin/captcha.rst
@@ -14,7 +14,7 @@ Captchas are available on the following forms:
 -  Register form: where user enters information to create a new account
 
 
-.. important:: 
+.. important::
 
     We use the Perl module GD::SecurityImage to generate
     images, you need to install it if you enable Captcha feature.
diff --git a/doc/sources/admin/cda.rst b/doc/sources/admin/cda.rst
index 1bd62e19b..ff122bf99 100644
--- a/doc/sources/admin/cda.rst
+++ b/doc/sources/admin/cda.rst
@@ -4,7 +4,7 @@ Cross Domain Authentication
 Presentation
 ------------
 
-:ref:`cross_domain_authentication_cda`
+:ref:`cda`
 
 Configuration
 -------------
@@ -21,17 +21,17 @@ To use this feature only locally, edit ``lemonldap-ng.ini`` in section
    cda = 1
 
 
-.. important:: 
+.. important::
 
     If your handler is being served by Nginx, you have to
     uncomment the following lines in your nginx configuration file:
-    
+
     ::
-    
-       # If CDA is used, uncomment this 
-       auth_request_set $cookie_value $upstream_http_set_cookie; 
+
+       # If CDA is used, uncomment this
+       auth_request_set $cookie_value $upstream_http_set_cookie;
        add_header Set-Cookie $cookie_value;
-    
+
 
 
 Handlers
@@ -40,5 +40,3 @@ Handlers
 Choose "CDA" as type for each virtualHost concerned by CDA *(ie not in
 main domain)*.
 
-.. |section>..presentation#cross_domain_authentication_cda&noheader| image:: section>..presentation#cross_domain_authentication_cda&noheader
-
diff --git a/doc/sources/admin/changesessionbackend.rst b/doc/sources/admin/changesessionbackend.rst
index b5a92ba2c..8be1d7753 100644
--- a/doc/sources/admin/changesessionbackend.rst
+++ b/doc/sources/admin/changesessionbackend.rst
@@ -5,7 +5,7 @@ LemonLDAP::NG provides a script to change session backend. This script
 will help you transfer existing persistent sessions (or offline
 sessions) when migrating from one backend to another, or when adding
 indexes to a
-:doc:`browseable sessio backend</browseablesessionbackend>`. It is
+:doc:`browseable session backend</browseablesessionbackend>`. It is
 available in LemonLDAP::NG utilities directory (``convertSessions``).
 
 How it works
diff --git a/doc/sources/admin/checkstate.rst b/doc/sources/admin/checkstate.rst
index 26742d1e1..a88720007 100644
--- a/doc/sources/admin/checkstate.rst
+++ b/doc/sources/admin/checkstate.rst
@@ -22,7 +22,7 @@ GET Parameter Need     Value
 ============= ======== ============================================================
 ``secret``    required Same value as the shared secret given to the manager
 ``user``      optional If set (with password), a login/logout process will be tried
-``password``  optional 
+``password``  optional
 ============= ======== ============================================================
 
 Example
diff --git a/doc/sources/admin/checkuser.rst b/doc/sources/admin/checkuser.rst
index 5b35eb99e..004d9e4a2 100644
--- a/doc/sources/admin/checkuser.rst
+++ b/doc/sources/admin/checkuser.rst
@@ -29,47 +29,47 @@ Just enable it in the manager (section “plugins”).
       attributes
 
 
-.. note:: 
+.. note::
 
     By examples :
-    
+
     \* Search attributes => ``mail uid givenName``
-    
+
     If ``whatToTrace`` fails, sessions are searched by ``mail``, next
     ``uid`` if none session is found and so on...
-    
+
     \* Display empty headers rule => ``$uid eq "dwho"`` -> Only 'dwho' will
-    see empty headers 
+    see empty headers
 
 
-.. note:: 
+.. note::
 
     Keep in mind that Nginx HTTP proxy module gets rid of empty
     headers. If the value of a header field is an empty string then this
     field will not be passed to a proxied server. To avoid misunderstanding,
-    it might be useful to not display empty headers. 
+    it might be useful to not display empty headers.
 
 
-.. important:: 
+.. important::
 
     Be careful to not display secret attributes.
-    
+
     checkUser plugin hidden attributes are concatenation of
     ``checkUserHiddenAttributes`` and ``hiddenAttributes``. You just have to
-    append checkUser specific attributes. 
+    append checkUser specific attributes.
 
 
-.. warning:: 
+.. warning::
 
     This plugin displays ALL user session attributes except
     the hidden ones.
-    
+
     You have to restrict access to specific users (administrators, DevOps,
     power users and so on...) by setting an access rule like other
     VirtualHosts.
-    
+
     By example: ``$groups =~ /\bsu\b/``
-    
+
 
 
 To modify persistent sessions attributes ('_loginHistory \_2fDevices
@@ -87,7 +87,7 @@ Usage
 When enabled, ``/checkuser`` URL path is handled by this plugin.
 
 
-.. important:: 
+.. important::
 
     With federated authentication, checkUser plugin works
-    only if a session can be found in backend. 
+    only if a session can be found in backend.
diff --git a/doc/sources/admin/cli_examples.rst b/doc/sources/admin/cli_examples.rst
index c0f9129cd..8eeec1910 100644
--- a/doc/sources/admin/cli_examples.rst
+++ b/doc/sources/admin/cli_examples.rst
@@ -2,10 +2,10 @@ Command Line Interface (lemonldap-ng-cli) examples
 ==================================================
 
 This page shows some examples of LL::NG Command Line Interface. See
-:doc:`how to use the command<configlocation>`.
+:ref:`how to use the command<configlocation-command-line-interface-cli>`.
 
 
-.. important:: 
+.. important::
 
     On Debian, the command is located in
     ``/usr/share/lemonldap-ng/bin`` and on CentOS in
@@ -232,7 +232,7 @@ In this example we use:
            ldapExportedVars sn sn \
            ldapExportedVars mobile mobile \
            ldapExportedVars mail mail \
-           ldapExportedVars givenName givenName 
+           ldapExportedVars givenName givenName
 
    /usr/share/lemonldap-ng/bin/lemonldap-ng-cli -yes 1 \
        set \
@@ -248,7 +248,8 @@ Configure CAS Identity Provider
 -------------------------------
 
 You just have to enable the CAS server feature, and you can set the
-access control policy (see :doc:`CAS service options<idpcas>`):
+access control policy (see
+:ref:`CAS service options<idpcas-configuring-the-cas-service>`):
 
 ::
 
@@ -452,6 +453,9 @@ Create the application "sample" inside category "applications":
            applicationList/applications/sample/options name "Sample application" \
            applicationList/applications/sample/options uri "https://sample.example.com/"
 
+
+.. _cli-examples-encryption-key:
+
 Encryption key
 --------------
 
diff --git a/doc/sources/admin/configapache.rst b/doc/sources/admin/configapache.rst
index f4d4670df..5d0583d2c 100644
--- a/doc/sources/admin/configapache.rst
+++ b/doc/sources/admin/configapache.rst
@@ -2,7 +2,7 @@ Deploy Apache configuration
 ===========================
 
 
-.. important:: 
+.. note::
 
     This step should have been already done if you installed LL::NG
     with packages.
@@ -11,7 +11,7 @@ Files
 -----
 
 
-.. important:: 
+.. important::
 
     Apache Mod Perl has many issues since 2.4 version with
     MPM worker and MPM event. No problem for portal and manager since they
@@ -32,21 +32,21 @@ You have to include them in Apache main configuration, for example:
    include /usr/local/lemonldap-ng/etc/test-apache2.conf
 
 
-.. tip:: 
+.. tip::
+
+
 
-    
-    
     -  You can also use symbolic links in ``conf.d`` or ``sites-available``
        Apache directory.
     -  If you have run the Debian/Ubuntu install command, just use:
-    
+
     ::
-    
+
        a2ensite manager-apache2.conf
        a2ensite portal-apache2.conf
        a2ensite handler-apache2.conf
        a2ensite test-apache2.conf
-    
+
 
 
 Modules
@@ -61,12 +61,12 @@ You will also need to load some Apache modules:
 -  mod_headers
 
 
-.. tip:: 
+.. tip::
 
     With Debian/Ubuntu:
-    
+
     ::
-    
+
        a2enmod fcgid perl alias rewrite headers
-    
+
 
diff --git a/doc/sources/admin/configlocation.rst b/doc/sources/admin/configlocation.rst
index 31c490317..28928dc3b 100644
--- a/doc/sources/admin/configlocation.rst
+++ b/doc/sources/admin/configlocation.rst
@@ -8,15 +8,15 @@ LemonLDAP::NG configuration is stored in a backend that allows all
 modules to access it.
 
 
-.. important:: 
+.. important::
 
     Note that all LL::NG components must have access:
-    
+
     -  to the configuration backend
     -  to the sessions storage backend
-    
+
     Detailed configuration backends documentation is available
-    :doc:`here<start>`.
+    :ref:`here<start-configuration-database>`.
 
 By default, configuration is stored in :doc:`files<fileconfbackend>`, so
 access trough network is not possible. To allow this, use
@@ -25,7 +25,8 @@ service like :doc:`SQL database<sqlconfbackend>` or
 :doc:`LDAP directory<ldapconfbackend>`.
 
 Configuration backend can be set in the
-local configuration file, in ``configuration`` section.
+:ref:`local configuration file<configlocation-local-file>`, in ``configuration``
+section.
 
 For example, to configure the ``File`` configuration backend:
 
@@ -36,7 +37,7 @@ For example, to configure the ``File`` configuration backend:
    dirName = /usr/local/lemonldap-ng/data/conf
 
 
-.. tip:: 
+.. tip::
 
     See
     :doc:`How to change configuration backend<changeconfbackend>` to known
@@ -52,7 +53,7 @@ By default, Manager is protected to allow only the demonstration user
 "dwho".
 
 
-.. important:: 
+.. important::
 
     This user will not be available anymore if you configure
     a new authentication backend! Remember to change the access rule in
@@ -77,7 +78,7 @@ editing ``lemonldap-ng.ini`` and changing the ``protection`` parameter:
    #   * none         : no protection
 
 
-.. tip:: 
+.. tip::
 
     See :doc:`Manager protection documentation<managerprotection>`
     to know how to use Apache modules or LL::NG to manage access to
@@ -104,28 +105,28 @@ When all modifications are done, click on ``Save`` to store
 configuration.
 
 
-.. warning:: 
+.. warning::
 
     LemonLDAP::NG will do some checks on configuration and
     display errors and warnings if any. Configuration **is not saved** if
     errors occur.
 
 
-.. tip:: 
+.. tip::
+
+
 
-    
-    
     -  :doc:`Configuration viewer<viewer>` allow some users to edit WebSSO
        configuration in Read Only mode.
-    
+
     -  You can set and display instance name in Manager menu by editing
        ``lemonldap-ng.ini`` in [manager] section:
-    
+
     .. code:: ini
-    
+
        [manager]
        instanceName = LLNG_Demo
-    
+
 
 
 Manager API
@@ -141,7 +142,7 @@ See `Manager API
 documentation <https://lemonldap-ng.org/manager-api/2.0/>`__.
 
 
-.. important:: 
+.. important::
 
     To access Manager API, enable the ``manager-api``
     virtual host and change the access rule. You can protect the API through
@@ -168,7 +169,7 @@ and is stored in the LemonLDAP::NG bin/ directory, for example
    /usr/libexec/lemonldap-ng/bin/lmConfigEditor
 
 
-.. tip:: 
+.. tip::
 
     This script must be run as root, it will then use the Apache
     user and group to access configuration.
@@ -198,6 +199,8 @@ The configuration is displayed as a big Perl Hash, that you can edit:
 If a modification is done, the configuration is saved with a new
 configuration number. Else, current configuration is kept.
 
+.. _configlocation-command-line-interface-cli:
+
 Command Line Interface (CLI)
 ----------------------------
 
@@ -219,7 +222,7 @@ for example /usr/share/lemonldap-ng/bin:
    /usr/libexec/lemonldap-ng/bin/lemonldap-ng-cli
 
 
-.. tip:: 
+.. tip::
 
     This script must be run as root, it will then use the Apache
     user and group to access configuration.
@@ -272,15 +275,18 @@ Some examples:
    /usr/share/lemonldap-ng/bin/lemonldap-ng-cli -sep ',' get macros,_whatToTrace
 
 
-.. tip:: 
+.. tip::
 
     See :doc:`other examples<cli_examples>`.
 
+
+.. _configlocation-apache:
+
 Apache
 ------
 
 
-.. important:: 
+.. important::
 
     LemonLDAP::NG does not manage Apache
     configuration
@@ -295,6 +301,8 @@ LemonLDAP::NG ships 3 Apache configuration files:
 
 See :doc:`how to deploy them<configapache>`.
 
+.. _configlocation-portal:
+
 Portal
 ~~~~~~
 
@@ -323,7 +331,7 @@ you need to edit the access rule in **handler-apache2.conf**
 
        <Location /reload>
            #CHANGE THIS######
-           Require ip 127 ::1 
+           Require ip 127 ::1
            ###########^^^^^^^
            SetHandler perl-script
            PerlResponseHandler Lemonldap::NG::Handler::ApacheMP2->reload
@@ -368,7 +376,7 @@ Nginx
 -----
 
 
-.. important:: 
+.. important::
 
     LemonLDAP::NG does not manage Nginx configuration
 
@@ -382,7 +390,7 @@ LemonLDAP::NG ships 3 Nginx configuration files:
 See :doc:`how to deploy them<confignginx>`.
 
 
-.. warning:: 
+.. warning::
 
     \ :doc:`LL::NG FastCGI<fastcgiserver>` server must be
     enabled and started separately.
@@ -417,11 +425,11 @@ you need to edit the access rule in **handler-nginx.conf**
 .. code:: nginx
 
      location = /reload {
-      
+
        ## CHANGE THIS #
        allow 127.0.0.1;
        ######^^^^^^^^^#
-      
+
        deny all;
 
        # FastCGI configuration
@@ -492,27 +500,27 @@ included file):
        #proxy_set_header Auth-User $authuser;
        # OR
        #fastcgi_param HTTP_AUTH_USER $authuser;
-       
+
        # Then (if LUA not supported), change cookie header to hide LLNG cookie
        #auth_request_set $lmcookie $upstream_http_cookie;
        #proxy_set_header Cookie: $lmcookie;
        # OR
        #fastcgi_param HTTP_COOKIE $lmcookie;
-       
+
        # Insert then your configuration (fastcgi_* or proxy_*)
 
 Configuration reload
 --------------------
 
 
-.. important:: 
+.. note::
 
     As Handlers keep configuration in cache, when configuration
     change, it should be updated in Handlers. An Apache restart will work,
     but LemonLDAP::NG offers the mean to reload them through an HTTP
     request. Configuration reload will then be effective in less than 10
     minutes. If you want to change this timeout, set ``checkTime = 240`` in
-    your lemonldap-ng.ini file *(values in seconds)*\ 
+    your lemonldap-ng.ini file *(values in seconds)*\
 
 After configuration is saved by Manager, LemonLDAP::NG will try to
 reload configuration on distant Handlers by sending an HTTP request to
@@ -525,7 +533,7 @@ You also have a parameter to adjust the timeout used to request reload
 URLs, it is be default set to 5 seconds.
 
 
-.. important:: 
+.. important::
 
     If "Compact configuration file" option is enabled, all
     useless parameters are removed to limit file size. Typically, if SAMLv2
@@ -536,7 +544,7 @@ These parameters can be overwritten in LemonLDAP::NG ini file, in the
 section ``apply``.
 
 
-.. tip:: 
+.. tip::
 
     You only need a reload URL per physical servers, as Handlers
     share the same configuration cache on each physical server.
@@ -546,27 +554,27 @@ inside a virtual host protected by LemonLDAP::NG Handler (see below
 examples in Apache->handler or Nginx->Handler).
 
 
-.. important:: 
+.. important::
 
     You must allow access to declared URLs to your Manager
     IP.
 
 
-.. important:: 
+.. important::
 
     If reload URL is served in HTTPS, to avoid "Error 500
     (certificate verify failed)", Go to :
-    
+
     ``General Parameters > Advanced Parameters > Security > SSL options for server requests``
-    
+
     and set :
-    
+
     **verify_hostname => 0**
-    
-    **SSL_verify_mode => 0** 
+
+    **SSL_verify_mode => 0**
 
 
-.. important:: 
+.. important::
 
     If you want to use reload mechanism on a portal only
     host, you must install a handler in Portal host to be able to refresh
@@ -593,6 +601,9 @@ You also need to adjust the protection of the reload vhost, for example:
            PerlResponseHandler Lemonldap::NG::Handler::ApacheMP2->reload
        </Location>
 
+
+.. _configlocation-local-file:
+
 Local file
 ----------
 
@@ -618,7 +629,7 @@ For example, to override configured skin for portal:
    portalSkin = dark
 
 
-.. tip:: 
+.. tip::
 
     You need to know the technical name of configuration parameter
     to do this. You can refer to :doc:`parameter list<parameterlist>` to
diff --git a/doc/sources/admin/configvhost.rst b/doc/sources/admin/configvhost.rst
index 96262e96f..95a39d9d3 100644
--- a/doc/sources/admin/configvhost.rst
+++ b/doc/sources/admin/configvhost.rst
@@ -9,7 +9,8 @@ Apache configuration
 --------------------
 
 To protect a virtual host in Apache, the LemonLDAP::NG Handler must be
-activated (see :doc:`Apache global configuration<configlocation>`).
+activated (see
+:ref:`Apache global configuration<configlocation-apache>`).
 
 Then you can take any virtual host, and simply add this line to protect
 it:
@@ -79,7 +80,7 @@ Same with remote server configured with the same host name:
    </VirtualHost>
 
 
-.. important:: 
+.. note::
 
     The ``ProxyPreserveHost`` directive will forward the Host header
     to the protected application. To learn more about using Apache as
@@ -88,7 +89,7 @@ Same with remote server configured with the same host name:
 
 
 
-.. tip:: 
+.. tip::
 
     Some applications need the ``REMOTE_USER`` environment
     variable to get the connected user, which is not set in reverse-proxy
@@ -115,7 +116,7 @@ Pages where this menu is displayed can be restricted, for example:
    </Location>
 
 
-.. important:: 
+.. important::
 
     You need to disable mod_deflate to use the floating
     menu
@@ -137,14 +138,14 @@ Then you can take any virtual host and modify it:
        internal;
        include /etc/nginx/fastcgi_params;
        fastcgi_pass unix:/var/run/llng-fastcgi-server/llng-fastcgi.sock;
-       
+
        # Drop post datas
        fastcgi_pass_request_body  off;
        fastcgi_param CONTENT_LENGTH "";
-       
+
        # Keep original hostname
        fastcgi_param HOST $http_host;
-       
+
        # Keep original request (LLNG server will receive /lmauth)
        fastcgi_param X_ORIGINAL_URI  $request_uri;
      }
@@ -161,7 +162,7 @@ Then you can take any virtual host and modify it:
        add_header Set-Cookie $cookie_value;
        error_page 401 $lmlocation;
        try_files $uri $uri/ =404;
-       
+
        ...
      }
 
@@ -188,7 +189,7 @@ Then you can take any virtual host and modify it:
        #proxy_set_header Cookie: $lmcookie;
        # OR in the corresponding block
        #fastcgi_param HTTP_COOKIE $lmcookie;
-       
+
        # Set REMOTE_USER (for FastCGI apps only)
        #fastcgi_param REMOTE_USER $lmremote_user;
      }
@@ -220,7 +221,7 @@ Example of a protected virtual host for a local application:
        fastcgi_param HOST $http_host;
        # Keep original request (LLNG server will receive /lmauth)
        fastcgi_param X_ORIGINAL_URI  $request_uri;
-     } 
+     }
 
      # Client requests
      location ~ \.php$ {
@@ -280,7 +281,7 @@ Reverse proxy
        fastcgi_param HOST $http_host;
        # Keep original request (LLNG server will receive /lmauth)
        fastcgi_param X_ORIGINAL_URI  $request_uri;
-     } 
+     }
 
      # Client requests
      location / {
@@ -316,7 +317,7 @@ by different types of handler :
      listen 80;
      server_name myserver;
      root /var/www/html;
-     
+
     # Internal MAIN handler authentication request
      location = /lmauth {
        internal;
@@ -363,7 +364,7 @@ by different types of handler :
        uwsgi_buffer_size 32k;
        uwsgi_buffers 32 32k;
      }
-     
+
      # Client requests
      location / {
        ##################################
@@ -375,14 +376,14 @@ by different types of handler :
        auth_request_set $lmlocation $upstream_http_location;
        # Remove this for AuthBasic handler
        error_page 401 $lmlocation;
-     
+
        ##################################
        # PASSING HEADERS TO APPLICATION #
        ##################################
        # IF LUA IS SUPPORTED
        include /etc/nginx/nginx-lua-headers.conf;
      }
-     
+
      location /AuthBasic/ {
        ##################################
        # CALLING AUTHENTICATION         #
@@ -400,7 +401,7 @@ by different types of handler :
        # IF LUA IS SUPPORTED
        include /etc/nginx/nginx-lua-headers.conf;
      }
-     
+
      location /web-service/ {
        ##################################
        # CALLING AUTHENTICATION         #
@@ -419,6 +420,8 @@ by different types of handler :
      }
    }
 
+.. _configvhost-lemonldapng-configuration:
+
 LemonLDAP::NG configuration
 ---------------------------
 
@@ -445,29 +448,29 @@ learn how to configure access control and HTTP headers sent to
 application by LL::NG.
 
 
-.. important:: 
+.. important::
 
     With **Nginx**-based ReverseProxy, header directives can
     be appended by a LUA script.
-    
+
     To send more than **TEN** headers to protected applications, you have to
     edit and modify :
-    
-    ``/etc/nginx/nginx-lua-headers.conf`` 
+
+    ``/etc/nginx/nginx-lua-headers.conf``
 
 
-.. warning:: 
+.. warning::
 
     \* **Nginx** gets rid of any empty headers. There is no
     point of passing along empty values to another server; it would only
     serve to bloat the request. In other words, headers with **empty values
     are completely removed** from the passed request.
-    
+
     \* **Nginx**, by default, will consider any header that **contains
     underscores as invalid**. It will remove these from the proxied request.
     If you wish to have Nginx interpret these as valid, you can set the
     ``underscores_in_headers`` directive to “on”, otherwise your headers
-    will never make it to the backend server. 
+    will never make it to the backend server.
 
 POST data
 ~~~~~~~~~
@@ -486,9 +489,9 @@ Some options are available:
 -  Maintenance mode: reject all requests with a maintenance message
 -  Aliases: list of aliases for this virtual host *(avoid to rewrite
    rules,...)*
--  Type: handler type *(normal,
-   :doc:`ServiceToken Handler</documentation/2.0/servertoserver>`,
-   :doc:`DevOps Handler</documentation/2.0/devopshandler>`,...)*
+-  Type: handler type (normal,
+   :doc:`ServiceToken Handler<servertoserver>`,
+   :doc:`DevOps Handler<devopshandler>`,...)
 -  Authentication level required: this option avoids to reject user with
    a rule based on ``$_authenticationLevel``. When user hasn't got the
    required level, he is redirected to an upgrade page in the portal.
@@ -497,24 +500,24 @@ Some options are available:
    seconds by default. This TTL can be customized for each virtual host.
 
 
-.. warning:: 
+.. warning::
 
     A same virtual host can serve many locations. Each
     location can be protected by a different type of handler :
-    
+
     ::
-    
+
        server test1.example.com 80
          location ^/AuthBasic  => AuthBasic handler
          location ^/AuthCookie => Main handler
-    
+
     Keep in mind that AuthBasic handler use "Login/Password" to authenticate
     users. If you set "Authentication level required" option to "5" by
     example, AuthBasic requests will be ALWAYS rejected because AuthBasic
-    authentication level is lower than required level. 
+    authentication level is lower than required level.
 
 
-.. important:: 
+.. important::
 
     A negative or null ServiceToken timeout value will be
     overloaded by ``handlerServiceTokenTTL`` (30 seconds by default).
diff --git a/doc/sources/admin/contextswitching.rst b/doc/sources/admin/contextswitching.rst
index 5988abd30..1f74f4bad 100644
--- a/doc/sources/admin/contextswitching.rst
+++ b/doc/sources/admin/contextswitching.rst
@@ -23,15 +23,15 @@ can be forbidden to assume.
       request.
 
 
-.. warning:: 
+.. warning::
 
     During context switching authentication process, all
     plugins are disabled. In other words, all entry points like afterData,
     endAuth and so on are skipped. Therefore, second factors or
-    notifications by example will not be prompted! 
+    notifications by example will not be prompted!
 
 
-.. important:: 
+.. important::
 
     ContextSwitching plugin works only with a userDB
     backend. You can not switch context with federated authentication.
diff --git a/doc/sources/admin/contribute.rst b/doc/sources/admin/contribute.rst
index 2e124af60..5463aa8ec 100644
--- a/doc/sources/admin/contribute.rst
+++ b/doc/sources/admin/contribute.rst
@@ -18,8 +18,8 @@ applies the following rules:
 -  Javascript:
 
    -  code must be written in
-      `CoffeeScript <http://coffeescript.org/>`__ *(in
-      ``<component>/site/coffee``)*: ``make minify`` will generate JS
+      `CoffeeScript <http://coffeescript.org/>`__ (in
+      ``<component>/site/coffee``): ``make minify`` will generate JS
       files
 
 Configure SSH
@@ -60,7 +60,7 @@ Debian
    aptitude install vim make devscripts yui-compressor git git-gui libjs-uglify coffeescript cpanminus autopkgtest pkg-perl-autopkgtest
    aptitude install libauth-yubikey-webclient-perl libnet-smtp-server-perl
 
-   cpanm Authen::U2F Authen::U2F::Tester Crypt::U2F::Server::Simple 
+   cpanm Authen::U2F Authen::U2F::Tester Crypt::U2F::Server::Simple
 
    curl -sL https://deb.nodesource.com/setup_9.x | bash -
    apt-get install -y nodejs
@@ -127,7 +127,7 @@ Install dependencies
 
 ::
 
-   aptitude install libapache-session-perl libcache-cache-perl libclone-perl libconfig-inifiles-perl libconvert-pem-perl libcrypt-openssl-bignum-perl libcrypt-openssl-rsa-perl libcrypt-openssl-x509-perl libcrypt-rijndael-perl libdbi-perl libdigest-hmac-perl libemail-sender-perl libgd-securityimage-perl libhtml-template-perl libio-string-perl libjson-perl libmime-tools-perl libmouse-perl libnet-ldap-perl libplack-perl libregexp-assemble-perl libregexp-common-perl libsoap-lite-perl libstring-random-perl libtext-unidecode-perl libunicode-string-perl liburi-perl libwww-perl libxml-simple-perl libxml-libxslt-perl libcrypt-urandom-perl libconvert-base32-perl cpanminus 
+   aptitude install libapache-session-perl libcache-cache-perl libclone-perl libconfig-inifiles-perl libconvert-pem-perl libcrypt-openssl-bignum-perl libcrypt-openssl-rsa-perl libcrypt-openssl-x509-perl libcrypt-rijndael-perl libdbi-perl libdigest-hmac-perl libemail-sender-perl libgd-securityimage-perl libhtml-template-perl libio-string-perl libjson-perl libmime-tools-perl libmouse-perl libnet-ldap-perl libplack-perl libregexp-assemble-perl libregexp-common-perl libsoap-lite-perl libstring-random-perl libtext-unidecode-perl libunicode-string-perl liburi-perl libwww-perl libxml-simple-perl libxml-libxslt-perl libcrypt-urandom-perl libconvert-base32-perl cpanminus
    aptitude install apache2 libapache2-mod-fcgid libapache2-mod-perl2  # install Apache
    aptitude install nginx nginx-extras  # install Nginx
    cpanm perltidy@20181120
@@ -135,7 +135,7 @@ Install dependencies
 ::
 
     SAML :
-   aptitude install liblasso-perl libglib-perl 
+   aptitude install liblasso-perl libglib-perl
 
 Working Project
 ---------------
diff --git a/doc/sources/admin/customfunctions.rst b/doc/sources/admin/customfunctions.rst
index 18cf367f4..e1ad08c73 100644
--- a/doc/sources/admin/customfunctions.rst
+++ b/doc/sources/admin/customfunctions.rst
@@ -2,8 +2,8 @@ Custom functions
 ================
 
 Custom functions allow one to extend LL::NG, they can be used in
-:doc:`headers<writingrulesand_headers>`,
-:doc:`rules<writingrulesand_headers>` or
+:ref:`headers`,
+:ref:`rules` or
 :doc:`form replay data<formreplay>`. Two actions are needed:
 
 -  declare them in LLNG configuration
@@ -72,7 +72,7 @@ Old method
 ^^^^^^^^^^
 
 
-.. warning:: 
+.. warning::
 
     This method is available but unusable by Portal under
     Apache. So if your rule may be used by the menu, use the new
@@ -128,7 +128,7 @@ Go in Manager, ``General Parameters`` » ``Advanced Parameters`` »
    SSOExtensions::function1 SSOExtensions::function2
 
 
-.. important:: 
+.. important::
 
     If your function is not compliant with
     :doc:`Safe jail<safejail>`, you will need to disable the jail.
diff --git a/doc/sources/admin/customhandlers.rst b/doc/sources/admin/customhandlers.rst
index 13fd78a17..f4385a5bf 100644
--- a/doc/sources/admin/customhandlers.rst
+++ b/doc/sources/admin/customhandlers.rst
@@ -56,13 +56,13 @@ LLNG provides 3 platforms:
 
 If you want to add another, you must write:
 
--  the platform launcher file that launch the required type *(see
+-  the platform launcher file that launch the required type (see
    ``lemonldap-ng-handler/lib/Lemonldap/NG/Handler/ApacheMP2`` file for
-   example)*
+   example)
 -  write the main platform file
    (``Lemonldap::NG::Handler::MyPlatform::Main``) that provides required
-   method *(see ``lemonldap-ng-handler/lib/Lemonldap/NG/Handler/*/Main``
-   for examples)* and inherits from ``Lemonldap::NG::Handler::Main``
+   method (see ``lemonldap-ng-handler/lib/Lemonldap/NG/Handler/*/Main``
+   for examples) and inherits from ``Lemonldap::NG::Handler::Main``
 -  write the "type" wrapper files (AuthBasic,...).
 
 Wrapper usually look at this:
@@ -79,7 +79,7 @@ Old fashion Nginx handlers
 --------------------------
 
 
-.. important:: 
+.. important::
 
     There is no need to use this feature now. It is kept for
     compatibility.
diff --git a/doc/sources/admin/decryptvalue.rst b/doc/sources/admin/decryptvalue.rst
index 86b378e8b..3d3e2100a 100644
--- a/doc/sources/admin/decryptvalue.rst
+++ b/doc/sources/admin/decryptvalue.rst
@@ -18,15 +18,15 @@ DecryptValue plugin can be allowed or denied for specific users.
       to use internal decrypt function.
 
 
-.. warning:: 
+.. warning::
 
     Custom functions must be defined into
     ``Lemonldap::NG::Portal::My::Plugin`` and set:
-    
+
     ::
-    
+
        My::Plugin::function1 My::Plugin::function2
-    
+
 
 
 .. |image0| image:: /documentation/beta.png
diff --git a/doc/sources/admin/devopshandler.rst b/doc/sources/admin/devopshandler.rst
index 6e3de4c1c..3c7d083d3 100644
--- a/doc/sources/admin/devopshandler.rst
+++ b/doc/sources/admin/devopshandler.rst
@@ -4,7 +4,7 @@ DevOps Handler
 This handler is designed to read vhost configuration from the website
 itself not from LL:NG configuration. Rules and headers are set in a
 **rules.json** file stored at the website root directory (ie
-``<nowiki>http://website/rules.json</nowiki>``). This file looks like:
+``http://website/rules.json``). This file looks like:
 
 .. code:: json
 
@@ -23,15 +23,15 @@ If this file is not found, the default rule "accept" is applied and just
 
 No specific configuration is required except that:
 
--  you have to choose this specific handler *(directly by using
-   ``VHOSTTYPE`` environment variable)*
+-  you have to choose this specific handler (directly by using
+   ``VHOSTTYPE`` environment variable)
 -  you can set the loopback URL needed by the DevOps handler to get
    ``/rules.json`` or use ``RULES_URL`` parameter to set JSON file path
-   *(see :doc:`SSO as a Service<ssoaas>`)*. Default to
-   ``<nowiki>http://127.0.0.1:<server-port></nowiki>``
+   (see :doc:`SSO as a Service<ssoaas>`). Default to
+   ``http://127.0.0.1:<server-port>``
 
 
-.. important:: 
+.. important::
 
     Note that DevOps handler will refuse to compile
     rules.json if :doc:`Safe Jail<safejail>` isn't enabled.
diff --git a/doc/sources/admin/download.rst b/doc/sources/admin/download.rst
index 5ae456db3..99e2fcac2 100644
--- a/doc/sources/admin/download.rst
+++ b/doc/sources/admin/download.rst
@@ -27,14 +27,11 @@ RPM
 ^^^
 
 
-.. tip:: 
+.. tip::
 
     You can:
-    
-    -  Use :doc:`our own YUM repository<installrpm>`.
-    -  Download them here and
-       :doc:`install pre-required packages<prereq>`.
-    
+    -  Use :ref:`our own YUM repository<installrpm-yum-repository>`.
+    -  Download them here and :ref:`install pre-required packages<prereq-yum>`.
 
 
 RHEL/CentOS 7
@@ -57,17 +54,16 @@ Debian
 ^^^^^^
 
 
-.. tip:: 
+.. tip::
 
     You can:
-    
+
     -  Use
-       :doc:`packages provided by Debian<installdeb>`.
+       :ref:`packages provided by Debian<installdeb-official-repository>`.
     -  Use
-       :doc:`our own Debian repository<installdeb>`.
+       :ref:`our own Debian repository<installdeb-llng-repository>`.
     -  Download them here and
-       :doc:`install pre-required packages<prereq>`.
-    
+       :ref:`install pre-required packages<prereq-apt-get>`.
 
 
 -  `DEB
@@ -99,6 +95,8 @@ Contributions
 
 See https://github.com/LemonLDAPNG
 
+.. _download-getting-sources-from-svn-repository:
+
 Git repository
 --------------
 
diff --git a/doc/sources/admin/error.rst b/doc/sources/admin/error.rst
index 73991e4cf..ba11d7907 100644
--- a/doc/sources/admin/error.rst
+++ b/doc/sources/admin/error.rst
@@ -2,7 +2,7 @@ Error messages
 ==============
 
 
-.. important:: 
+.. note::
 
     This page do not reference all error messages, but only the
     frequentest
@@ -23,7 +23,7 @@ from a version older than 1.0
    Can't locate /usr/share/lemonldap-ng/configStorage.pl
 
 → When you upgrade from Debian Lenny with customized index.pl files, you
-must upgrade them. See :doc:`Debian Lenny upgrade<upgrade>`.
+must upgrade them. 
 
 Lemonldap::NG::Handler
 ----------------------
@@ -60,13 +60,13 @@ configStorageOptionsor file permissions.
    mkdir /tmp/MyNamespace/2: Permission denied ...
 
 → The cache has been created by another user than Apache's user. Restart
-Apache to purge it. 
-.. important:: 
+Apache to purge it.
+.. important::
 
     This can append when you use
     lmConfigEditor or launch **cron files** with a different user than
     Apache process. That is why it is important to set APACHEUSER variable
-    when you launch "make install" 
+    when you launch "make install"
 
 ::
 
diff --git a/doc/sources/admin/exportedvars.rst b/doc/sources/admin/exportedvars.rst
index 5311fb261..bbb7b6f08 100644
--- a/doc/sources/admin/exportedvars.rst
+++ b/doc/sources/admin/exportedvars.rst
@@ -6,7 +6,8 @@ Presentation
 
 Exported variables are the variables available to
 :doc:`write rules and headers<writingrulesand_headers>`. They are
-extracted from the users database by the :doc:`users module<start>`.
+extracted from the users database by the
+:ref:`users module<start-authentication-users-and-password-databases>`.
 
 To create a variable, you've just to map a user attributes in LL::NG
 using ``Variables`` » ``Exported variables``. For each variable, The
@@ -32,7 +33,7 @@ module.
 |Exported variables in the Manager|
 
 
-.. tip:: 
+.. tip::
 
     You can define environment variables in
     ``Exported variables``, this allows one to populate user session with
diff --git a/doc/sources/admin/extendedfunctions.rst b/doc/sources/admin/extendedfunctions.rst
index f1ddb428a..3e27218cf 100644
--- a/doc/sources/admin/extendedfunctions.rst
+++ b/doc/sources/admin/extendedfunctions.rst
@@ -10,7 +10,7 @@ code execution.
 
 This is also true for:
 
--  :doc:`Menu modules activation rules<portalmenu>`
+-  :ref:`Menu modules activation rules<portalmenu-menu-modules>`
 -  :doc:`Form replay data<formreplay>`
 -  Macros
 -  Issuer databases use rules
@@ -18,30 +18,32 @@ This is also true for:
 
 Inside this jail, you can access to:
 
-::
+* all session values and CGI environment variables (through `$ENV{<HTTP_NAME>}`)
+* Core Perl subroutines (split, pop, map, etc.)
+* :doc:`Custom functions<customfunctions>`
+* The `encode_base64 <http://perldoc.perl.org/MIME/Base64.html>`__ subroutine
+* Information about current request
+* Extended functions:
+
+  * date_
+  * checkLogonHours_
+  * checkDate_
+  * basic_
+  * unicode2iso_
+  * iso2unicode_
+  * groupMatch_
+  * listMatch_ (|new| *since 2.0.7*)
+  * inGroup_ (|new| *since 2.0.8*)
+  * encrypt_
+  * token_
+  * isInNet6_
+  * varIsInUri_
+
+
+.. |new| image:: /documentation/new.png
+   :width: 35px
 
-   * all session values and CGI environment variables //(through $ENV{<HTTP_NAME>})//
-   * Core Perl subroutines (split, pop, map, etc.)
-   * [[customfunctions|Custom functions]]
-   * The [[http://perldoc.perl.org/MIME/Base64.html|encode_base64]] subroutine
-   * [[#Request information|Information about current request]]
-   * [[#Extended functions list|Extended functions]]:
-     * [[#date|date]]
-     * [[#checkLogonHours|checkLogonHours]]
-     * [[#checkDate|checkDate]]
-     * [[#basic|basic]]
-     * [[#unicode2iso|unicode2iso]]
-     * [[#iso2unicode|iso2unicode]]
-     * [[#groupMatch|groupMatch]]
-     * [[#listMatch|listMatch]] ({{..:new.png?direct&35|}} // since 2.0.7)//
-     * [[#inGroup|inGroup]] ({{..:new.png?direct&35|}} // since 2.0.8)//
-     * [[#encrypt|encrypt]]
-     * [[#token|token]]
-     * [[#isInNet6|isInNet6]]
-     * [[#varIsInUri|varIsInUri]]
-
-
-.. tip:: 
+.. tip::
 
     To know more about the jail, check `Safe module
     documentation <http://perldoc.perl.org/Safe.html>`__.
@@ -72,11 +74,10 @@ For example, for a full access, excepted week-end:
    000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFF000000
 
 
-.. tip:: 
+.. tip::
 
-    The :doc:`LDAP schema extension<authldap>` can be used to
-    store this value. You can also use the binary value from the logonHours
-    attribute of Active Directory
+    You can use the binary value from the logonHours attribute of Active
+    Directory, or create a custom attribute in your LDAP schema.
 
 Functions parameters:
 
@@ -130,11 +131,6 @@ This function will check the date of current request, and compare it to
 a start date and an end date. It returns 1 if this match, 0 else.
 
 
-.. tip:: 
-
-    The :doc:`LDAP schema extension<authldap>` can be used to
-    store these values
-
 The date format is the LDAP date syntax, for example for the 1st March
 2009:
 
@@ -159,7 +155,7 @@ basic
 ~~~~~
 
 
-.. important:: 
+.. important::
 
     This function is not compliant with
     :doc:`Safe jail<safejail>`, you will need to disable the jail to use
@@ -184,7 +180,7 @@ unicode2iso
 ~~~~~~~~~~~
 
 
-.. important:: 
+.. important::
 
     This function is not compliant with
     :doc:`Safe jail<safejail>`, you will need to disable the jail to use
@@ -206,7 +202,7 @@ iso2unicode
 ~~~~~~~~~~~
 
 
-.. important:: 
+.. important::
 
     This function is not compliant with
     :doc:`Safe jail<safejail>`, you will need to disable the jail to use
@@ -242,6 +238,8 @@ Simple usage example:
 
    groupMatch($hGroups, 'description', 'Service 1')
 
+.. _listMatch:
+
 listMatch
 ~~~~~~~~~
 
@@ -293,7 +291,7 @@ encrypt
 ~~~~~~~
 
 
-.. tip:: 
+.. tip::
 
     Since version 2.0, this function is now compliant with
     :doc:`Safe jail<safejail>`.
diff --git a/doc/sources/admin/external2f.rst b/doc/sources/admin/external2f.rst
index 842ebf710..ce94e1cc2 100644
--- a/doc/sources/admin/external2f.rst
+++ b/doc/sources/admin/external2f.rst
@@ -10,7 +10,7 @@ Commands
 
 Commands receive arguments on command line and must return a 0 code if
 succeed, another else. **Nothing must be written to STDOUT**, STDERR is
-reported in logs *(but may be lost with FastCGI server)*.
+reported in logs (but may be lost with FastCGI server).
 
 Configuration
 ~~~~~~~~~~~~~
@@ -33,17 +33,17 @@ All parameters are configured in "General Parameters » Portal Parameters
 -  **Authentication level** (Optional): if you want to overwrite the
    value sent by your authentication module, you can define here the new
    authentication level. Example: 5
--  **Logo** (Optional): logo file *(in static/<skin> directory)*
+-  **Logo** (Optional): logo file (in static/<skin> directory)
 -  **Label** (Optional): label that should be displayed to the user on
    the choice screen
 
 
-.. important:: 
+.. important::
 
     The command line is split in an array and launched with
-    exec(). So you don't need to enclose arguments in "" and this feature
-    protects your system against shell injection. However, you can not use
-    any space except to separate arguments.
+    exec(). So you don't need to enclose arguments in quotes to  protect your
+    system against shell injection. However, you can not use any space except
+    to separate arguments.
 
 SELinux note
 ^^^^^^^^^^^^
diff --git a/doc/sources/admin/fastcgi.rst b/doc/sources/admin/fastcgi.rst
index 7c4968c94..47d64dc8c 100644
--- a/doc/sources/admin/fastcgi.rst
+++ b/doc/sources/admin/fastcgi.rst
@@ -2,6 +2,6 @@ FastCGI support
 ===============
 
 
-.. important:: 
+.. important::
 
     Since 2.0, all LLNG components run under FastCGI
diff --git a/doc/sources/admin/fastcgiserver.rst b/doc/sources/admin/fastcgiserver.rst
index cfaa09d35..5d7c16cfe 100644
--- a/doc/sources/admin/fastcgiserver.rst
+++ b/doc/sources/admin/fastcgiserver.rst
@@ -2,9 +2,9 @@ LemonLDAP::NG FastCGI server
 ============================
 
 Since 1.9, Lemonldap::NG provides a FastCGI server usable to protect
-applications with Nginx *(See
-:doc:`Manage virtual hosts</documentation/1.9/configvhost>` page to
-configure virtual hosts)*.
+applications with Nginx (See
+:doc:`Manage virtual hosts<configvhost>` page to
+configure virtual hosts).
 
 This FastCGI server can be used for all LLNG components. It compiles
 enabled components on-the-fly.
diff --git a/doc/sources/admin/features.rst b/doc/sources/admin/features.rst
index f5813d416..e17706d99 100644
--- a/doc/sources/admin/features.rst
+++ b/doc/sources/admin/features.rst
@@ -21,7 +21,7 @@ Easy to integrate
 
 :doc:`Integrating applications<applications>` in
 LL::NG is easy since its dialog with applications is based on
-:doc:`customizable HTTP headers<writingrulesand_headers>`.
+:ref:`customizable HTTP headers<headers>`.
 
 Unifying authentications (Identity Federation)
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -38,6 +38,8 @@ applications.
 Sessions
 --------
 
+.. _session-explorer:
+
 Session explorer
 ~~~~~~~~~~~~~~~~
 
@@ -52,6 +54,8 @@ opened sessions:
 
 It can be used to delete a session
 
+.. _session-restrictions:
+
 Session restrictions
 ~~~~~~~~~~~~~~~~~~~~
 
diff --git a/doc/sources/admin/federationproxy.rst b/doc/sources/admin/federationproxy.rst
index c4b2bb247..82ee7d539 100644
--- a/doc/sources/admin/federationproxy.rst
+++ b/doc/sources/admin/federationproxy.rst
@@ -35,12 +35,12 @@ initiated by OpenID-Connect Provider. LLNG will implement it when this
 standard will be published.
 
 
-.. important:: 
+.. important::
 
     Federation proxy installation can be complex. Don't
     hesitate to contact us on lemonldap-ng-users@ow2.org
 
 See the following chapters:
 
--  :doc:`Authentication protocols<start>`
--  :doc:`Identity provider<start>`
+-  :ref:`Authentication protocols<start-authentication-users-and-password-databases>`
+-  :ref:`Identity provider<start-identity-provider>`
diff --git a/doc/sources/admin/fileconfbackend.rst b/doc/sources/admin/fileconfbackend.rst
index 95ca51b49..e683f5f4f 100644
--- a/doc/sources/admin/fileconfbackend.rst
+++ b/doc/sources/admin/fileconfbackend.rst
@@ -5,14 +5,14 @@ This is the default configuration backend. Configuration is stored as
 JSON.
 
 
-.. tip:: 
+.. tip::
 
     This configuration storage can be shared between different
     hosts using:
-    
+
     -  :doc:`SOAP configuration backend proxy<soapconfbackend>`
     -  any files sharing system (NFS, NAS, SAN,...)
-    
+
 
 
 Configuration
diff --git a/doc/sources/admin/filesessionbackend.rst b/doc/sources/admin/filesessionbackend.rst
index a51c30a9e..e87e66834 100644
--- a/doc/sources/admin/filesessionbackend.rst
+++ b/doc/sources/admin/filesessionbackend.rst
@@ -16,7 +16,7 @@ in "General parameters » Sessions » Session storage » Apache::Session
 module" and add the following parameters (case sensitive):
 
 =================== ============================== ===================================
-Required parameters                               
+Required parameters
 =================== ============================== ===================================
 Name                Comment                        Example
 **Directory**       The path to the main directory /var/lib/lemonldap-ng/sessions
diff --git a/doc/sources/admin/formreplay.rst b/doc/sources/admin/formreplay.rst
index 93e92813f..89bcf1905 100644
--- a/doc/sources/admin/formreplay.rst
+++ b/doc/sources/admin/formreplay.rst
@@ -9,16 +9,16 @@ filling a HTML POST login form and autosubmitting it, without asking
 anything to the user.
 
 
-.. warning:: 
+.. warning::
 
     This kind of SSO mechanism is not clean, and can lead to
     problems, like local password blocking, local session not well closed,
     etc.
-    
+
     Please always try to find another solution to protect your application
     with LL::NG. At least, check if it is not a
     :doc:`known application<applications>`, or
-    :doc:`try to adapt its source code<selfmadeapplication>`. 
+    :doc:`try to adapt its source code<selfmadeapplication>`.
 
 If you configure form replay with LL::NG, the Handler will detect forms
 to fill, add a javascript in the html page to fill form fields with
@@ -28,7 +28,7 @@ data in the request body.
 POST data can be static values or computed from user's session.
 
 
-.. tip:: 
+.. tip::
 
     To post user's password, you must enable
     :doc:`password storing<passwordstore>`. In this case you will be able to
@@ -96,7 +96,7 @@ example:
 |image1|
 
 
-.. tip:: 
+.. tip::
 
     You can define more than one form replay URL per virtual
     host.
diff --git a/doc/sources/admin/globallogout.rst b/doc/sources/admin/globallogout.rst
index 812ac3852..1e875a59e 100644
--- a/doc/sources/admin/globallogout.rst
+++ b/doc/sources/admin/globallogout.rst
@@ -17,9 +17,9 @@ Just enable it in the Manager (section “plugins”).
    -  **Custom parameter**: Session attribut to display at global logout
 
 
-.. important:: 
+.. note::
 
     To display more than one session attribute, you can create a
     macro like this :
-    
-    ``user_USER => "$uid_" . uc $uid`` 
+
+    ``user_USER => "$uid_" . uc $uid``
diff --git a/doc/sources/admin/handlerarch.rst b/doc/sources/admin/handlerarch.rst
index 501add033..20411ce45 100644
--- a/doc/sources/admin/handlerarch.rst
+++ b/doc/sources/admin/handlerarch.rst
@@ -18,8 +18,8 @@ Overview of Handler packages
 Usage                                                                          Platform      Wrapper           Types       Main
 ============================================================================== ============  ================= =========== ====
 Apache2 protection                                                             ApacheMP2     ApacheMP2::<type> Lib::<type> Main
-Plack servers protection or Nginx/\ :doc:`SSOaaS<ssoaas>` FastCGI/uWSGI server Server        Server::<type>             
-:doc:`Self protected applications<selfmadeapplication>`                        PSGI          PSGI::<type>               
+Plack servers protection or Nginx/\ :doc:`SSOaaS<ssoaas>` FastCGI/uWSGI server Server        Server::<type>
+:doc:`Self protected applications<selfmadeapplication>`                        PSGI          PSGI::<type>
 ============================================================================== ============  ================= =========== ====
 
 Types are:
diff --git a/doc/sources/admin/handlerauthbasic.rst b/doc/sources/admin/handlerauthbasic.rst
index d6b43af53..794ac0df7 100644
--- a/doc/sources/admin/handlerauthbasic.rst
+++ b/doc/sources/admin/handlerauthbasic.rst
@@ -46,32 +46,32 @@ see :doc:`REST sessions backend<restsessionbackend>`, enable local cache
 to access required locations in Portal Virtual Host.
 
 
-.. warning:: 
+.. warning::
 
     With AuthBasic handler, you have to disable CSRF token by
     setting a special rule based on source IP addresses like this :
-    
+
     requireToken => $env->{REMOTE_ADDR} !~ /^127\.0\.[1-3]\.1$/
-    
+
     With AutChoice, you have to declare which authentication module is
     requested by handler to create global session.
-    
+
     Go to:
     ``General Parameters > Authentication parameters > Choice parameters``
-    
+
     and set authentication module's name :
-    
+
     **AuthBasic handler parameter** => 2_LDAP (by example)
-    
 
 
 
-.. important:: 
+
+.. important::
 
     With HTTPS, you may have to set **LWP::UserAgent
     object** with ``verify_hostname => 0`` and ``SSL_verify_mode => 0``.
-    
+
     Go to:
-    
+
     ``General Parameters > Advanced Parameters > Security > SSL options for server requests``
 
diff --git a/doc/sources/admin/header_remote_user_conversion.rst b/doc/sources/admin/header_remote_user_conversion.rst
index 0f2cbd858..035a7417a 100644
--- a/doc/sources/admin/header_remote_user_conversion.rst
+++ b/doc/sources/admin/header_remote_user_conversion.rst
@@ -45,7 +45,7 @@ two Apache configuration files:
 
    <VirtualHost *:80>
            ServerName application.example.com
-           
+
            SetEnvIfNoCase Auth-User "(.*)" REMOTE_USER=$1
 
            DocumentRoot /var/www/application
@@ -53,18 +53,18 @@ two Apache configuration files:
    </VirtualHost>
 
 
-.. tip:: 
+.. tip::
 
     Sometimes, PHP applications also check the PHP_AUTH_USER and
     PHP_AUHT_PW environment variables. You can set them the same way:
-    
+
     .. code:: apache
-    
+
        SetEnvIfNoCase Auth-User "(.*)" PHP_AUTH_USER=$1
        SetEnvIfNoCase Auth-Password "(.*)" PHP_AUTH_PW=$1
-    
+
     Of course, you need to :doc:`store password in session<passwordstore>`
-    to fill PHP_AUTH_PW. 
+    to fill PHP_AUTH_PW.
 
 Nginx
 -----
diff --git a/doc/sources/admin/idpcas.rst b/doc/sources/admin/idpcas.rst
index b3b1bb9b5..f2757fdb8 100644
--- a/doc/sources/admin/idpcas.rst
+++ b/doc/sources/admin/idpcas.rst
@@ -29,17 +29,18 @@ In the Manager, go in ``General Parameters`` » ``Issuer modules`` »
    to always allow.
 
 
-.. tip:: 
+.. tip::
 
     For example, to allow only users with a strong authentication
     level:
-    
+
     ::
-    
+
        $authenticationLevel > 2
-    
 
 
+.. _idpcas-configuring-cas-applications:
+
 Configuring the CAS Service
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
@@ -65,15 +66,17 @@ Then go in ``CAS Service`` to define:
 
 -  **CAS session module name and options**: choose a specific module if
    you do not want to mix CAS sessions and normal sessions (see
-   :doc:`why<samlservice>`).
+   :ref:`why<samlservice-saml-sessions-module-name-and-options>`).
 
 
-.. tip:: 
+.. tip::
 
     If ``CAS login`` is not set, it uses ``General Parameters`` »
     ``Logs`` » ``REMOTE_USER`` data, which is set to ``uid`` by
     default
 
+.. _idpcas-configuring-the-cas-service:
+
 Configuring CAS Applications
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
@@ -110,7 +113,7 @@ Options
    left blank, access will be allowed for everyone.
 
 
-.. important:: 
+.. important::
 
     If the access control policy is set to ``none``, this
     rule will be ignored
diff --git a/doc/sources/admin/idpopenid.rst b/doc/sources/admin/idpopenid.rst
index 3ae923740..f96fcff41 100644
--- a/doc/sources/admin/idpopenid.rst
+++ b/doc/sources/admin/idpopenid.rst
@@ -2,10 +2,10 @@ OpenID server
 =============
 
 
-.. warning:: 
+.. warning::
 
     OpenID protocol is deprecated, you should now use
-    :doc:`OpenID Connect<idpopenidconnect>`\ 
+    :doc:`OpenID Connect<idpopenidconnect>`\
 
 Presentation
 ------------
@@ -31,7 +31,7 @@ their authentication using [PORTAL]/openidserver/[login] where:
 
 -  [PORTAL] is the portal URL
 -  [login] is the user login (or any other session information,
-   :doc:`see below<idpopenid>`)
+   :ref:`see below<idpopenid-configuration>`)
 
 Example:
 
@@ -39,6 +39,8 @@ Example:
 
    http://auth.example.com/openidserver/foo.bar
 
+.. _idpopenid-configuration:
+
 Configuration
 -------------
 
@@ -47,39 +49,41 @@ In the Manager, go in ``General Parameters`` » ``Issuer modules`` »
 
 -  **Activation**: set to ``On``
 -  **Path**: keep ``^/openidserver/`` unless you have change
-   :doc:`Apache portal configuration<configlocation>` file.
+   :ref:`Apache portal configuration<configlocation-portal>` file.
 -  **Use rule**: a rule to allow user to use this module, set to 1 to
    always allow.
 
 
-.. tip:: 
+.. tip::
 
     For example, to allow only users with a strong authentication
     level:
-    
+
     ::
-    
+
        $authenticationLevel > 2
-    
+
 
 
 Then go in ``Options`` to define:
 
 -  **Secret token**: a secret token used to secure transmissions between
-   OpenID client and server (:doc:`see below<idpopenid>`).
+   OpenID client and server (:ref:`see below<idpopenid-security>`).
 -  **OpenID login**: the session key used to match OpenID login.
 -  **Authorized domains**: white list or black list of OpenID client
-   domains (:doc:`see below<idpopenid>`).
+   domains (:ref:`see below<idpopenid-security>`).
 -  **SREG mapping**: link between SREG attributes and session keys
-   (:doc:`see below<idpopenid>`).
+   (:ref:`see below<idpopenid-shared-attributes-sreg>`).
 
 
-.. tip:: 
+.. tip::
 
     If ``OpenID login`` is not set, it uses ``General Parameters``
     » ``Logs`` » ``REMOTE_USER`` data, which is set to ``uid`` by
     default
 
+.. _idpopenid-shared-attributes-sreg:
+
 Shared attributes (SREG)
 ~~~~~~~~~~~~~~~~~~~~~~~~
 
@@ -100,11 +104,13 @@ Each SREG attribute will be associated to a user session key. A session
 key can be associated to more than one SREG attribute.
 
 
-.. important:: 
+.. note::
 
     If the OpenID consumer ask for data, users will be prompted to
     accept or not the data sharing.
 
+.. _idpopenid-security:
+
 Security
 ~~~~~~~~
 
@@ -114,7 +120,7 @@ Security
    encryption key.
 
 
-.. important:: 
+.. important::
 
     Note that :doc:`SAML<idpsaml>` protocol is more secured
     than OpenID, so when your partners are known, prefer
diff --git a/doc/sources/admin/idpopenidconnect.rst b/doc/sources/admin/idpopenidconnect.rst
index b782133ae..8914eb1df 100644
--- a/doc/sources/admin/idpopenidconnect.rst
+++ b/doc/sources/admin/idpopenidconnect.rst
@@ -5,7 +5,7 @@ Presentation
 ------------
 
 
-.. important:: 
+.. note::
 
     OpenID Connect is a protocol based on REST, OAuth 2.0 and JOSE
     stacks. It is described here: http://openid.net/connect/.
@@ -58,15 +58,15 @@ and configure:
    to always allow.
 
 
-.. tip:: 
+.. tip::
 
     For example, to allow only users with a strong authentication
     level:
-    
+
     ::
-    
+
        $authenticationLevel > 2
-    
+
 
 
 Configuration of LL::NG in Relying Party
@@ -173,7 +173,7 @@ So you can define for example:
 -  email => mail
 
 
-.. important:: 
+.. important::
 
     The specific ``sub`` attribute is not defined here, but
     in User attribute parameter (see below).
@@ -182,7 +182,7 @@ Extra Claims
 ^^^^^^^^^^^^
 
 
-.. important:: 
+.. important::
 
     By default, only claims that are part of standard OpenID
     Connect scopes will be sent to a client. If you want to send a claim
@@ -202,7 +202,7 @@ be able to read the ``rebirth_count`` and ``bloodline`` claims from the
 Userinfo endpoint.
 
 
-.. warning:: 
+.. warning::
 
     Any Claim defined in this section must be mapped to a
     LemonLDAP::NG session attribute in the **Exported Attributes**
@@ -268,16 +268,15 @@ Options
       https://openid.net/specs/openid-connect-core-1_0.html#OfflineAccess
       for details. These offline sessions can be administered through
       the Session Browser.
+   - **Allow OAuth2.0 Password Grant** (since version ``2.0.8``) Allow the use of the Resource Owner Password Credentials Grant on by this client. This feature only works if you have configured a form-based authentication module.
+   - **Access Rule**: lets you specify a :doc:`Perl rule<rules_examples>` to restrict access to this client
 
-::
+- **Logout**
 
-      * **Allow OAuth2.0 Password Grant** (since version ''2.0.8''): Allow the use of the Resource Owner Password Credentials Grant on by this client. This feature only works if you have configured a form-based authentication module.
-      * **Access Rule**: lets you specify a [[rules_examples|Perl rule]] to restrict access to this client
-   * **Logout**
-     * **Allowed redirection addresses for logout**: A space separated list of URLs that this client can redirect the user to once the logout is done (through ''post_logout_redirect_uri'')
-     * **URL**: Specify the relying party's logout URL
-     * **Type**: Type of Logout to perform (only Front-Channel is implemented for now)
-     * **Session required**: Whether to send the Session ID in the logout request
+   - **Allowed redirection addresses for logout**: A space separated list of URLs that this client can redirect the user to once the logout is done (through ``post_logout_redirect_uri``)
+   - **URL**: Specify the relying party's logout URL
+   - **Type**: Type of Logout to perform (only Front-Channel is implemented for now)
+   - **Session required**: Whether to send the Session ID in the logout request
 
 Macros
 ^^^^^^
diff --git a/doc/sources/admin/idpsaml.rst b/doc/sources/admin/idpsaml.rst
index 1ec35c2a5..edfcd75c8 100644
--- a/doc/sources/admin/idpsaml.rst
+++ b/doc/sources/admin/idpsaml.rst
@@ -32,15 +32,15 @@ configure:
    to always allow.
 
 
-.. tip:: 
+.. tip::
 
     For example, to allow only users with a strong authentication
     level:
-    
+
     ::
-    
+
        $authenticationLevel > 2
-    
+
 
 
 Register LemonLDAP::NG on partner Service Provider
@@ -78,7 +78,7 @@ between your server and the SP).
 |image0|
 
 
-.. tip:: 
+.. tip::
 
     You can also edit the metadata directly in the textarea
 
@@ -139,10 +139,10 @@ Authentication response
      NotOnOrAfter="2014-07-21T12:48:08Z">
 
 
-.. important:: 
+.. important::
 
     There is a time tolerance of 60 seconds in
-    ``<Conditions>``\ 
+    ``<Conditions>``\
 
 -  **Force UTF-8**: Activate to force UTF-8 decoding of values in SAML
    attributes. If set to 0, the value from the session is directly
@@ -152,7 +152,7 @@ Signature
 '''''''''
 
 These options override service signature options (see
-:doc:`SAML service configuration<samlservice>`).
+:ref:`SAML service configuration<samlservice-general-options>`).
 
 -  **Sign SSO message**: sign SSO message
 -  **Check SSO message signature**: check SSO message signature
@@ -168,17 +168,17 @@ Security
    Initiated URL on this SP.
 
 
-.. tip:: 
+.. tip::
 
     The IDP Initiated URL is the SSO SAML URL with GET
     parameters:
-    
+
     -  IDPInitiated: 1
     -  One of:
-    
+
        -  sp: SP entity ID
        -  spConfKey: SP configuration key
-    
+
     For example:
     http://auth.example.com/saml/singleSignOn?IDPInitiated=1&spConfKey=simplesamlphp
 
diff --git a/doc/sources/admin/impersonation.rst b/doc/sources/admin/impersonation.rst
index 4781871a8..99b13840f 100644
--- a/doc/sources/admin/impersonation.rst
+++ b/doc/sources/admin/impersonation.rst
@@ -7,7 +7,7 @@ choose another profile to appear as. This feature can be especially
 useful for training/learning or development platforms.
 
 
-.. important:: 
+.. important::
 
     This plugin should not be used on production instance,
     prefer :doc:`ContextSwitching plugin<contextswitching>`.
@@ -36,41 +36,41 @@ protected from being impersonated.
       ``su; admins; anonymous``
 
 
-.. warning:: 
+.. warning::
 
     You HAVE TO modify **REMOTE_USER** to log both real AND
     spoofed uid.
-    
+
     Set a macro like this :
-    
+
     '' \_whatToTrace -> $real__user ? "$real__user/$_user" : "$_user/$_user"
     ''
-    
+
     and set ``Genaral Parameters > Logs > REMOTE_USER`` with ''
     \_whatToTrace ''
-    
 
 
 
-.. important:: 
+
+.. important::
 
     Both spoofed and real session attributes can be used to
     set access rules, groups or macros.
-    
+
     By example : ``$real_uid eq 'dwho``' or ``$real_groups =~ /\bsu\b/``
-    
+
     Keep in mind that real session is computed first. Afterward, if access
     is granted, impersonated session is computed with real and spoofed
-    session attributes if Impersonation is allowed. 
+    session attributes if Impersonation is allowed.
 
 
-.. important:: 
+.. important::
 
     By example, to prevent impersonation as 'dwho' set
     **Identities use rule** like :
-    
+
     '' $uid ne 'dwho' ''
-    
+
 
 
 impersonationPrefix is used to rename user's real profile attributes.
diff --git a/doc/sources/admin/installdeb.rst b/doc/sources/admin/installdeb.rst
index 1e61aecb9..831af1f5b 100644
--- a/doc/sources/admin/installdeb.rst
+++ b/doc/sources/admin/installdeb.rst
@@ -20,6 +20,8 @@ LemonLDAP::NG provides these packages:
 Get the packages
 ----------------
 
+.. _installdeb-official-repository:
+
 Official repository
 ~~~~~~~~~~~~~~~~~~~
 
@@ -31,27 +33,29 @@ installable:
    apt-get install lemonldap-ng
 
 
-.. tip:: 
+.. tip::
 
     Packages from `Debian
-    repository <http://packages.debian.org/search?keywords=lemonldap-ng>`
+    repository <http://packages.debian.org/search?keywords=lemonldap-ng>`__
     may not be up to date but are **security-maintained** by `Debian
-    Security Team <https://security-team.debian.org/>` for "stable"
+    Security Team <https://security-team.debian.org/>`__ for "stable"
     release and `LTS team <https://www.debian.org/lts/>`__ for "oldstable"
     release. Then if you don't need some new features or aren't concerned by
     a bug fixed earlier, **this is a good choice**. You can also use `Debian
     backports <https://backports.debian.org/>`__ or "testing"/"unstable"
     packages, team maintained.
-    `Here is the list of Debian versions <https://lemonldap-ng.org/documentation/>`__.
+    `Here is the list of Debian versions <https://lemonldap-ng.org/documentation/#packaged_versions>`__.
 
 
-.. warning:: 
+.. warning::
 
     LLNG Ubuntu packages are not in the "universe" but in the
     "multiverse". This means they are not security-maintained. If you use
     them, you should follow our security advisories on
     lemonldap-ng-users@ow2.org.
 
+.. _installdeb-llng-repository:
+
 LL::NG repository
 ~~~~~~~~~~~~~~~~~
 
@@ -83,16 +87,16 @@ Then, add the official LL::NG repository
    deb-src https://lemonldap-ng.org/deb stable main
 
 
-.. tip:: 
+.. tip::
+
+
 
-    
-    
     -  Use the ``oldstable`` repository to get packages from previous major
        version
     -  Use the ``testing`` repository to get packages from next major
        version
     -  Use the ``2.0`` repository to avoid upgrade to next major version
-    
+
 
 
 Finally update your APT cache:
@@ -110,15 +114,15 @@ Install packages
 ----------------
 
 
-.. important:: 
+.. important::
 
     By default packages will require Nginx. If you want to
     use Apache2, install it first with mod_perl:
-    
+
     ::
-    
+
        apt install apache2 libapache2-mod-perl2 libapache2-mod-fcgid
-    
+
 
 
 With apt
@@ -166,7 +170,7 @@ Configure your DNS server to resolve names with your server IP:
 -  manager.<your domain>: manager, only for adminsitrators
 -  test1.<your domain>, test2.<your domain>: sample applications
 
-Follow the :doc:`next steps<start>`
+Follow the :ref:`next steps<start-configuration>`
 
 File location
 -------------
diff --git a/doc/sources/admin/installrpm.rst b/doc/sources/admin/installrpm.rst
index 3db6fc2be..40a217819 100644
--- a/doc/sources/admin/installrpm.rst
+++ b/doc/sources/admin/installrpm.rst
@@ -2,7 +2,7 @@ Installation on Red Hat/CentOS
 ==============================
 
 
-.. important:: 
+.. important::
 
     LL::NG requires at least Red Hat/CentOS 7
 
@@ -31,21 +31,23 @@ LemonLDAP::NG provides packages for Red Hat/Centos 7:
 -  perl-Lemonldap-NG-Portal: CPAN - Portal modules
 
 
-.. warning:: 
+.. warning::
 
     The package lemonldap-ng-nginx requires the nginx
     community package. If you use openrestry or Nginx plus, you must ignore
     this dependency. To do this, download the package and install it with:
-    
+
     ::
-    
+
        rpm --nodeps -i lemonldap-ng-nginx*.rpm
-    
+
 
 
 Get the packages
 ----------------
 
+.. _installrpm-yum-repository:
+
 YUM repository
 ~~~~~~~~~~~~~~
 
@@ -65,7 +67,7 @@ You can add this YUM repository to get recent packages:
    gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-OW2
 
 
-.. tip:: 
+.. tip::
 
     Replace ``stable`` by ``2.0`` to avoid upgrade to next major
     version
@@ -88,11 +90,11 @@ Run this to update packages cache:
    yum update
 
 
-.. warning:: 
+.. warning::
 
     You must also install the EPEL repository for non-core
-    dependencies. See :doc:`prerequisites and dependencies<prereq>` chapter
-    for more. 
+    dependencies. See :ref:`prerequisites and dependencies<prereq-yum>`
+    chapter for more. 
 
 Manual download
 ~~~~~~~~~~~~~~~
@@ -140,14 +142,14 @@ You have then to install all the downloaded packages:
    rpm -Uvh lemonldap-ng-* perl-Lemonldap-NG-*
 
 
-.. tip:: 
+.. tip::
 
     You can choose to install only one component by choosing the
     package ``lemonldap-ng-portal``, ``lemonldap-ng-handler`` or
     ``lemonldap-ng-manager``.
-    
+
     Install the package ``lemonldap-ng-conf`` on all server which contains
-    one of those packages. 
+    one of those packages.
 
 First configuration steps
 -------------------------
@@ -176,7 +178,7 @@ Configure your DNS server to resolve names with your server IP:
 -  manager.<your domain>: manager, only for adminsitrators
 -  test1.<your domain>, test2.<your domain>: sample applications
 
-Follow the :doc:`next steps<start>`
+Follow the :ref:`next steps<start-configuration>`
 
 File location
 -------------
diff --git a/doc/sources/admin/installsles.rst b/doc/sources/admin/installsles.rst
index f895318f2..f0bbb1da3 100644
--- a/doc/sources/admin/installsles.rst
+++ b/doc/sources/admin/installsles.rst
@@ -2,7 +2,7 @@ Installation on Suse Linux
 ==========================
 
 
-.. important:: 
+.. important::
 
     LL::NG requires at least SLES 12 SP1 or
     equivalent
@@ -82,14 +82,14 @@ or
    zypper refresh
 
 
-.. tip:: 
+.. tip::
 
-    Only packages on SLES 12 SP1 are tested for now. 
+    Only packages on SLES 12 SP1 are tested for now.
 
 Manual download
 ~~~~~~~~~~~~~~~
 
-RPMs are available on the :doc:`Download page</download>`.
+RPMs are available on the :doc:`Download page<download>`.
 
 Package GPG signature
 ---------------------
@@ -143,14 +143,14 @@ You have then to install all the downloaded packages:
    rpm -Uvh lemonldap-ng-* perl-Lemonldap-NG-*
 
 
-.. tip:: 
+.. tip::
 
     You can choose to install only one component by choosing the
     package ``lemonldap-ng-portal``, ``lemonldap-ng-handler`` or
     ``lemonldap-ng-manager``.
-    
+
     Install the package ``lemonldap-ng-conf`` on all server which contains
-    one of those packages. 
+    one of those packages.
 
 First configuration steps
 -------------------------
@@ -203,7 +203,7 @@ Configure your DNS server to resolve names with your server IP:
 -  manager.<your domain>: manager, only for adminsitrators
 -  test1.<your domain>, test2.<your domain>: sample applications
 
-Follow the :doc:`next steps<start>`
+Follow the :ref:`next steps<start-configuration>`
 
 File location
 -------------
@@ -240,9 +240,9 @@ If you need it, you can rebuild RPMs:
 
 Alternatively, you can use the automatic script
 "create-lemonldap-packages.sh", available in rpm-sles directory in the
-:doc:`lemonldap svn repository</download>`. The automatic script can
-also generate intermediate dependencies. See README file in the same
-directory for more information.
+:ref:`lemonldap svn repository<download-getting-sources-from-svn-repository>`.
+The automatic script can also generate intermediate dependencies. See
+README file in the same directory for more information.
 
 .. |image0| image:: /rpm-gpg-key-ow2
 
diff --git a/doc/sources/admin/installtarball.rst b/doc/sources/admin/installtarball.rst
index db66acee7..1586550e8 100644
--- a/doc/sources/admin/installtarball.rst
+++ b/doc/sources/admin/installtarball.rst
@@ -8,7 +8,7 @@ Get the tarball from :doc:`download page</download>`. You can also find
 on this page the SVN tarball if you want to test latest features.
 
 
-.. important:: 
+.. important::
 
     The content of the SVN tarball is not the same as the
     official tarball. Please see the next chapter to learn how build an
@@ -60,10 +60,10 @@ For full install:
    sudo make install PROD=yes
 
 
-.. important:: 
+.. note::
 
     ``PROD=yes`` makes web interface use minified versions of CSS and
-    JS files. 
+    JS files.
 
 You can modify location of default storage configuration file in
 configure target:
@@ -126,28 +126,28 @@ Available parameters are:
 -  **VHOSTLISTEN**: how listen parameter is configured for virtual hosts
    in Apache (default: \*:80)
 -  **PROD**: use minified JS and CSS files
--  **USEDEBIANLIBS**: use Debian packaged JS and CSS files *(*\ **Note
-   that this options isn't yet usable**\ *since Debian provides a too
-   old AngularJS for now: LLNG manager needs at least version 1.4.0)*
+-  **USEDEBIANLIBS**: use Debian packaged JS and CSS files (**Note
+   that this options isn't yet usable**  since Debian provides a too
+   old AngularJS for now: LLNG manager needs at least version 1.4.0)
 -  **USEEXTERNALLIBS**: use files from public CDN
 
 
-.. tip:: 
+.. tip::
 
     For Debian/Ubuntu with Apache2, you can use:
-    
+
     ::
-    
+
        make debian-install-for-apache
        make ubuntu-install-for-apache
-    
+
     And with Nginx:
-    
+
     ::
-    
+
        make debian-install-for-nginx
        make ubuntu-install-for-nginx
-    
+
     See also :doc:`Debian/Ubuntu installation documentation<installdeb>`.
 
 
@@ -176,4 +176,4 @@ Configure your DNS server to resolve names with your server IP:
 -  manager.<your domain>: manager, only for adminsitrators
 -  test1.<your domain>, test2.<your domain>: sample applications
 
-Follow the :doc:`next steps<start>`.
+Follow the :ref:`next steps<start-configuration>`.
diff --git a/doc/sources/admin/issuerdbget.rst b/doc/sources/admin/issuerdbget.rst
index 0fe04908c..3c4f60a45 100644
--- a/doc/sources/admin/issuerdbget.rst
+++ b/doc/sources/admin/issuerdbget.rst
@@ -15,7 +15,7 @@ GET parameters:
    example)
 
 
-.. warning:: 
+.. warning::
 
     Passing such sensitive information can be dangerous. Using
     other well-known secured protocols is recommended.
@@ -32,20 +32,20 @@ In the Manager, go in ``General Parameters`` » ``Issuer modules`` »
 
 -  **Activation**: set to ``On``.
 -  **Path**: keep ``^/get/`` unless you have change
-   :doc:`Apache portal configuration<configlocation>` file.
+   :ref:`Apache portal configuration<configlocation-portal>` file.
 -  **Use rule**: a rule to allow user to use this module, set to 1 to
    always allow.
 
 
-.. tip:: 
+.. tip::
 
     For example, to allow only users with a strong authentication
     level:
-    
+
     ::
-    
+
        $authenticationLevel > 2
-    
+
 
 
 Then go in ``Get parameters`` to define variables to transmit:
@@ -63,15 +63,16 @@ For example:
    }
 
 
-.. warning:: 
+.. warning::
 
     In the previous example, \_session_id is quite sensitive,
     thus it is encouraged that the application revalidate \_session_id using
     getCookie() SOAP call to avoid some security problems
 
 
-.. tip:: 
+.. tip::
 
     If host is not already registered in virtual hosts, you need
-    to declare it in :doc:`trusted domains<security>` to allow
+    to declare it in
+    :ref:`trusted domains<security-configure-security-settings>` to allow
     redirection
diff --git a/doc/sources/admin/jsonfileconfbackend.rst b/doc/sources/admin/jsonfileconfbackend.rst
index f9b4edc16..9b5bc1665 100644
--- a/doc/sources/admin/jsonfileconfbackend.rst
+++ b/doc/sources/admin/jsonfileconfbackend.rst
@@ -5,14 +5,14 @@ This works like :doc:`File backend<fileconfbackend>`, except that data
 are serialized in JSON.
 
 
-.. tip:: 
+.. tip::
 
     This configuration storage can be shared between different
     hosts using:
-    
+
     -  :doc:`SOAP configuration backend proxy<soapconfbackend>`
     -  any files sharing system (NFS, NAS, SAN,...)
-    
+
 
 
 Configuration
diff --git a/doc/sources/admin/kerberos.rst b/doc/sources/admin/kerberos.rst
index 2d5b1566d..5eeba1f94 100644
--- a/doc/sources/admin/kerberos.rst
+++ b/doc/sources/admin/kerberos.rst
@@ -43,7 +43,7 @@ Active Directory). The reverse DNS of auth.example.com **must** return
 the portal IP.
 
 
-.. tip:: 
+.. tip::
 
     If you have a SSO cluster, you must setup a Virtual IP in
     cluster and register this IP in DNS.
@@ -136,13 +136,13 @@ You have to run this command on Active Directory:
    ktpass -princ HTTP/auth.example.com@EXAMPLE.COM -mapuser KERB_AUTH@EXAMPLE.COM -crypto DES-CBC-MD5 -ptype KRB5_NT_PRINCIPAL -mapOp set -pass <PASSWORD> -out c:\auth.keytab
 
 
-.. important:: 
+.. important::
 
     The values passed in -crypto and -ptype depend on the
     Active Directory version and the windows version of the workstations.
     You can for example use RC4-HMAC-NT as crypto protocol if DES is not
     supported by workstations (this the case by default for Window 8 for
-    example). 
+    example).
 
 The file ``auth.keytab`` should then be copied (with a secure media) to
 the Linux server (for example in ``/etc/lemonldap-ng``).
diff --git a/doc/sources/admin/ldapsessionbackend.rst b/doc/sources/admin/ldapsessionbackend.rst
index fef8882f7..e45860334 100644
--- a/doc/sources/admin/ldapsessionbackend.rst
+++ b/doc/sources/admin/ldapsessionbackend.rst
@@ -5,14 +5,14 @@ An Apache session module was created by LL::NG team to store sessions in
 an LDAP directory.
 
 
-.. important:: 
+.. important::
 
     This module is not part of LL::NG distribution, and can
     be found on CPAN:
     `Apache::Session::LDAP <http://search.cpan.org/dist/Apache-Session-LDAP/>`__.
 
 
-.. tip:: 
+.. tip::
 
     This module is also available on
     `GitHub <https://github.com/coudot/apache-session-ldap>`__.
@@ -36,15 +36,21 @@ in ``General parameters`` » ``Sessions`` » ``Session storage`` »
 sensitive):
 
 ======================== ================================= ===============================
-Required parameters                                       
-======================== ================================= ===============================
+Required parameters
+------------------------------------------------------------------------------------------
 Name                     Comment                           Example
+======================== ================================= ===============================
 **ldapServer**           URI of the server                 ldap://localhost
 **ldapConfBase**         DN of sessions branch             ou=sessions,dc=example,dc=com
 **ldapBindDN**           Connection login                  cn=admin,dc=example,dc=password
 **ldapBindPassword**     Connection password               secret
-Optional parameters                                       
+======================== ================================= ===============================
+
+======================== ================================= ===============================
+Optional parameters
+------------------------------------------------------------------------------------------
 Name                     Comment                           Default value
+======================== ================================= ===============================
 **ldapObjectClass**      Objectclass of the entry          applicationProcess
 **ldapAttributeId**      Attribute storing session ID      cn
 **ldapAttributeContent** Attribute storing session content description
diff --git a/doc/sources/admin/localconfbackend.rst b/doc/sources/admin/localconfbackend.rst
index 9ece61750..7c7584e87 100644
--- a/doc/sources/admin/localconfbackend.rst
+++ b/doc/sources/admin/localconfbackend.rst
@@ -5,6 +5,6 @@ Some admins wants to deploy configuration using lemonldap-ng.ini only.
 This backend just return an empty configuration.
 
 
-.. important:: 
+.. important::
 
     Advanced use only !
diff --git a/doc/sources/admin/loginhistory.rst b/doc/sources/admin/loginhistory.rst
index fe946c043..f07b4364b 100644
--- a/doc/sources/admin/loginhistory.rst
+++ b/doc/sources/admin/loginhistory.rst
@@ -35,8 +35,9 @@ data.
 
 To allow the Login History tab in Menu, configure it in
 ``General Parameters`` > ``Portal`` > ``Menu`` > ``Modules`` (see
-:doc:`portal menu configuration<portalmenu>`).
+:ref:`portal menu configuration<portalmenu-menu-modules>`).
 
 You can also display a check box on the authentication form, to allow
 user to see their login history before being redirected to the protected
-application (see :doc:`portal customization<portalcustom>`).
+application (see
+:ref:`portal customization<portalcustom-other-parameters>`).
diff --git a/doc/sources/admin/logoutforward.rst b/doc/sources/admin/logoutforward.rst
index a75f26863..99dda810e 100644
--- a/doc/sources/admin/logoutforward.rst
+++ b/doc/sources/admin/logoutforward.rst
@@ -5,7 +5,7 @@ Presentation
 ------------
 
 Even if LL:NG can catch logout URL trough
-:doc:`virtual host rules<writingrulesand_headers>`, you can have the
+:ref:`virtual host rules<rules>`, you can have the
 need to forward a logout to other applications, to close their local
 sessions.
 
@@ -14,7 +14,7 @@ process, to send logout requests (indeed, GET requests on application
 logout URL) inside hidden iframes.
 
 
-.. tip:: 
+.. tip::
 
     The logout request will be sent even if the user did not use
     the application.
@@ -29,7 +29,7 @@ Go in Manager, ``General parameters`` » ``Advanced parameters`` »
 -  **Value**: application logout URL
 
 
-.. important:: 
+.. important::
 
     The request on logout URL will be sent after user is
     disconnected, so you should unprotect this URL if it is protected by an
diff --git a/doc/sources/admin/logs.rst b/doc/sources/admin/logs.rst
index 3856a68ed..7c77b4fc9 100644
--- a/doc/sources/admin/logs.rst
+++ b/doc/sources/admin/logs.rst
@@ -33,7 +33,7 @@ choose between:
    backends depending on log level
 
 
-.. important:: 
+.. important::
 
     Except for Apache2 and Log4Perl, log level is defined
     by ``logLevel`` parameter set in ``lemonldap-ng.ini`` file. Logger
@@ -167,7 +167,7 @@ You just have to give your DSN:
    sentryDsn = https://...
 
 
-.. important:: 
+.. important::
 
     This experimental logger requires
     `Sentry::Raven <https://metacpan.org/pod/Sentry::Raven>`__ Perl
@@ -190,10 +190,10 @@ Use it to use more than one logger. Example:
    sentryDsn         = https://...
 
 
-.. important:: 
+.. important::
 
-    At least ``logDispatchError`` *(or
-    ``userLogDispatchError`` for user logs)* must be defined. All sub level
+    At least ``logDispatchError`` (or
+    ``userLogDispatchError`` for user logs) must be defined. All sub level
     will be dispatched on it, until another lever is declared. In the above
     example, Sentry collects ``error`` and ``warn`` levels and all user
     actions, while syslog stores technical ``notice``, ``info`` and
diff --git a/doc/sources/admin/mail2f.rst b/doc/sources/admin/mail2f.rst
index c34ee7c84..f835504aa 100644
--- a/doc/sources/admin/mail2f.rst
+++ b/doc/sources/admin/mail2f.rst
@@ -10,13 +10,13 @@ The user will be prompted for this code in order to finish the login
 process.
 
 
-.. important:: 
+.. important::
 
     This plugin will only improve security in situations
     where the user's email is not protected by the same password used to
     login on LemonLDAP::NG. And of course, if the user's email account is
     also protected by LemonLDAP::NG, they will not be able to open their
-    mailbox to find out their one-time code. 
+    mailbox to find out their one-time code.
 
 Configuration
 ~~~~~~~~~~~~~
diff --git a/doc/sources/admin/managerprotection.rst b/doc/sources/admin/managerprotection.rst
index aba663b12..8b1f7a848 100644
--- a/doc/sources/admin/managerprotection.rst
+++ b/doc/sources/admin/managerprotection.rst
@@ -9,7 +9,7 @@ Apache based protection
 -----------------------
 
 
-.. tip:: 
+.. tip::
 
     Apache based protection allow one to be independent from
     WebSSO, so Manager will always be reachable even if WebSSO configuration
@@ -46,23 +46,23 @@ module <http://httpd.apache.org/docs/current/mod/mod_authnz_ldap.html>`__:
        </Directory>
 
 
-.. important:: 
+.. important::
 
     You need to disable default Manager protection in
     lemonldap-ng.ini to rely only on Apache:
-    
+
     .. code:: ini
-    
+
        [manager]
        ;protection = manager
-    
+
 
 
 LL::NG based protection
 -----------------------
 
 
-.. warning:: 
+.. warning::
 
     Before enabling Manager protection by LL::NG, you must
     have configured how users authenticate on Portal, and test that you can
@@ -71,8 +71,9 @@ LL::NG based protection
 
 By default, you will have a manager virtual host define in
 configuration. If not Go on Manager, and declare Manager as a new
-:doc:`virtual host<configvhost>`, for example ``manager.example.com``.
-You can then set the access rule. No headers are needed.
+:ref:`virtual host<configvhost-lemonldapng-configuration>`, for example
+``manager.example.com``. You can then set the access rule. No headers
+are needed.
 
 The default rule is:
 
@@ -86,7 +87,7 @@ like group membership, or any other rule based on a session variable).
 Save the configuration and exit the Manager.
 
 
-.. tip:: 
+.. tip::
 
     The next time you will access Manager, it will be trough
     LL::NG.
@@ -112,10 +113,10 @@ Restart Apache and try to log on Manager. You should be redirected to
 LL::NG Portal.
 
 You can then add the Manager as
-:doc:`an application in the menu<portalmenu>`.
+:ref:`an application in the menu<portalmenu-categories-and-applications>`.
 
 
-.. tip:: 
+.. tip::
 
     If for an obscure reason, the WebSSO is not working and you
     want to access the Manager, remove the protection in
diff --git a/doc/sources/admin/memcachedsessionbackend.rst b/doc/sources/admin/memcachedsessionbackend.rst
index d81321746..fe02f0b1e 100644
--- a/doc/sources/admin/memcachedsessionbackend.rst
+++ b/doc/sources/admin/memcachedsessionbackend.rst
@@ -2,20 +2,20 @@ Memcached session backend
 =========================
 
 
-.. important:: 
+.. important::
 
     \ `Memcached <http://memcached.org/>`__ can be used with
     LL::NG, but some features will not work since Memcached doesn't provide
     any parsing system:
-    
+
     -  Session expiration: sessions will never expire (server side)
-    -  :doc:`Session explorer<features>` will not work
-    -  :doc:`Session restrictions<features>` will not work
-    
+    -  :ref:`Session explorer<session-explorer>` will not work
+    -  :ref:`Session restrictions<session-restrictions>` will not work
+
     To keep Memcached performance level and LL::NG features, you can replace
     `Memcached <http://memcached.org/>`__ by
     `Redis <http://code.google.com/p/redis/>`__ using
-    :doc:`NoSQL session backend<nosqlsessionbackend>`. 
+    :doc:`NoSQL session backend<nosqlsessionbackend>`.
 
 Setup
 -----
@@ -29,7 +29,7 @@ in ``General parameters`` » ``Sessions`` » ``Session storage`` »
 sensitive):
 
 =================== ================= =============================
-Required parameters                  
+Required parameters
 =================== ================= =============================
 Name                Comment           Example
 **Servers**         Memcached servers 10.0.0.1:20000 10.0.0.2:20000
diff --git a/doc/sources/admin/mongodbconfbackend.rst b/doc/sources/admin/mongodbconfbackend.rst
index 19d2fee50..a183206c8 100644
--- a/doc/sources/admin/mongodbconfbackend.rst
+++ b/doc/sources/admin/mongodbconfbackend.rst
@@ -40,12 +40,12 @@ Example :
    password = llpassword
 
 ===================================================================================================================== ================================ ==========
-Optional parameters (see `MongoDB::MongoClient <http://search.cpan.org/perldoc?MongoDB%3A%3AMongoClient>`__ man page)                                 
+Optional parameters (see `MongoDB::MongoClient <http://search.cpan.org/perldoc?MongoDB%3A%3AMongoClient>`__ man page)
 ===================================================================================================================== ================================ ==========
 Name                                                                                                                  Comment                          Example
 db_name                                                                                                               Admin database (default: admin)  admin
 auth_mechanism                                                                                                        Authentication mechanism         PLAIN
-auth_mechanism_properties                                                                                                                             
+auth_mechanism_properties
 connect_timeout                                                                                                       Connection timeout               10000
 ssl                                                                                                                   Boolean or hash ref (default: 0) 1
 username                                                                                                              Username to use to connect       lluser
diff --git a/doc/sources/admin/mongodbsessionbackend.rst b/doc/sources/admin/mongodbsessionbackend.rst
index a4fd9ba23..7804ee8b1 100644
--- a/doc/sources/admin/mongodbsessionbackend.rst
+++ b/doc/sources/admin/mongodbsessionbackend.rst
@@ -5,7 +5,7 @@ MongoDB session backend
 is a faster shareable session backend.
 
 
-.. important:: 
+.. important::
 
     Use an up-to-date version of Apache::Session::MongoDB, at least 1.8.1.
 
@@ -27,14 +27,15 @@ in ``General parameters`` » ``Sessions`` » ``Session storage`` »
 sensitive):
 
 ============================= ============================================================================================ ===============
-Optional parameters                                                                                                       
-============================= ============================================================================================ ===============
+Optional parameters
+------------------------------------------------------------------------------------------------------------------------------------------
 Name                          Comment                                                                                      Example
+============================= ============================================================================================ ===============
 **host**                      `MongoDB server URI <https://metacpan.org/pod/MongoDB::MongoClient#CONNECTION-STRING-URI>`__ 127.0.0.1:27017
 **db_name**                   Session database (default: sessions)                                                         llconfdb
 **collection**                Collection (default: sessions)                                                               sessions
 **auth_mechanism**            Authentication mechanism                                                                     PLAIN
-**auth_mechanism_properties**                                                                                             
+**auth_mechanism_properties**
 **connect_timeout**           Connection timeout                                                                           10000
 **ssl**                       Boolean or hash ref (default: 0)                                                             1
 **username**                  Username to use to connect                                                                   lluser
diff --git a/doc/sources/admin/mysqlminihowto.rst b/doc/sources/admin/mysqlminihowto.rst
index fb12848c9..18f4e965b 100644
--- a/doc/sources/admin/mysqlminihowto.rst
+++ b/doc/sources/admin/mysqlminihowto.rst
@@ -21,6 +21,6 @@ Steps:
 
    -  :doc:`Using Apache::Session::Browseable::MySQL<browseablesessionbackend>`
       (recommended for best performances)
-   -  :doc:`Using Apache::Session::MySQL<sqlsessionbackend>` *(if you
+   -  :doc:`Using Apache::Session::MySQL<sqlsessionbackend>` (if you
       choose this option, then read
-      :doc:`how to increase MySQL performances<performances>`)*
+      :ref:`how to increase MySQL performances<performances-apachesession-performances>`)
diff --git a/doc/sources/admin/nodehandler.rst b/doc/sources/admin/nodehandler.rst
index fbe037eca..443402be4 100644
--- a/doc/sources/admin/nodehandler.rst
+++ b/doc/sources/admin/nodehandler.rst
@@ -13,12 +13,12 @@ Examples
 **Important things**:
 
 -  Rules and headers must be written in javascript for these hosts
-   *(example ``$uid eq "dwho"`` becomes ``$uid === "dwho"``)*
+   (example ``$uid eq "dwho"`` becomes ``$uid === "dwho"``)
 -  Multi-lines are not supported in lemonldap-ng.ini
 -  Virtualhosts handled by node-lemonldap-ng-handler must be explicitly
    declared in your ``lemonldap-ng.ini`` file in ``[node-handler]``
-   section *(*\ **NB**\ *: section ``[handler]`` isn't used by node
-   handler)*:
+   section (**NB**: section ``[handler]`` isn't used by node
+   handler):
 
 .. code:: ini
 
diff --git a/doc/sources/admin/notifications.rst b/doc/sources/admin/notifications.rst
index db19681b1..0ed489c7b 100644
--- a/doc/sources/admin/notifications.rst
+++ b/doc/sources/admin/notifications.rst
@@ -63,13 +63,13 @@ An XML document can contain several notifications messages. Just the
 first one can be searched and displayed!
 
 
-.. important:: 
+.. important::
 
     Listed notifications are extracted from users
     persistent session (notification reference and accepted date). ONLY the
     notifications explorer can found in notifications backend are available
     to be displayed. Notifications content (title, subtitle and so on...) is
-    not stored into persistent session. 
+    not stored into persistent session.
 
 Storage
 ~~~~~~~
@@ -99,20 +99,20 @@ Parameters for File backend are the same as
 :doc:`File configuration backend<fileconfbackend>`.
 
 
-.. important:: 
+.. important::
 
     You need to create yourself the directory and set write
     access to Apache user. For example:
-    
+
     ::
-    
+
        mkdir /usr/local/lemonldap-ng/notifications/
        chown www-data /usr/local/lemonldap-ng/notifications/
-    
 
 
 
-.. tip:: 
+
+.. tip::
 
     The file name default separator is ``_``, this can be a
     problem if you register notifications for users having ``_`` in their
@@ -131,12 +131,12 @@ Parameters for DBI backend are the same as
 :doc:`DBI configuration backend<sqlconfbackend>`.
 
 
-.. important:: 
+.. important::
 
     You have to create the table by yourself:
-    
+
     .. code:: sql
-    
+
        CREATE TABLE notifications (
          date datetime NOT NULL,
          uid varchar(255) NOT NULL,
@@ -146,7 +146,7 @@ Parameters for DBI backend are the same as
          done datetime DEFAULT NULL,
          PRIMARY KEY (date, uid,ref)
        )
-    
+
 
 
 To summary available options:
@@ -163,7 +163,7 @@ Parameters for LDAP backend are the same as
 :doc:`LDAP configuration backend<ldapconfbackend>`.
 
 
-.. important:: 
+.. important::
 
     You have to create the branch by yourself
 
@@ -175,12 +175,12 @@ To summary available options:
 -  **ldapConfBase**: Notifications branch DN.
 
 
-.. important:: 
+.. note::
 
     DBI configuration example:
-    
+
     ::
-    
+
        notificationStorage = DBI
        notificationStorageOptions={  \
            'dbiChain'    => 'DBI:Pg:dbname=llng;host=mabdd;port=5432', \
@@ -189,7 +189,7 @@ To summary available options:
            'dbiPassword' => 'qwerty', \
            'type'        => 'CDBI', \
        }
-    
+
 
 
 Wildcard
@@ -210,7 +210,7 @@ Using notification system
 -------------------------
 
 
-.. important:: 
+.. important::
 
     Since version 2.0, notifications are now stored in JSON
     format. If you want to keep old format, select "use old format" in the
@@ -252,19 +252,19 @@ Notifications are JSON (default) or XML files containing:
          type="checkbox" />...</p>
 
 
-.. important:: 
+.. important::
 
     All other elements will be removed including HTML
     elements like <b>.
 
 
-.. tip:: 
+.. tip::
 
     One notification XML document can contain several
     notifications messages.
-    
+
     Several notifications can be inserted with a single request by using an
-    array of JSON (Tested with an array of 10,000 elements) 
+    array of JSON (Tested with an array of 10,000 elements)
 
 Examples
 ^^^^^^^^
@@ -298,7 +298,7 @@ JSON
    }] # No comma at the end
 
 
-.. tip:: 
+.. tip::
 
     JSON format notifications are displayed sorted by date and
     reference
@@ -361,7 +361,7 @@ Available options:
 -  **HTTP methods**: Enable/Disable HTTP methods
 
 
-.. important:: 
+.. important::
 
     If notification server is enabled, you have to protect
     this URL by using the web server because there is no authentication
@@ -492,7 +492,7 @@ For example with curl:
    # Retrieve all existing notifications
    curl -X GET -H "Content-Type: application/json" -H "Accept: application/json" http://auth.example.com/notifications/_allExisting_
 
-   # Retrieve all <uid>'s notifications 
+   # Retrieve all <uid>'s notifications
    curl -X GET -H "Content-Type: application/json" -H "Accept: application/json" http://auth.example.com/notifications/<uid>
 
    # Retrieve <uid>/<reference> notification parameters
diff --git a/doc/sources/admin/oauth2handler.rst b/doc/sources/admin/oauth2handler.rst
index d70b86990..736a8de5f 100644
--- a/doc/sources/admin/oauth2handler.rst
+++ b/doc/sources/admin/oauth2handler.rst
@@ -18,7 +18,7 @@ protected by the OAuth2 Handler.
 |image1|
 
 
-.. tip:: 
+.. tip::
 
     In the above schema, the OpenID Connect process is simplified.
     How the front application receives the Access Token depends on the
diff --git a/doc/sources/admin/openidconnectclaims.rst b/doc/sources/admin/openidconnectclaims.rst
index 79a400734..d9dba7e23 100644
--- a/doc/sources/admin/openidconnectclaims.rst
+++ b/doc/sources/admin/openidconnectclaims.rst
@@ -8,21 +8,21 @@ sub                   openid           string  uid
 name                  profile          string  cn
 given_name            profile          string  givenName
 family_name           profile          string  sn
-middle_name           profile          string 
-nickname              profile          string 
+middle_name           profile          string
+nickname              profile          string
 preferred_username    profile          string  displayName
 profile               profile          string  labeledURI
-picture               profile          string 
-website               profile          string 
+picture               profile          string
+website               profile          string
 email                 email            string  mail
 email_verified        email            boolean
-gender                profile          string 
-birthdate             profile          string 
-zoneinfo              profile          string 
+gender                profile          string
+birthdate             profile          string
+zoneinfo              profile          string
 locale                profile          string  preferredLanguage
 phone_number          phone            string  telephoneNumber
 phone_number_verified phone            boolean
-updated_at            profile          string 
+updated_at            profile          string
 formatted             address          string  registeredAddress
 street_address        address          string  street
 locality              address          string  l
diff --git a/doc/sources/admin/openidconnectservice.rst b/doc/sources/admin/openidconnectservice.rst
index 018f82436..07823aea8 100644
--- a/doc/sources/admin/openidconnectservice.rst
+++ b/doc/sources/admin/openidconnectservice.rst
@@ -28,7 +28,7 @@ values unless you have a specific need to change them.
 -  **Check Session**
 
 
-.. tip:: 
+.. tip::
 
     The end points are published inside JSON metadata.
 
@@ -84,7 +84,7 @@ run for example each week:
    5 5 * * 6 www-data /usr/share/lemonldap-ng/bin/rotateOidcKeys
 
 
-.. tip:: 
+.. tip::
 
     Set the correct Apache user, else generated configuration will
     not be readable by LL::NG.
@@ -100,7 +100,7 @@ portal (or has destroyed its SSO cookie). Else the ``unchanged`` state
 will be returned.
 
 
-.. tip:: 
+.. tip::
 
     To work, the LL::NG cookie must not be protected against
     javascript (``httpOnly`` option should be set to ``0``).
diff --git a/doc/sources/admin/parameterlist.rst b/doc/sources/admin/parameterlist.rst
index 9d0fe8810..ad1d5197e 100644
--- a/doc/sources/admin/parameterlist.rst
+++ b/doc/sources/admin/parameterlist.rst
@@ -2,12 +2,12 @@ Parameter list
 ==============
 
 
-.. tip:: 
+.. tip::
 
     Click on a column header to sort table. The attribute key
     name can be used directly in ``lemonldap-ng.ini`` or in Perl scripts to
     override configuration parameters (see
-    :doc:`configuration location<configlocation>`). 
+    :doc:`configuration location<configlocation>`).
 
 Main parameters
 ---------------
@@ -17,591 +17,591 @@ Main parameters
 ======================================================= ==================================================================================== ====== ======= ======= =============
 Key name                                                Documentation                                                                        Portal Handler Manager ini file only
 ======================================================= ==================================================================================== ====== ======= ======= =============
-ADPwdExpireWarning                                      AD password expire warning                                                           ✔                     
-ADPwdMaxAge                                             AD password max age                                                                  ✔                     
-AuthLDAPFilter                                          LDAP filter for auth search                                                          ✔                     
-LDAPFilter                                              Default LDAP filter                                                                  ✔                     
-SMTPAuthPass                                            Password to use to send mails                                                        ✔                     
-SMTPAuthUser                                            Login to use to send mails                                                           ✔                     
-SMTPPort                                                Fix SMTP port                                                                        ✔                     
-SMTPServer                                              SMTP Server                                                                          ✔                     
-SMTPTLS                                                 TLS protocol to use with SMTP                                                        ✔                     
-SMTPTLSOpts                                             TLS/SSL options for SMTP                                                             ✔                     
-SSLAuthnLevel                                           SSL authentication level                                                             ✔                     
-SSLVar                                                                                                                                       ✔                     
-SSLVarIf                                                                                                                                     ✔                     
-activeTimer                                             Enable timers on portal pages                                                        ✔                     
-apacheAuthnLevel                                        Apache authentication level                                                          ✔                     
-applicationList                                         Applications list                                                                    ✔                     
-authChoiceAuthBasic                                     Auth module used by AuthBasic handler                                                ✔                     
-authChoiceModules                                       Hash list of Choice strings                                                          ✔                     
-authChoiceParam                                         Applications list                                                                    ✔                     
-authentication                                          Authentication module                                                                ✔                     
-autoSigninRules                                         List of auto signin rules                                                            ✔                     
+ADPwdExpireWarning                                      AD password expire warning                                                           ✔
+ADPwdMaxAge                                             AD password max age                                                                  ✔
+AuthLDAPFilter                                          LDAP filter for auth search                                                          ✔
+LDAPFilter                                              Default LDAP filter                                                                  ✔
+SMTPAuthPass                                            Password to use to send mails                                                        ✔
+SMTPAuthUser                                            Login to use to send mails                                                           ✔
+SMTPPort                                                Fix SMTP port                                                                        ✔
+SMTPServer                                              SMTP Server                                                                          ✔
+SMTPTLS                                                 TLS protocol to use with SMTP                                                        ✔
+SMTPTLSOpts                                             TLS/SSL options for SMTP                                                             ✔
+SSLAuthnLevel                                           SSL authentication level                                                             ✔
+SSLVar                                                                                                                                       ✔
+SSLVarIf                                                                                                                                     ✔
+activeTimer                                             Enable timers on portal pages                                                        ✔
+apacheAuthnLevel                                        Apache authentication level                                                          ✔
+applicationList                                         Applications list                                                                    ✔
+authChoiceAuthBasic                                     Auth module used by AuthBasic handler                                                ✔
+authChoiceModules                                       Hash list of Choice strings                                                          ✔
+authChoiceParam                                         Applications list                                                                    ✔
+authentication                                          Authentication module                                                                ✔
+autoSigninRules                                         List of auto signin rules                                                            ✔
 available2F                                             Available second factor modules                                                      ✔                      ✔
 available2FSelfRegistration                             Available self-registration modules for second factor                                ✔                      ✔
-browsersDontStorePassword                               Avoid browsers to store users password                                               ✔                     
-bruteForceProtection                                    Enable brute force attack protection                                                 ✔                     
-bruteForceProtectionIncrementalTempo                    Enable incremental lock time for brute force attack protection                       ✔                     
+browsersDontStorePassword                               Avoid browsers to store users password                                               ✔
+bruteForceProtection                                    Enable brute force attack protection                                                 ✔
+bruteForceProtectionIncrementalTempo                    Enable incremental lock time for brute force attack protection                       ✔
 bruteForceProtectionLockTimes                           Incremental lock time values for brute force attack protection                       ✔                      ✔
 bruteForceProtectionMaxAge                              Brute force attack protection -> Max age between last and first allowed failed login ✔                      ✔
 bruteForceProtectionMaxFailed                           Brute force attack protection -> Max allowed failed login                            ✔                      ✔
 bruteForceProtectionMaxLockTime                         Brute force attack protection -> Max lock time                                       ✔                      ✔
 bruteForceProtectionTempo                               Brute force attack protection -> Tempo before try again                              ✔                      ✔
-captcha_login_enabled                                   Captcha on login page                                                                ✔                     
-captcha_mail_enabled                                    Captcha on password reset page                                                       ✔                     
-captcha_register_enabled                                Captcha on account creation page                                                     ✔                     
-captcha_size                                            Captcha size                                                                         ✔                     
-casAccessControlPolicy                                  CAS access control policy                                                            ✔                     
+captcha_login_enabled                                   Captcha on login page                                                                ✔
+captcha_mail_enabled                                    Captcha on password reset page                                                       ✔
+captcha_register_enabled                                Captcha on account creation page                                                     ✔
+captcha_size                                            Captcha size                                                                         ✔
+casAccessControlPolicy                                  CAS access control policy                                                            ✔
 casAppMetaDataOptions                                   Root of CAS app options                                                              ✔                      [1]
-casAttr                                                 Pivot attribute for CAS                                                              ✔                     
-casAttributes                                           CAS exported attributes                                                              ✔                     
-casAuthnLevel                                           CAS authentication level                                                             ✔                     
+casAttr                                                 Pivot attribute for CAS                                                              ✔
+casAttributes                                           CAS exported attributes                                                              ✔
+casAuthnLevel                                           CAS authentication level                                                             ✔
 casSrvMetaDataOptions                                   Root of CAS server options                                                           ✔                      [1]
-casStorage                                              Apache::Session module to store CAS user data                                        ✔                     
-casStorageOptions                                       Apache::Session module parameters                                                    ✔                     
-cda                                                     Enable Cross Domain Authentication                                                   ✔      ✔              
-certificateResetByMailCeaAttribute                                                                                                           ✔                     
-certificateResetByMailCertificateAttribute                                                                                                   ✔                     
-certificateResetByMailStep1Body                         Custom Certificate reset mail body                                                   ✔                     
-certificateResetByMailStep1Subject                      Mail subject for certificate reset email                                             ✔                     
-certificateResetByMailStep2Body                         Custom confirm Certificate reset mail body                                           ✔                     
-certificateResetByMailStep2Subject                      Mail subject for reset confirmation                                                  ✔                     
-certificateResetByMailURL                               URL of certificate reset page                                                        ✔                     
-certificateResetByMailValidityDelay                                                                                                          ✔                     
+casStorage                                              Apache::Session module to store CAS user data                                        ✔
+casStorageOptions                                       Apache::Session module parameters                                                    ✔
+cda                                                     Enable Cross Domain Authentication                                                   ✔      ✔
+certificateResetByMailCeaAttribute                                                                                                           ✔
+certificateResetByMailCertificateAttribute                                                                                                   ✔
+certificateResetByMailStep1Body                         Custom Certificate reset mail body                                                   ✔
+certificateResetByMailStep1Subject                      Mail subject for certificate reset email                                             ✔
+certificateResetByMailStep2Body                         Custom confirm Certificate reset mail body                                           ✔
+certificateResetByMailStep2Subject                      Mail subject for reset confirmation                                                  ✔
+certificateResetByMailURL                               URL of certificate reset page                                                        ✔
+certificateResetByMailValidityDelay                                                                                                          ✔
 cfgAuthor                                               Name of the author of the current configuration                                      ✔                      ✔
 cfgAuthorIP                                             Uploader IP address of the current configuration                                     ✔                      ✔
 cfgDate                                                 Timestamp of the current configuration                                               ✔                      ✔
 cfgLog                                                  Configuration update log                                                             ✔                      ✔
 cfgNum                                                  Enable Cross Domain Authentication                                                   ✔                      ✔
 cfgVersion                                              Version of LLNG which build configuration                                            ✔                      ✔
-checkState                                              Enable CheckState plugin                                                             ✔                     
-checkStateSecret                                        Secret token for CheckState plugin                                                   ✔                     
+checkState                                              Enable CheckState plugin                                                             ✔
+checkStateSecret                                        Secret token for CheckState plugin                                                   ✔
 checkTime                                               Timeout to check new configuration in local cache                                    ✔      ✔               ✔
-checkUser                                               Enable check user                                                                    ✔                     
-checkUserDisplayEmptyHeaders                            Display empty headers rule                                                           ✔                     
-checkUserDisplayEmptyValues                             Display session empty values rule                                                    ✔                     
-checkUserDisplayPersistentInfo                          Display persistent session info rule                                                 ✔                     
-checkUserHiddenAttributes                               Attributes to hide in CheckUser plugin                                               ✔                     
-checkUserIdRule                                         checkUser identities rule                                                            ✔                     
-checkUserSearchAttributes                               Attributes used for retrieving sessions in user DataBase                             ✔                     
-checkXSS                                                Check XSS                                                                            ✔                     
-combModules                                             Combination module description                                                       ✔                     
-combination                                             Combination rule                                                                     ✔                     
-compactConf                                             Compact configuration                                                                ✔                     
+checkUser                                               Enable check user                                                                    ✔
+checkUserDisplayEmptyHeaders                            Display empty headers rule                                                           ✔
+checkUserDisplayEmptyValues                             Display session empty values rule                                                    ✔
+checkUserDisplayPersistentInfo                          Display persistent session info rule                                                 ✔
+checkUserHiddenAttributes                               Attributes to hide in CheckUser plugin                                               ✔
+checkUserIdRule                                         checkUser identities rule                                                            ✔
+checkUserSearchAttributes                               Attributes used for retrieving sessions in user DataBase                             ✔
+checkXSS                                                Check XSS                                                                            ✔
+combModules                                             Combination module description                                                       ✔
+combination                                             Combination rule                                                                     ✔
+compactConf                                             Compact configuration                                                                ✔
 configStorage                                           Configuration storage                                                                ✔      ✔       ✔       ✔
-confirmFormMethod                                       HTTP method for confirm page form                                                    ✔                     
-contextSwitchingIdRule                                  Context switching identities rule                                                    ✔                     
+confirmFormMethod                                       HTTP method for confirm page form                                                    ✔
+contextSwitchingIdRule                                  Context switching identities rule                                                    ✔
 contextSwitchingPrefix                                  Prefix to store real session Id                                                      ✔                      ✔
-contextSwitchingRule                                    Context switching activation rule                                                    ✔                     
-contextSwitchingStopWithLogout                          Stop context switching by logout                                                     ✔                     
-cookieExpiration                                        Cookie expiration                                                                    ✔      ✔              
-cookieName                                              Name of the main cookie                                                              ✔      ✔              
-corsAllow_Credentials                                   Allow credentials for Cross-Origin Resource Sharing                                  ✔                     
-corsAllow_Headers                                       Allowed headers for Cross-Origin Resource Sharing                                    ✔                     
-corsAllow_Methods                                       Allowed methods for Cross-Origin Resource Sharing                                    ✔                     
-corsAllow_Origin                                        Allowed origine for Cross-Origin Resource Sharing                                    ✔                     
-corsEnabled                                             Enable Cross-Origin Resource Sharing                                                 ✔                     
-corsExpose_Headers                                      Exposed headers for Cross-Origin Resource Sharing                                    ✔                     
-corsMax_Age                                             MAx-age for Cross-Origin Resource Sharing                                            ✔                     
-cspConnect                                              Authorized Ajax destination for Content-Security-Policy                              ✔                     
-cspDefault                                              Default value for Content-Security-Policy                                            ✔                     
-cspFont                                                 Font source for Content-Security-Policy                                              ✔                     
-cspFormAction                                           Form action destination for Content-Security-Policy                                  ✔                     
-cspFrameAncestors                                       Frame-Ancestors for Content-Security-Policy                                          ✔                     
-cspImg                                                  Image source for Content-Security-Policy                                             ✔                     
-cspScript                                               Javascript source for Content-Security-Policy                                        ✔                     
-cspStyle                                                Style source for Content-Security-Policy                                             ✔                     
-customAddParams                                         Custom additional parameters                                                         ✔                     
-customAuth                                              Custom auth module                                                                   ✔                     
-customFunctions                                         List of custom functions                                                             ✔      ✔       ✔      
-customPassword                                          Custom password module                                                               ✔                     
-customPlugins                                           Custom plugins                                                                       ✔                     
-customPluginsParams                                     Custom plugins parameters                                                            ✔                     
-customRegister                                          Custom register module                                                               ✔                     
-customResetCertByMail                                   Custom certificateResetByMail module                                                 ✔                     
-customToTrace                                           Session parameter used to fill REMOTE_CUSTOM                                         ✔      ✔              
-customUserDB                                            Custom user DB module                                                                ✔                     
-dbiAuthChain                                                                                                                                 ✔                     
-dbiAuthLoginCol                                                                                                                              ✔                     
-dbiAuthPassword                                                                                                                              ✔                     
-dbiAuthPasswordCol                                                                                                                           ✔                     
-dbiAuthPasswordHash                                                                                                                          ✔                     
-dbiAuthTable                                                                                                                                 ✔                     
-dbiAuthUser                                                                                                                                  ✔                     
-dbiAuthnLevel                                           DBI authentication level                                                             ✔                     
-dbiDynamicHashEnabled                                                                                                                        ✔                     
-dbiDynamicHashNewPasswordScheme                                                                                                              ✔                     
-dbiDynamicHashValidSaltedSchemes                                                                                                             ✔                     
-dbiDynamicHashValidSchemes                                                                                                                   ✔                     
-dbiExportedVars                                         DBI exported variables                                                               ✔                     
-dbiPasswordMailCol                                                                                                                           ✔                     
-dbiUserChain                                                                                                                                 ✔                     
-dbiUserPassword                                                                                                                              ✔                     
-dbiUserTable                                                                                                                                 ✔                     
-dbiUserUser                                                                                                                                  ✔                     
-decryptValueFunctions                                   Custom function used for decrypting values                                           ✔                     
-decryptValueRule                                        Decrypt value activation rule                                                        ✔                     
-demoExportedVars                                        Demo exported variables                                                              ✔                     
-disablePersistentStorage                                Enabled persistent storage                                                           ✔                     
-domain                                                  DNS domain                                                                           ✔      ✔              
-exportedAttr                                            List of attributes to export by SOAP or REST servers                                 ✔                     
-exportedVars                                            Main exported variables                                                              ✔                     
-ext2FSendCommand                                        Send command of External second factor                                               ✔                     
-ext2FValidateCommand                                    Validation command of External second factor                                         ✔                     
-ext2fActivation                                         External second factor activation                                                    ✔                     
-ext2fAuthnLevel                                         Authentication level for users authentified by External second factor                ✔                     
-ext2fCodeActivation                                     OTP generated by Portal                                                              ✔                     
-ext2fLabel                                              Portal label for External second factor                                              ✔                     
-ext2fLogo                                               Custom logo for External 2F                                                          ✔                     
-facebookAppId                                                                                                                                ✔                     
-facebookAppSecret                                                                                                                            ✔                     
-facebookAuthnLevel                                      Facebook authentication level                                                        ✔                     
-facebookExportedVars                                    Facebook exported variables                                                          ✔                     
-facebookUserField                                                                                                                            ✔                     
-failedLoginNumber                                       Number of failures stored in login history                                           ✔                     
+contextSwitchingRule                                    Context switching activation rule                                                    ✔
+contextSwitchingStopWithLogout                          Stop context switching by logout                                                     ✔
+cookieExpiration                                        Cookie expiration                                                                    ✔      ✔
+cookieName                                              Name of the main cookie                                                              ✔      ✔
+corsAllow_Credentials                                   Allow credentials for Cross-Origin Resource Sharing                                  ✔
+corsAllow_Headers                                       Allowed headers for Cross-Origin Resource Sharing                                    ✔
+corsAllow_Methods                                       Allowed methods for Cross-Origin Resource Sharing                                    ✔
+corsAllow_Origin                                        Allowed origine for Cross-Origin Resource Sharing                                    ✔
+corsEnabled                                             Enable Cross-Origin Resource Sharing                                                 ✔
+corsExpose_Headers                                      Exposed headers for Cross-Origin Resource Sharing                                    ✔
+corsMax_Age                                             MAx-age for Cross-Origin Resource Sharing                                            ✔
+cspConnect                                              Authorized Ajax destination for Content-Security-Policy                              ✔
+cspDefault                                              Default value for Content-Security-Policy                                            ✔
+cspFont                                                 Font source for Content-Security-Policy                                              ✔
+cspFormAction                                           Form action destination for Content-Security-Policy                                  ✔
+cspFrameAncestors                                       Frame-Ancestors for Content-Security-Policy                                          ✔
+cspImg                                                  Image source for Content-Security-Policy                                             ✔
+cspScript                                               Javascript source for Content-Security-Policy                                        ✔
+cspStyle                                                Style source for Content-Security-Policy                                             ✔
+customAddParams                                         Custom additional parameters                                                         ✔
+customAuth                                              Custom auth module                                                                   ✔
+customFunctions                                         List of custom functions                                                             ✔      ✔       ✔
+customPassword                                          Custom password module                                                               ✔
+customPlugins                                           Custom plugins                                                                       ✔
+customPluginsParams                                     Custom plugins parameters                                                            ✔
+customRegister                                          Custom register module                                                               ✔
+customResetCertByMail                                   Custom certificateResetByMail module                                                 ✔
+customToTrace                                           Session parameter used to fill REMOTE_CUSTOM                                         ✔      ✔
+customUserDB                                            Custom user DB module                                                                ✔
+dbiAuthChain                                                                                                                                 ✔
+dbiAuthLoginCol                                                                                                                              ✔
+dbiAuthPassword                                                                                                                              ✔
+dbiAuthPasswordCol                                                                                                                           ✔
+dbiAuthPasswordHash                                                                                                                          ✔
+dbiAuthTable                                                                                                                                 ✔
+dbiAuthUser                                                                                                                                  ✔
+dbiAuthnLevel                                           DBI authentication level                                                             ✔
+dbiDynamicHashEnabled                                                                                                                        ✔
+dbiDynamicHashNewPasswordScheme                                                                                                              ✔
+dbiDynamicHashValidSaltedSchemes                                                                                                             ✔
+dbiDynamicHashValidSchemes                                                                                                                   ✔
+dbiExportedVars                                         DBI exported variables                                                               ✔
+dbiPasswordMailCol                                                                                                                           ✔
+dbiUserChain                                                                                                                                 ✔
+dbiUserPassword                                                                                                                              ✔
+dbiUserTable                                                                                                                                 ✔
+dbiUserUser                                                                                                                                  ✔
+decryptValueFunctions                                   Custom function used for decrypting values                                           ✔
+decryptValueRule                                        Decrypt value activation rule                                                        ✔
+demoExportedVars                                        Demo exported variables                                                              ✔
+disablePersistentStorage                                Enabled persistent storage                                                           ✔
+domain                                                  DNS domain                                                                           ✔      ✔
+exportedAttr                                            List of attributes to export by SOAP or REST servers                                 ✔
+exportedVars                                            Main exported variables                                                              ✔
+ext2FSendCommand                                        Send command of External second factor                                               ✔
+ext2FValidateCommand                                    Validation command of External second factor                                         ✔
+ext2fActivation                                         External second factor activation                                                    ✔
+ext2fAuthnLevel                                         Authentication level for users authentified by External second factor                ✔
+ext2fCodeActivation                                     OTP generated by Portal                                                              ✔
+ext2fLabel                                              Portal label for External second factor                                              ✔
+ext2fLogo                                               Custom logo for External 2F                                                          ✔
+facebookAppId                                                                                                                                ✔
+facebookAppSecret                                                                                                                            ✔
+facebookAuthnLevel                                      Facebook authentication level                                                        ✔
+facebookExportedVars                                    Facebook exported variables                                                          ✔
+facebookUserField                                                                                                                            ✔
+failedLoginNumber                                       Number of failures stored in login history                                           ✔
 forceGlobalStorageIssuerOTT                             Force Issuer tokens to be stored into Global Storage                                 ✔                      ✔
 forceGlobalStorageUpgradeOTT                            Force Upgrade tokens be stored into Global Storage                                   ✔                      ✔
-formTimeout                                             Token timeout for forms                                                              ✔                     
-githubAuthnLevel                                        GitHub authentication level                                                          ✔                     
-githubClientID                                                                                                                               ✔                     
-githubClientSecret                                                                                                                           ✔                     
-githubScope                                                                                                                                  ✔                     
-githubUserField                                                                                                                              ✔                     
-globalLogoutCustomParam                                 Custom session parameter to display                                                  ✔                     
-globalLogoutRule                                        Global logout activation rule                                                        ✔                     
-globalLogoutTimer                                       Global logout auto accept time                                                       ✔                     
-globalStorage                                           Session backend module                                                               ✔      ✔              
-globalStorageOptions                                    Session backend module options                                                       ✔      ✔              
-gpgAuthnLevel                                           GPG authentication level                                                             ✔                     
-gpgDb                                                   GPG keys database                                                                    ✔                     
-grantSessionRules                                       Rules to grant sessions                                                              ✔                     
-groups                                                  Groups                                                                               ✔                     
-groupsBeforeMacros                                      Compute groups before macros                                                         ✔                     
+formTimeout                                             Token timeout for forms                                                              ✔
+githubAuthnLevel                                        GitHub authentication level                                                          ✔
+githubClientID                                                                                                                               ✔
+githubClientSecret                                                                                                                           ✔
+githubScope                                                                                                                                  ✔
+githubUserField                                                                                                                              ✔
+globalLogoutCustomParam                                 Custom session parameter to display                                                  ✔
+globalLogoutRule                                        Global logout activation rule                                                        ✔
+globalLogoutTimer                                       Global logout auto accept time                                                       ✔
+globalStorage                                           Session backend module                                                               ✔      ✔
+globalStorageOptions                                    Session backend module options                                                       ✔      ✔
+gpgAuthnLevel                                           GPG authentication level                                                             ✔
+gpgDb                                                   GPG keys database                                                                    ✔
+grantSessionRules                                       Rules to grant sessions                                                              ✔
+groups                                                  Groups                                                                               ✔
+groupsBeforeMacros                                      Compute groups before macros                                                         ✔
 handlerInternalCache                                    Handler internal cache timeout                                                       ✔      ✔               ✔
 handlerServiceTokenTTL                                  Handler ServiceToken timeout                                                         ✔      ✔               ✔
-hiddenAttributes                                        Name of attributes to hide in logs                                                   ✔                     
-hideOldPassword                                         Hide old password in portal                                                          ✔                     
-httpOnly                                                Enable httpOnly flag in cookie                                                       ✔      ✔              
-https                                                   Use HTTPS for redirection from portal                                                       ✔              
-impersonationHiddenAttributes                           Attributes to skip                                                                   ✔                     
-impersonationIdRule                                     Impersonation identities rule                                                        ✔                     
-impersonationMergeSSOgroups                             Merge spoofed and real SSO groups                                                    ✔                     
+hiddenAttributes                                        Name of attributes to hide in logs                                                   ✔
+hideOldPassword                                         Hide old password in portal                                                          ✔
+httpOnly                                                Enable httpOnly flag in cookie                                                       ✔      ✔
+https                                                   Use HTTPS for redirection from portal                                                       ✔
+impersonationHiddenAttributes                           Attributes to skip                                                                   ✔
+impersonationIdRule                                     Impersonation identities rule                                                        ✔
+impersonationMergeSSOgroups                             Merge spoofed and real SSO groups                                                    ✔
 impersonationPrefix                                     Prefix to rename real session attributes                                             ✔                      ✔
-impersonationRule                                       Impersonation activation rule                                                        ✔                     
-impersonationSkipEmptyValues                            Skip session empty values                                                            ✔                     
-infoFormMethod                                          HTTP method for info page form                                                       ✔                     
-issuerDBCASActivation                                   CAS server activation                                                                ✔                     
-issuerDBCASPath                                         CAS server request path                                                              ✔                     
-issuerDBCASRule                                         CAS server rule                                                                      ✔                     
-issuerDBGetActivation                                   Get issuer activation                                                                ✔                     
-issuerDBGetParameters                                   List of virtualHosts with their get parameters                                       ✔                     
-issuerDBGetPath                                         Get issuer request path                                                              ✔                     
-issuerDBGetRule                                         Get issuer rule                                                                      ✔                     
-issuerDBOpenIDActivation                                OpenID server activation                                                             ✔                     
-issuerDBOpenIDConnectActivation                         OpenID Connect server activation                                                     ✔                     
-issuerDBOpenIDConnectPath                               OpenID Connect server request path                                                   ✔                     
-issuerDBOpenIDConnectRule                               OpenID Connect server rule                                                           ✔                     
-issuerDBOpenIDPath                                      OpenID server request path                                                           ✔                     
-issuerDBOpenIDRule                                      OpenID server rule                                                                   ✔                     
-issuerDBSAMLActivation                                  SAML IDP activation                                                                  ✔                     
-issuerDBSAMLPath                                        SAML IDP request path                                                                ✔                     
-issuerDBSAMLRule                                        SAML IDP rule                                                                        ✔                     
-issuersTimeout                                          Token timeout for issuers                                                            ✔                     
-jsRedirect                                              Use javascript for redirections                                                      ✔                     
-key                                                     Secret key                                                                           ✔                     
-krbAuthnLevel                                           Null authentication level                                                            ✔                     
-krbByJs                                                 Launch Kerberos authentication by Ajax                                               ✔                     
-krbKeytab                                               Kerberos keytab                                                                      ✔                     
-krbRemoveDomain                                         Remove domain in Kerberos username                                                   ✔                     
-ldapAllowResetExpiredPassword                           Allow a user to reset his expired password                                           ✔                     
-ldapAuthnLevel                                          LDAP authentication level                                                            ✔                     
-ldapBase                                                LDAP search base                                                                     ✔                     
-ldapChangePasswordAsUser                                                                                                                     ✔                     
-ldapExportedVars                                        LDAP exported variables                                                              ✔                     
-ldapGroupAttributeName                                  LDAP attribute name for member in groups                                             ✔                     
-ldapGroupAttributeNameGroup                             LDAP attribute name in group entry referenced as member in groups                    ✔                     
-ldapGroupAttributeNameSearch                            LDAP attributes to search in groups                                                  ✔                     
-ldapGroupAttributeNameUser                              LDAP attribute name in user entry referenced as member in groups                     ✔                     
-ldapGroupBase                                                                                                                                ✔                     
-ldapGroupDecodeSearchedValue                            Decode value before searching it in LDAP groups                                      ✔                     
-ldapGroupObjectClass                                    LDAP object class of groups                                                          ✔                     
-ldapGroupRecursive                                      LDAP recursive search in groups                                                      ✔                     
-ldapITDS                                                Support for IBM Tivoli Directory Server                                              ✔                     
-ldapPasswordResetAttribute                              LDAP password reset attribute                                                        ✔                     
-ldapPasswordResetAttributeValue                         LDAP password reset value                                                            ✔                     
-ldapPort                                                LDAP port                                                                            ✔                     
-ldapPpolicyControl                                                                                                                           ✔                     
-ldapPwdEnc                                              LDAP password encoding                                                               ✔                     
-ldapRaw                                                                                                                                      ✔                     
-ldapSearchDeref                                         "deref" param of Net::LDAP::search ()                        ✔                     
-ldapServer                                              LDAP server (host or URI)                                                            ✔                     
-ldapSetPassword                                                                                                                              ✔                     
-ldapTimeout                                             LDAP connection timeout                                                              ✔                     
-ldapUsePasswordResetAttribute                           LDAP store reset flag in an attribute                                                ✔                     
-ldapVersion                                             LDAP protocol version                                                                ✔                     
-linkedInAuthnLevel                                      LinkedIn authentication level                                                        ✔                     
-linkedInClientID                                                                                                                             ✔                     
-linkedInClientSecret                                                                                                                         ✔                     
-linkedInFields                                                                                                                               ✔                     
-linkedInScope                                                                                                                                ✔                     
-linkedInUserField                                                                                                                            ✔                     
-localSessionStorage                                     Local sessions cache module                                                          ✔                     
-localSessionStorageOptions                              Sessions cache module options                                                        ✔                     
+impersonationRule                                       Impersonation activation rule                                                        ✔
+impersonationSkipEmptyValues                            Skip session empty values                                                            ✔
+infoFormMethod                                          HTTP method for info page form                                                       ✔
+issuerDBCASActivation                                   CAS server activation                                                                ✔
+issuerDBCASPath                                         CAS server request path                                                              ✔
+issuerDBCASRule                                         CAS server rule                                                                      ✔
+issuerDBGetActivation                                   Get issuer activation                                                                ✔
+issuerDBGetParameters                                   List of virtualHosts with their get parameters                                       ✔
+issuerDBGetPath                                         Get issuer request path                                                              ✔
+issuerDBGetRule                                         Get issuer rule                                                                      ✔
+issuerDBOpenIDActivation                                OpenID server activation                                                             ✔
+issuerDBOpenIDConnectActivation                         OpenID Connect server activation                                                     ✔
+issuerDBOpenIDConnectPath                               OpenID Connect server request path                                                   ✔
+issuerDBOpenIDConnectRule                               OpenID Connect server rule                                                           ✔
+issuerDBOpenIDPath                                      OpenID server request path                                                           ✔
+issuerDBOpenIDRule                                      OpenID server rule                                                                   ✔
+issuerDBSAMLActivation                                  SAML IDP activation                                                                  ✔
+issuerDBSAMLPath                                        SAML IDP request path                                                                ✔
+issuerDBSAMLRule                                        SAML IDP rule                                                                        ✔
+issuersTimeout                                          Token timeout for issuers                                                            ✔
+jsRedirect                                              Use javascript for redirections                                                      ✔
+key                                                     Secret key                                                                           ✔
+krbAuthnLevel                                           Null authentication level                                                            ✔
+krbByJs                                                 Launch Kerberos authentication by Ajax                                               ✔
+krbKeytab                                               Kerberos keytab                                                                      ✔
+krbRemoveDomain                                         Remove domain in Kerberos username                                                   ✔
+ldapAllowResetExpiredPassword                           Allow a user to reset his expired password                                           ✔
+ldapAuthnLevel                                          LDAP authentication level                                                            ✔
+ldapBase                                                LDAP search base                                                                     ✔
+ldapChangePasswordAsUser                                                                                                                     ✔
+ldapExportedVars                                        LDAP exported variables                                                              ✔
+ldapGroupAttributeName                                  LDAP attribute name for member in groups                                             ✔
+ldapGroupAttributeNameGroup                             LDAP attribute name in group entry referenced as member in groups                    ✔
+ldapGroupAttributeNameSearch                            LDAP attributes to search in groups                                                  ✔
+ldapGroupAttributeNameUser                              LDAP attribute name in user entry referenced as member in groups                     ✔
+ldapGroupBase                                                                                                                                ✔
+ldapGroupDecodeSearchedValue                            Decode value before searching it in LDAP groups                                      ✔
+ldapGroupObjectClass                                    LDAP object class of groups                                                          ✔
+ldapGroupRecursive                                      LDAP recursive search in groups                                                      ✔
+ldapITDS                                                Support for IBM Tivoli Directory Server                                              ✔
+ldapPasswordResetAttribute                              LDAP password reset attribute                                                        ✔
+ldapPasswordResetAttributeValue                         LDAP password reset value                                                            ✔
+ldapPort                                                LDAP port                                                                            ✔
+ldapPpolicyControl                                                                                                                           ✔
+ldapPwdEnc                                              LDAP password encoding                                                               ✔
+ldapRaw                                                                                                                                      ✔
+ldapSearchDeref                                         "deref" param of Net::LDAP::search ()                        ✔
+ldapServer                                              LDAP server (host or URI)                                                            ✔
+ldapSetPassword                                                                                                                              ✔
+ldapTimeout                                             LDAP connection timeout                                                              ✔
+ldapUsePasswordResetAttribute                           LDAP store reset flag in an attribute                                                ✔
+ldapVersion                                             LDAP protocol version                                                                ✔
+linkedInAuthnLevel                                      LinkedIn authentication level                                                        ✔
+linkedInClientID                                                                                                                             ✔
+linkedInClientSecret                                                                                                                         ✔
+linkedInFields                                                                                                                               ✔
+linkedInScope                                                                                                                                ✔
+linkedInUserField                                                                                                                            ✔
+localSessionStorage                                     Local sessions cache module                                                          ✔
+localSessionStorageOptions                              Sessions cache module options                                                        ✔
 localStorage                                            Local cache                                                                          ✔      ✔       ✔       ✔
 localStorageOptions                                     Local cache parameters                                                               ✔      ✔       ✔       ✔
 log4perlConfFile                                        Log4Perl logger configuration file                                                   ✔      ✔       ✔       ✔
 logLevel                                                Log level, must be set in .ini                                                       ✔      ✔       ✔       ✔
 logger                                                  technical logger                                                                     ✔      ✔       ✔       ✔
-loginHistoryEnabled                                     Enable login history                                                                 ✔                     
-logoutServices                                          Send logout trough GET request to these services                                     ✔                     
-lwpOpts                                                 Options given to LWP::UserAgent                                                      ✔                     
-lwpSslOpts                                              SSL options given to LWP::UserAgent                                                  ✔                     
-macros                                                  Macros                                                                               ✔                     
-mail2fActivation                                        Mail second factor activation                                                        ✔                     
-mail2fAuthnLevel                                        Authentication level for users authenticated by Mail second factor                   ✔                     
-mail2fBody                                              Mail body for second factor authentication                                           ✔                     
-mail2fCodeRegex                                         Regular expression to create a mail OTP code                                         ✔                     
-mail2fLabel                                             Portal label for Mail second factor                                                  ✔                     
-mail2fLogo                                              Custom logo for Mail 2F                                                              ✔                     
-mail2fSubject                                           Mail subject for second factor authentication                                        ✔                     
-mail2fTimeout                                           Second factor code timeout                                                           ✔                     
-mailBody                                                Custom password reset mail body                                                      ✔                     
-mailCharset                                             Mail charset                                                                         ✔                     
-mailConfirmBody                                         Custom confirm password reset mail body                                              ✔                     
-mailConfirmSubject                                      Mail subject for reset confirmation                                                  ✔                     
-mailFrom                                                Sender email                                                                         ✔                     
-mailLDAPFilter                                          LDAP filter for mail search                                                          ✔                     
-mailOnPasswordChange                                    Send a mail when password is changed                                                 ✔                     
-mailReplyTo                                             Reply-To address                                                                     ✔                     
-mailSessionKey                                          Session parameter where mail is stored                                               ✔                     
-mailSubject                                             Mail subject for new password email                                                  ✔                     
-mailTimeout                                             Mail password reset session timeout                                                  ✔                     
-mailUrl                                                 URL of password reset page                                                           ✔                     
-maintenance                                             Maintenance mode for all virtual hosts                                                      ✔              
-managerDn                                               LDAP manager DN                                                                      ✔                     
-managerPassword                                         LDAP manager Password                                                                ✔                     
+loginHistoryEnabled                                     Enable login history                                                                 ✔
+logoutServices                                          Send logout trough GET request to these services                                     ✔
+lwpOpts                                                 Options given to LWP::UserAgent                                                      ✔
+lwpSslOpts                                              SSL options given to LWP::UserAgent                                                  ✔
+macros                                                  Macros                                                                               ✔
+mail2fActivation                                        Mail second factor activation                                                        ✔
+mail2fAuthnLevel                                        Authentication level for users authenticated by Mail second factor                   ✔
+mail2fBody                                              Mail body for second factor authentication                                           ✔
+mail2fCodeRegex                                         Regular expression to create a mail OTP code                                         ✔
+mail2fLabel                                             Portal label for Mail second factor                                                  ✔
+mail2fLogo                                              Custom logo for Mail 2F                                                              ✔
+mail2fSubject                                           Mail subject for second factor authentication                                        ✔
+mail2fTimeout                                           Second factor code timeout                                                           ✔
+mailBody                                                Custom password reset mail body                                                      ✔
+mailCharset                                             Mail charset                                                                         ✔
+mailConfirmBody                                         Custom confirm password reset mail body                                              ✔
+mailConfirmSubject                                      Mail subject for reset confirmation                                                  ✔
+mailFrom                                                Sender email                                                                         ✔
+mailLDAPFilter                                          LDAP filter for mail search                                                          ✔
+mailOnPasswordChange                                    Send a mail when password is changed                                                 ✔
+mailReplyTo                                             Reply-To address                                                                     ✔
+mailSessionKey                                          Session parameter where mail is stored                                               ✔
+mailSubject                                             Mail subject for new password email                                                  ✔
+mailTimeout                                             Mail password reset session timeout                                                  ✔
+mailUrl                                                 URL of password reset page                                                           ✔
+maintenance                                             Maintenance mode for all virtual hosts                                                      ✔
+managerDn                                               LDAP manager DN                                                                      ✔
+managerPassword                                         LDAP manager Password                                                                ✔
 max2FDevices                                            Maximum registered 2F devices                                                        ✔                      ✔
 max2FDevicesNameLength                                  Maximum 2F devices name length                                                       ✔                      ✔
-multiValuesSeparator                                    Separator for multiple values                                                        ✔      ✔       ✔      
+multiValuesSeparator                                    Separator for multiple values                                                        ✔      ✔       ✔
 mySessionAuthorizedRWKeys                               Alterable session keys by user itself                                                ✔                      ✔
-nginxCustomHandlers                                     Custom Nginx handler (deprecated)                                                    ✔                     
-noAjaxHook                                              Avoid replacing 302 by 401 for Ajax responses                                        ✔                     
-notification                                            Notification activation                                                              ✔                     
-notificationDefaultCond                                 Notification default condition                                                       ✔                     
-notificationServer                                      Notification server activation                                                       ✔                     
-notificationServerDELETE                                Notification server activation                                                       ✔                     
-notificationServerGET                                   Notification server activation                                                       ✔                     
-notificationServerPOST                                  Notification server activation                                                       ✔                     
-notificationServerSentAttributes                        Prameters to send with notification server GET method                                ✔                     
-notificationStorage                                     Notification backend                                                                 ✔                     
-notificationStorageOptions                              Notification backend options                                                         ✔                     
-notificationWildcard                                    Notification string to match all users                                               ✔                     
-notificationXSLTfile                                    Custom XSLT document for notifications                                               ✔                     
-notificationsExplorer                                   Notifications explorer activation                                                    ✔                     
+nginxCustomHandlers                                     Custom Nginx handler (deprecated)                                                    ✔
+noAjaxHook                                              Avoid replacing 302 by 401 for Ajax responses                                        ✔
+notification                                            Notification activation                                                              ✔
+notificationDefaultCond                                 Notification default condition                                                       ✔
+notificationServer                                      Notification server activation                                                       ✔
+notificationServerDELETE                                Notification server activation                                                       ✔
+notificationServerGET                                   Notification server activation                                                       ✔
+notificationServerPOST                                  Notification server activation                                                       ✔
+notificationServerSentAttributes                        Prameters to send with notification server GET method                                ✔
+notificationStorage                                     Notification backend                                                                 ✔
+notificationStorageOptions                              Notification backend options                                                         ✔
+notificationWildcard                                    Notification string to match all users                                               ✔
+notificationXSLTfile                                    Custom XSLT document for notifications                                               ✔
+notificationsExplorer                                   Notifications explorer activation                                                    ✔
 notificationsMaxRetrieve                                Max number of displayed notifications                                                ✔                      ✔
-notifyDeleted                                           Show deleted sessions in portal                                                      ✔                     
-notifyOther                                             Show other sessions in portal                                                        ✔                     
-nullAuthnLevel                                          Null authentication level                                                            ✔                     
-oidcAuthnLevel                                          OpenID Connect authentication level                                                  ✔                     
+notifyDeleted                                           Show deleted sessions in portal                                                      ✔
+notifyOther                                             Show other sessions in portal                                                        ✔
+nullAuthnLevel                                          Null authentication level                                                            ✔
+oidcAuthnLevel                                          OpenID Connect authentication level                                                  ✔
 oidcOPMetaDataOptions                                                                                                                        ✔                      [1]
-oidcRPCallbackGetParam                                  OpenID Connect Callback GET URLparameter                                             ✔                     
+oidcRPCallbackGetParam                                  OpenID Connect Callback GET URLparameter                                             ✔
 oidcRPMetaDataOptions                                                                                                                        ✔                      [1]
-oidcRPStateTimeout                                      OpenID Connect Timeout of state sessions                                             ✔                     
-oidcServiceAccessTokenExpiration                        OpenID Connect global access token TTL                                               ✔                     
-oidcServiceAllowAuthorizationCodeFlow                   OpenID Connect allow authorization code flow                                         ✔                     
-oidcServiceAllowDynamicRegistration                     OpenID Connect allow dynamic client registration                                     ✔                     
-oidcServiceAllowHybridFlow                              OpenID Connect allow hybrid flow                                                     ✔                     
-oidcServiceAllowImplicitFlow                            OpenID Connect allow implicit flow                                                   ✔                     
-oidcServiceAuthorizationCodeExpiration                  OpenID Connect global code TTL                                                       ✔                     
-oidcServiceDynamicRegistrationExportedVars              OpenID Connect exported variables for dynamic registration                           ✔                     
-oidcServiceDynamicRegistrationExtraClaims               OpenID Connect extra claims for dynamic registration                                 ✔                     
-oidcServiceIDTokenExpiration                            OpenID Connect global ID token TTL                                                   ✔                     
-oidcServiceKeyIdSig                                     OpenID Connect Signature Key ID                                                      ✔                     
-oidcServiceMetaDataAuthnContext                         OpenID Connect Authentication Context Class Ref                                      ✔                     
-oidcServiceMetaDataAuthorizeURI                         OpenID Connect authorizaton endpoint                                                 ✔                     
-oidcServiceMetaDataBackChannelURI                       OpenID Connect Front-Channel logout endpoint                                         ✔                     
-oidcServiceMetaDataCheckSessionURI                      OpenID Connect check session iframe                                                  ✔                     
-oidcServiceMetaDataEndSessionURI                        OpenID Connect end session endpoint                                                  ✔                     
-oidcServiceMetaDataFrontChannelURI                      OpenID Connect Front-Channel logout endpoint                                         ✔                     
-oidcServiceMetaDataIntrospectionURI                     OpenID Connect introspection endpoint                                                ✔                     
-oidcServiceMetaDataIssuer                               OpenID Connect issuer                                                                ✔                     
-oidcServiceMetaDataJWKSURI                              OpenID Connect JWKS endpoint                                                         ✔                     
-oidcServiceMetaDataRegistrationURI                      OpenID Connect registration endpoint                                                 ✔                     
-oidcServiceMetaDataTokenURI                             OpenID Connect token endpoint                                                        ✔                     
-oidcServiceMetaDataUserInfoURI                          OpenID Connect user info endpoint                                                    ✔                     
-oidcServiceOfflineSessionExpiration                     OpenID Connect global offline session TTL                                            ✔                     
-oidcServicePrivateKeySig                                                                                                                     ✔                     
-oidcServicePublicKeySig                                                                                                                      ✔                     
-oidcStorage                                             Apache::Session module to store OIDC user data                                       ✔                     
-oidcStorageOptions                                      Apache::Session module parameters                                                    ✔                     
-oldNotifFormat                                          Use old XML format for notifications                                                 ✔                     
-openIdAttr                                                                                                                                   ✔                     
-openIdAuthnLevel                                        OpenID authentication level                                                          ✔                     
-openIdExportedVars                                      OpenID exported variables                                                            ✔                     
-openIdIDPList                                                                                                                                ✔                     
-openIdIssuerSecret                                                                                                                           ✔                     
-openIdSPList                                                                                                                                 ✔                     
-openIdSecret                                                                                                                                 ✔                     
-openIdSreg_country                                                                                                                           ✔                     
-openIdSreg_dob                                                                                                                               ✔                     
-openIdSreg_email                                        OpenID SREG email session parameter                                                  ✔                     
-openIdSreg_fullname                                     OpenID SREG fullname session parameter                                               ✔                     
-openIdSreg_gender                                                                                                                            ✔                     
-openIdSreg_language                                                                                                                          ✔                     
-openIdSreg_nickname                                     OpenID SREG nickname session parameter                                               ✔                     
-openIdSreg_postcode                                                                                                                          ✔                     
-openIdSreg_timezone                                     OpenID SREG timezone session parameter                                               ✔                     
-pamAuthnLevel                                           PAM authentication level                                                             ✔                     
-pamService                                              PAM service                                                                          ✔                     
-passwordDB                                              Password module                                                                      ✔                     
-passwordPolicyMinDigit                                  Password policy: minimal digit characters                                            ✔                     
-passwordPolicyMinLower                                  Password policy: minimal lower characters                                            ✔                     
-passwordPolicyMinSize                                   Password policy: minimal size                                                        ✔                     
-passwordPolicyMinSpeChar                                Password policy: minimal special characters                                          ✔                     
-passwordPolicyMinUpper                                  Password policy: minimal upper characters                                            ✔                     
-passwordPolicySpecialChar                               Password policy: allowed special characters                                          ✔                     
-passwordResetAllowedRetries                             Maximum number of retries to reset password                                          ✔                     
+oidcRPStateTimeout                                      OpenID Connect Timeout of state sessions                                             ✔
+oidcServiceAccessTokenExpiration                        OpenID Connect global access token TTL                                               ✔
+oidcServiceAllowAuthorizationCodeFlow                   OpenID Connect allow authorization code flow                                         ✔
+oidcServiceAllowDynamicRegistration                     OpenID Connect allow dynamic client registration                                     ✔
+oidcServiceAllowHybridFlow                              OpenID Connect allow hybrid flow                                                     ✔
+oidcServiceAllowImplicitFlow                            OpenID Connect allow implicit flow                                                   ✔
+oidcServiceAuthorizationCodeExpiration                  OpenID Connect global code TTL                                                       ✔
+oidcServiceDynamicRegistrationExportedVars              OpenID Connect exported variables for dynamic registration                           ✔
+oidcServiceDynamicRegistrationExtraClaims               OpenID Connect extra claims for dynamic registration                                 ✔
+oidcServiceIDTokenExpiration                            OpenID Connect global ID token TTL                                                   ✔
+oidcServiceKeyIdSig                                     OpenID Connect Signature Key ID                                                      ✔
+oidcServiceMetaDataAuthnContext                         OpenID Connect Authentication Context Class Ref                                      ✔
+oidcServiceMetaDataAuthorizeURI                         OpenID Connect authorizaton endpoint                                                 ✔
+oidcServiceMetaDataBackChannelURI                       OpenID Connect Front-Channel logout endpoint                                         ✔
+oidcServiceMetaDataCheckSessionURI                      OpenID Connect check session iframe                                                  ✔
+oidcServiceMetaDataEndSessionURI                        OpenID Connect end session endpoint                                                  ✔
+oidcServiceMetaDataFrontChannelURI                      OpenID Connect Front-Channel logout endpoint                                         ✔
+oidcServiceMetaDataIntrospectionURI                     OpenID Connect introspection endpoint                                                ✔
+oidcServiceMetaDataIssuer                               OpenID Connect issuer                                                                ✔
+oidcServiceMetaDataJWKSURI                              OpenID Connect JWKS endpoint                                                         ✔
+oidcServiceMetaDataRegistrationURI                      OpenID Connect registration endpoint                                                 ✔
+oidcServiceMetaDataTokenURI                             OpenID Connect token endpoint                                                        ✔
+oidcServiceMetaDataUserInfoURI                          OpenID Connect user info endpoint                                                    ✔
+oidcServiceOfflineSessionExpiration                     OpenID Connect global offline session TTL                                            ✔
+oidcServicePrivateKeySig                                                                                                                     ✔
+oidcServicePublicKeySig                                                                                                                      ✔
+oidcStorage                                             Apache::Session module to store OIDC user data                                       ✔
+oidcStorageOptions                                      Apache::Session module parameters                                                    ✔
+oldNotifFormat                                          Use old XML format for notifications                                                 ✔
+openIdAttr                                                                                                                                   ✔
+openIdAuthnLevel                                        OpenID authentication level                                                          ✔
+openIdExportedVars                                      OpenID exported variables                                                            ✔
+openIdIDPList                                                                                                                                ✔
+openIdIssuerSecret                                                                                                                           ✔
+openIdSPList                                                                                                                                 ✔
+openIdSecret                                                                                                                                 ✔
+openIdSreg_country                                                                                                                           ✔
+openIdSreg_dob                                                                                                                               ✔
+openIdSreg_email                                        OpenID SREG email session parameter                                                  ✔
+openIdSreg_fullname                                     OpenID SREG fullname session parameter                                               ✔
+openIdSreg_gender                                                                                                                            ✔
+openIdSreg_language                                                                                                                          ✔
+openIdSreg_nickname                                     OpenID SREG nickname session parameter                                               ✔
+openIdSreg_postcode                                                                                                                          ✔
+openIdSreg_timezone                                     OpenID SREG timezone session parameter                                               ✔
+pamAuthnLevel                                           PAM authentication level                                                             ✔
+pamService                                              PAM service                                                                          ✔
+passwordDB                                              Password module                                                                      ✔
+passwordPolicyMinDigit                                  Password policy: minimal digit characters                                            ✔
+passwordPolicyMinLower                                  Password policy: minimal lower characters                                            ✔
+passwordPolicyMinSize                                   Password policy: minimal size                                                        ✔
+passwordPolicyMinSpeChar                                Password policy: minimal special characters                                          ✔
+passwordPolicyMinUpper                                  Password policy: minimal upper characters                                            ✔
+passwordPolicySpecialChar                               Password policy: allowed special characters                                          ✔
+passwordResetAllowedRetries                             Maximum number of retries to reset password                                          ✔
 pdataDomain                                             pdata cookie DNS domain                                                              ✔      ✔               ✔
 persistentSessionAttributes                             Persistent session attributes to hide                                                ✔                      ✔
-persistentStorage                                       Storage module for persistent sessions                                               ✔                     
-persistentStorageOptions                                Options for persistent sessions storage module                                       ✔                     
-port                                                    Force port in redirection                                                                   ✔              
-portal                                                  Portal URL                                                                           ✔      ✔       ✔      
-portalAntiFrame                                         Avoid portal to be displayed inside frames                                           ✔                     
-portalCheckLogins                                       Display login history checkbox in portal                                             ✔                     
-portalCustomCss                                         Path to custom CSS file                                                              ✔                     
-portalDisplayAppslist                                   Display applications tab in portal                                                   ✔                     
-portalDisplayCertificateResetByMail                     Display Certificate Reset by mail tab in portal                                      ✔                     
-portalDisplayChangePassword                             Display password tab in portal                                                       ✔                     
-portalDisplayGeneratePassword                           Display password generate box in reset password form                                 ✔                     
-portalDisplayLoginHistory                               Display login history tab in portal                                                  ✔                     
-portalDisplayLogout                                     Display logout tab in portal                                                         ✔                     
-portalDisplayOidcConsents                               Display OIDC consent tab in portal                                                   ✔                     
-portalDisplayPasswordPolicy                             Display policy in password form                                                      ✔                     
-portalDisplayRefreshMyRights                            Displays the link to refresh the user session                                        ✔                     
-portalDisplayRegister                                   Display register button in portal                                                    ✔                     
-portalDisplayResetPassword                              Display reset password button in portal                                              ✔                     
-portalErrorOnExpiredSession                             Show error if session is expired                                                     ✔                     
-portalErrorOnMailNotFound                               Show error if mail is not found in password reset process                            ✔                     
-portalForceAuthn                                        Enable force to authenticate when displaying portal                                  ✔                     
-portalForceAuthnInterval                                Maximum interval in seconds since last authentication to force reauthentication      ✔                     
-portalMainLogo                                          Portal main logo path                                                                ✔                     
-portalOpenLinkInNewWindow                               Open applications in new windows                                                     ✔                     
-portalPingInterval                                      Interval in ms between portal Ajax pings                                             ✔                     
-portalRequireOldPassword                                Rule to require old password to change the password                                  ✔                     
-portalSkin                                              Name of portal skin                                                                  ✔                     
-portalSkinBackground                                    Background image of portal skin                                                      ✔                     
-portalSkinRules                                         Rules to choose portal skin                                                          ✔                     
-portalStatus                                            Enable portal status                                                                 ✔                     
-portalUserAttr                                          Session parameter to display connected user in portal                                ✔                     
+persistentStorage                                       Storage module for persistent sessions                                               ✔
+persistentStorageOptions                                Options for persistent sessions storage module                                       ✔
+port                                                    Force port in redirection                                                                   ✔
+portal                                                  Portal URL                                                                           ✔      ✔       ✔
+portalAntiFrame                                         Avoid portal to be displayed inside frames                                           ✔
+portalCheckLogins                                       Display login history checkbox in portal                                             ✔
+portalCustomCss                                         Path to custom CSS file                                                              ✔
+portalDisplayAppslist                                   Display applications tab in portal                                                   ✔
+portalDisplayCertificateResetByMail                     Display Certificate Reset by mail tab in portal                                      ✔
+portalDisplayChangePassword                             Display password tab in portal                                                       ✔
+portalDisplayGeneratePassword                           Display password generate box in reset password form                                 ✔
+portalDisplayLoginHistory                               Display login history tab in portal                                                  ✔
+portalDisplayLogout                                     Display logout tab in portal                                                         ✔
+portalDisplayOidcConsents                               Display OIDC consent tab in portal                                                   ✔
+portalDisplayPasswordPolicy                             Display policy in password form                                                      ✔
+portalDisplayRefreshMyRights                            Displays the link to refresh the user session                                        ✔
+portalDisplayRegister                                   Display register button in portal                                                    ✔
+portalDisplayResetPassword                              Display reset password button in portal                                              ✔
+portalErrorOnExpiredSession                             Show error if session is expired                                                     ✔
+portalErrorOnMailNotFound                               Show error if mail is not found in password reset process                            ✔
+portalForceAuthn                                        Enable force to authenticate when displaying portal                                  ✔
+portalForceAuthnInterval                                Maximum interval in seconds since last authentication to force reauthentication      ✔
+portalMainLogo                                          Portal main logo path                                                                ✔
+portalOpenLinkInNewWindow                               Open applications in new windows                                                     ✔
+portalPingInterval                                      Interval in ms between portal Ajax pings                                             ✔
+portalRequireOldPassword                                Rule to require old password to change the password                                  ✔
+portalSkin                                              Name of portal skin                                                                  ✔
+portalSkinBackground                                    Background image of portal skin                                                      ✔
+portalSkinRules                                         Rules to choose portal skin                                                          ✔
+portalStatus                                            Enable portal status                                                                 ✔
+portalUserAttr                                          Session parameter to display connected user in portal                                ✔
 protection                                              Manager protection method                                                                   ✔       ✔       ✔
-proxyAuthService                                                                                                                             ✔                     
-proxyAuthnLevel                                         Proxy authentication level                                                           ✔                     
-proxySessionService                                                                                                                          ✔                     
-proxyUseSoap                                            Use SOAP instead of REST                                                             ✔                     
-radius2fActivation                                      Radius second factor activation                                                      ✔                     
-radius2fAuthnLevel                                      Authentication level for users authenticated by Radius second factor                 ✔                     
-radius2fLabel                                           Portal label for Radius 2F                                                           ✔                     
-radius2fLogo                                            Custom logo for Radius 2F                                                            ✔                     
-radius2fSecret                                                                                                                               ✔                     
-radius2fServer                                                                                                                               ✔                     
-radius2fTimeout                                         Radius 2f verification timeout                                                       ✔                     
-radius2fUsernameSessionKey                              Session key used as Radius login                                                     ✔                     
-radiusAuthnLevel                                        Radius authentication level                                                          ✔                     
-radiusSecret                                                                                                                                 ✔                     
-radiusServer                                                                                                                                 ✔                     
-randomPasswordRegexp                                    Regular expression to create a random password                                       ✔                     
-redirectFormMethod                                      HTTP method for redirect page form                                                   ✔                     
-refreshSessions                                         Refresh sessions plugin                                                              ✔                     
-registerConfirmSubject                                  Mail subject for register confirmation                                               ✔                     
-registerDB                                              Register module                                                                      ✔                     
-registerDoneSubject                                     Mail subject when register is done                                                   ✔                     
-registerTimeout                                         Register session timeout                                                             ✔                     
-registerUrl                                             URL of register page                                                                 ✔                     
-reloadTimeout                                           Configuration reload timeout                                                                        ✔      
-reloadUrls                                              URL to call on reload                                                                ✔                     
-remoteCookieName                                                                                                                             ✔                     
-remoteGlobalStorage                                     Remote session backend                                                               ✔                     
-remoteGlobalStorageOptions                              Apache::Session module parameters                                                    ✔                     
-remotePortal                                                                                                                                 ✔                     
-requireToken                                            Enable token for forms                                                               ✔                     
-rest2fActivation                                        REST second factor activation                                                        ✔                     
-rest2fAuthnLevel                                        Authentication level for users authentified by REST second factor                    ✔                     
-rest2fInitArgs                                          Args for REST 2F init                                                                ✔                     
-rest2fInitUrl                                           REST 2F init URL                                                                     ✔                     
-rest2fLabel                                             Portal label for REST second factor                                                  ✔                     
-rest2fLogo                                              Custom logo for REST 2F                                                              ✔                     
-rest2fVerifyArgs                                        Args for REST 2F init                                                                ✔                     
-rest2fVerifyUrl                                         REST 2F init URL                                                                     ✔                     
-restAuthUrl                                                                                                                                  ✔                     
-restAuthnLevel                                          REST authentication level                                                            ✔                     
-restClockTolerance                                      How tolerant the REST session server will be to clock dift                           ✔                     
-restConfigServer                                        Enable REST config server                                                            ✔                     
-restExportSecretKeys                                    Allow to export secret keys in REST session server                                   ✔                     
-restPwdConfirmUrl                                                                                                                            ✔                     
-restPwdModifyUrl                                                                                                                             ✔                     
-restSessionServer                                       Enable REST session server                                                           ✔                     
-restUserDBUrl                                                                                                                                ✔                     
-sameSite                                                Cookie SameSite value                                                                ✔      ✔              
-samlAttributeAuthorityDescriptorAttributeServiceSOAP    SAML Attribute Authority SOAP                                                        ✔                     
-samlAuthnContextMapKerberos                             SAML authn context kerberos level                                                    ✔                     
-samlAuthnContextMapPassword                             SAML authn context password level                                                    ✔                     
-samlAuthnContextMapPasswordProtectedTransport           SAML authn context password protected transport level                                ✔                     
-samlAuthnContextMapTLSClient                            SAML authn context TLS client level                                                  ✔                     
-samlCommonDomainCookieActivation                        SAML CDC activation                                                                  ✔                     
-samlCommonDomainCookieDomain                                                                                                                 ✔                     
-samlCommonDomainCookieReader                                                                                                                 ✔                     
-samlCommonDomainCookieWriter                                                                                                                 ✔                     
-samlDiscoveryProtocolActivation                         SAML Discovery Protocol activation                                                   ✔                     
-samlDiscoveryProtocolIsPassive                          SAML Discovery Protocol Is Passive                                                   ✔                     
-samlDiscoveryProtocolPolicy                             SAML Discovery Protocol Policy                                                       ✔                     
-samlDiscoveryProtocolURL                                SAML Discovery Protocol EndPoint URL                                                 ✔                     
-samlEntityID                                            SAML service entityID                                                                ✔                     
+proxyAuthService                                                                                                                             ✔
+proxyAuthnLevel                                         Proxy authentication level                                                           ✔
+proxySessionService                                                                                                                          ✔
+proxyUseSoap                                            Use SOAP instead of REST                                                             ✔
+radius2fActivation                                      Radius second factor activation                                                      ✔
+radius2fAuthnLevel                                      Authentication level for users authenticated by Radius second factor                 ✔
+radius2fLabel                                           Portal label for Radius 2F                                                           ✔
+radius2fLogo                                            Custom logo for Radius 2F                                                            ✔
+radius2fSecret                                                                                                                               ✔
+radius2fServer                                                                                                                               ✔
+radius2fTimeout                                         Radius 2f verification timeout                                                       ✔
+radius2fUsernameSessionKey                              Session key used as Radius login                                                     ✔
+radiusAuthnLevel                                        Radius authentication level                                                          ✔
+radiusSecret                                                                                                                                 ✔
+radiusServer                                                                                                                                 ✔
+randomPasswordRegexp                                    Regular expression to create a random password                                       ✔
+redirectFormMethod                                      HTTP method for redirect page form                                                   ✔
+refreshSessions                                         Refresh sessions plugin                                                              ✔
+registerConfirmSubject                                  Mail subject for register confirmation                                               ✔
+registerDB                                              Register module                                                                      ✔
+registerDoneSubject                                     Mail subject when register is done                                                   ✔
+registerTimeout                                         Register session timeout                                                             ✔
+registerUrl                                             URL of register page                                                                 ✔
+reloadTimeout                                           Configuration reload timeout                                                                        ✔
+reloadUrls                                              URL to call on reload                                                                ✔
+remoteCookieName                                                                                                                             ✔
+remoteGlobalStorage                                     Remote session backend                                                               ✔
+remoteGlobalStorageOptions                              Apache::Session module parameters                                                    ✔
+remotePortal                                                                                                                                 ✔
+requireToken                                            Enable token for forms                                                               ✔
+rest2fActivation                                        REST second factor activation                                                        ✔
+rest2fAuthnLevel                                        Authentication level for users authentified by REST second factor                    ✔
+rest2fInitArgs                                          Args for REST 2F init                                                                ✔
+rest2fInitUrl                                           REST 2F init URL                                                                     ✔
+rest2fLabel                                             Portal label for REST second factor                                                  ✔
+rest2fLogo                                              Custom logo for REST 2F                                                              ✔
+rest2fVerifyArgs                                        Args for REST 2F init                                                                ✔
+rest2fVerifyUrl                                         REST 2F init URL                                                                     ✔
+restAuthUrl                                                                                                                                  ✔
+restAuthnLevel                                          REST authentication level                                                            ✔
+restClockTolerance                                      How tolerant the REST session server will be to clock dift                           ✔
+restConfigServer                                        Enable REST config server                                                            ✔
+restExportSecretKeys                                    Allow to export secret keys in REST session server                                   ✔
+restPwdConfirmUrl                                                                                                                            ✔
+restPwdModifyUrl                                                                                                                             ✔
+restSessionServer                                       Enable REST session server                                                           ✔
+restUserDBUrl                                                                                                                                ✔
+sameSite                                                Cookie SameSite value                                                                ✔      ✔
+samlAttributeAuthorityDescriptorAttributeServiceSOAP    SAML Attribute Authority SOAP                                                        ✔
+samlAuthnContextMapKerberos                             SAML authn context kerberos level                                                    ✔
+samlAuthnContextMapPassword                             SAML authn context password level                                                    ✔
+samlAuthnContextMapPasswordProtectedTransport           SAML authn context password protected transport level                                ✔
+samlAuthnContextMapTLSClient                            SAML authn context TLS client level                                                  ✔
+samlCommonDomainCookieActivation                        SAML CDC activation                                                                  ✔
+samlCommonDomainCookieDomain                                                                                                                 ✔
+samlCommonDomainCookieReader                                                                                                                 ✔
+samlCommonDomainCookieWriter                                                                                                                 ✔
+samlDiscoveryProtocolActivation                         SAML Discovery Protocol activation                                                   ✔
+samlDiscoveryProtocolIsPassive                          SAML Discovery Protocol Is Passive                                                   ✔
+samlDiscoveryProtocolPolicy                             SAML Discovery Protocol Policy                                                       ✔
+samlDiscoveryProtocolURL                                SAML Discovery Protocol EndPoint URL                                                 ✔
+samlEntityID                                            SAML service entityID                                                                ✔
 samlIDPMetaDataOptions                                                                                                                       ✔                      [1]
-samlIDPSSODescriptorArtifactResolutionServiceArtifact   SAML IDP artifact resolution service                                                 ✔                     
-samlIDPSSODescriptorSingleLogoutServiceHTTPPost         SAML IDP SLO HTTP POST                                                               ✔                     
-samlIDPSSODescriptorSingleLogoutServiceHTTPRedirect     SAML IDP SLO HTTP Redirect                                                           ✔                     
-samlIDPSSODescriptorSingleLogoutServiceSOAP             SAML IDP SLO SOAP                                                                    ✔                     
-samlIDPSSODescriptorSingleSignOnServiceHTTPArtifact     SAML IDP SSO HTTP Artifact                                                           ✔                     
-samlIDPSSODescriptorSingleSignOnServiceHTTPPost         SAML IDP SSO HTTP POST                                                               ✔                     
-samlIDPSSODescriptorSingleSignOnServiceHTTPRedirect     SAML IDP SSO HTTP Redirect                                                           ✔                     
-samlIDPSSODescriptorWantAuthnRequestsSigned             SAML IDP want authn request signed                                                   ✔                     
-samlMetadataForceUTF8                                   SAML force metadata UTF8 conversion                                                  ✔                     
-samlNameIDFormatMapEmail                                SAML session parameter for NameID email                                              ✔                     
-samlNameIDFormatMapKerberos                             SAML session parameter for NameID kerberos                                           ✔                     
-samlNameIDFormatMapWindows                              SAML session parameter for NameID windows                                            ✔                     
-samlNameIDFormatMapX509                                 SAML session parameter for NameID x509                                               ✔                     
-samlOrganizationDisplayName                             SAML service organization display name                                               ✔                     
-samlOrganizationName                                    SAML service organization name                                                       ✔                     
-samlOrganizationURL                                     SAML service organization URL                                                        ✔                     
-samlOverrideIDPEntityID                                 Override SAML EntityID when acting as an IDP                                         ✔                     
-samlRelayStateTimeout                                   SAML timeout of relay state                                                          ✔                     
+samlIDPSSODescriptorArtifactResolutionServiceArtifact   SAML IDP artifact resolution service                                                 ✔
+samlIDPSSODescriptorSingleLogoutServiceHTTPPost         SAML IDP SLO HTTP POST                                                               ✔
+samlIDPSSODescriptorSingleLogoutServiceHTTPRedirect     SAML IDP SLO HTTP Redirect                                                           ✔
+samlIDPSSODescriptorSingleLogoutServiceSOAP             SAML IDP SLO SOAP                                                                    ✔
+samlIDPSSODescriptorSingleSignOnServiceHTTPArtifact     SAML IDP SSO HTTP Artifact                                                           ✔
+samlIDPSSODescriptorSingleSignOnServiceHTTPPost         SAML IDP SSO HTTP POST                                                               ✔
+samlIDPSSODescriptorSingleSignOnServiceHTTPRedirect     SAML IDP SSO HTTP Redirect                                                           ✔
+samlIDPSSODescriptorWantAuthnRequestsSigned             SAML IDP want authn request signed                                                   ✔
+samlMetadataForceUTF8                                   SAML force metadata UTF8 conversion                                                  ✔
+samlNameIDFormatMapEmail                                SAML session parameter for NameID email                                              ✔
+samlNameIDFormatMapKerberos                             SAML session parameter for NameID kerberos                                           ✔
+samlNameIDFormatMapWindows                              SAML session parameter for NameID windows                                            ✔
+samlNameIDFormatMapX509                                 SAML session parameter for NameID x509                                               ✔
+samlOrganizationDisplayName                             SAML service organization display name                                               ✔
+samlOrganizationName                                    SAML service organization name                                                       ✔
+samlOrganizationURL                                     SAML service organization URL                                                        ✔
+samlOverrideIDPEntityID                                 Override SAML EntityID when acting as an IDP                                         ✔
+samlRelayStateTimeout                                   SAML timeout of relay state                                                          ✔
 samlSPMetaDataOptions                                                                                                                        ✔                      [1]
-samlSPSSODescriptorArtifactResolutionServiceArtifact    SAML SP artifact resolution service                                                  ✔                     
-samlSPSSODescriptorAssertionConsumerServiceHTTPArtifact SAML SP ACS HTTP artifact                                                            ✔                     
-samlSPSSODescriptorAssertionConsumerServiceHTTPPost     SAML SP ACS HTTP POST                                                                ✔                     
-samlSPSSODescriptorAuthnRequestsSigned                  SAML SP AuthnRequestsSigned                                                          ✔                     
-samlSPSSODescriptorSingleLogoutServiceHTTPPost          SAML SP SLO HTTP POST                                                                ✔                     
-samlSPSSODescriptorSingleLogoutServiceHTTPRedirect      SAML SP SLO HTTP Redirect                                                            ✔                     
-samlSPSSODescriptorSingleLogoutServiceSOAP              SAML SP SLO SOAP                                                                     ✔                     
-samlSPSSODescriptorWantAssertionsSigned                 SAML SP WantAssertionsSigned                                                         ✔                     
-samlServicePrivateKeyEnc                                SAML encryption private key                                                          ✔                     
-samlServicePrivateKeyEncPwd                                                                                                                  ✔                     
-samlServicePrivateKeySig                                SAML signature private key                                                           ✔                     
-samlServicePrivateKeySigPwd                             SAML signature private key password                                                  ✔                     
-samlServicePublicKeyEnc                                 SAML encryption public key                                                           ✔                     
-samlServicePublicKeySig                                 SAML signature public key                                                            ✔                     
-samlServiceSignatureMethod                                                                                                                   ✔                     
-samlServiceUseCertificateInResponse                     Use certificate instead of public key in SAML responses                              ✔                     
-samlStorage                                             Apache::Session module to store SAML user data                                       ✔                     
-samlStorageOptions                                      Apache::Session module parameters                                                    ✔                     
-samlUseQueryStringSpecific                              SAML use specific method for query_string                                            ✔                     
+samlSPSSODescriptorArtifactResolutionServiceArtifact    SAML SP artifact resolution service                                                  ✔
+samlSPSSODescriptorAssertionConsumerServiceHTTPArtifact SAML SP ACS HTTP artifact                                                            ✔
+samlSPSSODescriptorAssertionConsumerServiceHTTPPost     SAML SP ACS HTTP POST                                                                ✔
+samlSPSSODescriptorAuthnRequestsSigned                  SAML SP AuthnRequestsSigned                                                          ✔
+samlSPSSODescriptorSingleLogoutServiceHTTPPost          SAML SP SLO HTTP POST                                                                ✔
+samlSPSSODescriptorSingleLogoutServiceHTTPRedirect      SAML SP SLO HTTP Redirect                                                            ✔
+samlSPSSODescriptorSingleLogoutServiceSOAP              SAML SP SLO SOAP                                                                     ✔
+samlSPSSODescriptorWantAssertionsSigned                 SAML SP WantAssertionsSigned                                                         ✔
+samlServicePrivateKeyEnc                                SAML encryption private key                                                          ✔
+samlServicePrivateKeyEncPwd                                                                                                                  ✔
+samlServicePrivateKeySig                                SAML signature private key                                                           ✔
+samlServicePrivateKeySigPwd                             SAML signature private key password                                                  ✔
+samlServicePublicKeyEnc                                 SAML encryption public key                                                           ✔
+samlServicePublicKeySig                                 SAML signature public key                                                            ✔
+samlServiceSignatureMethod                                                                                                                   ✔
+samlServiceUseCertificateInResponse                     Use certificate instead of public key in SAML responses                              ✔
+samlStorage                                             Apache::Session module to store SAML user data                                       ✔
+samlStorageOptions                                      Apache::Session module parameters                                                    ✔
+samlUseQueryStringSpecific                              SAML use specific method for query_string                                            ✔
 secureTokenAllowOnError                                 Secure Token allow requests in error                                                        ✔               ✔
 secureTokenAttribute                                    Secure Token attribute                                                                      ✔               ✔
 secureTokenExpiration                                   Secure Token expiration                                                                     ✔               ✔
 secureTokenHeader                                       Secure Token header                                                                         ✔               ✔
 secureTokenMemcachedServers                             Secure Token Memcached servers                                                              ✔               ✔
 secureTokenUrls                                                                                                                                     ✔               ✔
-securedCookie                                           Cookie securisation method                                                           ✔      ✔              
+securedCookie                                           Cookie securisation method                                                           ✔      ✔
 sentryDsn                                               Sentry logger DSN                                                                    ✔      ✔       ✔       ✔
-sessionDataToRemember                                   Data to remember in login history                                                    ✔                     
+sessionDataToRemember                                   Data to remember in login history                                                    ✔
 sfEngine                                                Second factor engine                                                                 ✔                      ✔
-sfExtra                                                 Extra second factors                                                                 ✔                     
-sfManagerRule                                           Rule to display second factor Manager link                                           ✔                     
-sfRemovedMsgRule                                        Display a message if at leat one expired SF has been removed                         ✔                     
-sfRemovedNotifMsg                                       Notification message                                                                 ✔                     
-sfRemovedNotifRef                                       Notification reference                                                               ✔                     
-sfRemovedNotifTitle                                     Notification title                                                                   ✔                     
-sfRemovedUseNotif                                       Use Notifications plugin to display message                                          ✔                     
-sfRequired                                              Second factor required                                                               ✔                     
-showLanguages                                           Display langs icons                                                                  ✔                     
-singleIP                                                Allow only one session per IP                                                        ✔                     
-singleSession                                           Allow only one session per user                                                      ✔                     
-singleUserByIP                                          Allow only one user per IP                                                           ✔                     
-skipRenewConfirmation                                   Avoid asking confirmation when an Issuer asks to renew auth                          ✔                     
-slaveAuthnLevel                                         Slave authentication level                                                           ✔                     
-slaveDisplayLogo                                        Display Slave authentication logo                                                    ✔                     
-slaveExportedVars                                       Slave exported variables                                                             ✔                     
-slaveHeaderContent                                                                                                                           ✔                     
-slaveHeaderName                                                                                                                              ✔                     
-slaveMasterIP                                                                                                                                ✔                     
-slaveUserHeader                                                                                                                              ✔                     
-soapConfigServer                                        Enable SOAP config server                                                            ✔                     
+sfExtra                                                 Extra second factors                                                                 ✔
+sfManagerRule                                           Rule to display second factor Manager link                                           ✔
+sfRemovedMsgRule                                        Display a message if at leat one expired SF has been removed                         ✔
+sfRemovedNotifMsg                                       Notification message                                                                 ✔
+sfRemovedNotifRef                                       Notification reference                                                               ✔
+sfRemovedNotifTitle                                     Notification title                                                                   ✔
+sfRemovedUseNotif                                       Use Notifications plugin to display message                                          ✔
+sfRequired                                              Second factor required                                                               ✔
+showLanguages                                           Display langs icons                                                                  ✔
+singleIP                                                Allow only one session per IP                                                        ✔
+singleSession                                           Allow only one session per user                                                      ✔
+singleUserByIP                                          Allow only one user per IP                                                           ✔
+skipRenewConfirmation                                   Avoid asking confirmation when an Issuer asks to renew auth                          ✔
+slaveAuthnLevel                                         Slave authentication level                                                           ✔
+slaveDisplayLogo                                        Display Slave authentication logo                                                    ✔
+slaveExportedVars                                       Slave exported variables                                                             ✔
+slaveHeaderContent                                                                                                                           ✔
+slaveHeaderName                                                                                                                              ✔
+slaveMasterIP                                                                                                                                ✔
+slaveUserHeader                                                                                                                              ✔
+soapConfigServer                                        Enable SOAP config server                                                            ✔
 soapProxyUrn                                            SOAP URN for Proxy                                                                   ✔                      ✔
-soapSessionServer                                       Enable SOAP session server                                                           ✔                     
-sslByAjax                                               Use Ajax request for SSL                                                             ✔                     
-sslHost                                                 URL for SSL Ajax request                                                             ✔                     
+soapSessionServer                                       Enable SOAP session server                                                           ✔
+sslByAjax                                               Use Ajax request for SSL                                                             ✔
+sslHost                                                 URL for SSL Ajax request                                                             ✔
 staticPrefix                                            Prefix of static files for HTML templates                                            ✔                      ✔
 status                                                  Status daemon activation                                                                    ✔               ✔
-stayConnected                                           Enable StayConnected plugin                                                          ✔                     
-storePassword                                           Store password in session                                                            ✔                     
-successLoginNumber                                      Number of success stored in login history                                            ✔                     
+stayConnected                                           Enable StayConnected plugin                                                          ✔
+storePassword                                           Store password in session                                                            ✔
+successLoginNumber                                      Number of success stored in login history                                            ✔
 syslogFacility                                          Syslog logger technical facility                                                     ✔      ✔       ✔       ✔
-timeout                                                 Session timeout on server side                                                       ✔                     
-timeoutActivity                                         Session activity timeout on server side                                              ✔                     
-timeoutActivityInterval                                 Update session timeout interval on server side                                       ✔                     
-tokenUseGlobalStorage                                   Enable global token storage                                                          ✔                     
-totp2fActivation                                        TOTP activation                                                                      ✔                     
-totp2fAuthnLevel                                        Authentication level for users authentified by password+TOTP                         ✔                     
-totp2fDigits                                            Number of digits for TOTP code                                                       ✔                     
-totp2fDisplayExistingSecret                             Display existing TOTP secret in registration form                                    ✔                     
-totp2fInterval                                          TOTP interval                                                                        ✔                     
-totp2fIssuer                                            TOTP Issuer                                                                          ✔                     
-totp2fLabel                                             Portal label for TOTP 2F                                                             ✔                     
-totp2fLogo                                              Custom logo for TOTP 2F                                                              ✔                     
-totp2fRange                                             TOTP range (number of interval to test)                                              ✔                     
-totp2fSelfRegistration                                  TOTP self registration activation                                                    ✔                     
-totp2fTTL                                               TOTP device time to live                                                             ✔                     
-totp2fUserCanChangeKey                                  Authorize users to change existing TOTP secret                                       ✔                     
-totp2fUserCanRemoveKey                                  Authorize users to remove existing TOTP secret                                       ✔                     
-trustedDomains                                          Trusted domains                                                                      ✔                     
-twitterAppName                                                                                                                               ✔                     
-twitterAuthnLevel                                       Twitter authentication level                                                         ✔                     
-twitterKey                                                                                                                                   ✔                     
-twitterSecret                                                                                                                                ✔                     
-twitterUserField                                                                                                                             ✔                     
-u2fActivation                                           U2F activation                                                                       ✔                     
-u2fAuthnLevel                                           Authentication level for users authentified by password+U2F                          ✔                     
-u2fLabel                                                Portal label for U2F                                                                 ✔                     
-u2fLogo                                                 Custom logo for U2F                                                                  ✔                     
-u2fSelfRegistration                                     U2F self registration activation                                                     ✔                     
-u2fTTL                                                  U2F device time to live                                                              ✔                     
-u2fUserCanRemoveKey                                     Authorize users to remove existing U2F key                                           ✔                     
-upgradeSession                                          Upgrade session activation                                                           ✔                     
-useRedirectOnError                                      Use 302 redirect code for error (500)                                                       ✔              
-useRedirectOnForbidden                                  Use 302 redirect code for forbidden (403)                                            ✔                     
-useSafeJail                                             Activate Safe jail                                                                   ✔      ✔              
-userControl                                             Regular expression to validate login                                                 ✔                     
-userDB                                                  User module                                                                          ✔                     
+timeout                                                 Session timeout on server side                                                       ✔
+timeoutActivity                                         Session activity timeout on server side                                              ✔
+timeoutActivityInterval                                 Update session timeout interval on server side                                       ✔
+tokenUseGlobalStorage                                   Enable global token storage                                                          ✔
+totp2fActivation                                        TOTP activation                                                                      ✔
+totp2fAuthnLevel                                        Authentication level for users authentified by password+TOTP                         ✔
+totp2fDigits                                            Number of digits for TOTP code                                                       ✔
+totp2fDisplayExistingSecret                             Display existing TOTP secret in registration form                                    ✔
+totp2fInterval                                          TOTP interval                                                                        ✔
+totp2fIssuer                                            TOTP Issuer                                                                          ✔
+totp2fLabel                                             Portal label for TOTP 2F                                                             ✔
+totp2fLogo                                              Custom logo for TOTP 2F                                                              ✔
+totp2fRange                                             TOTP range (number of interval to test)                                              ✔
+totp2fSelfRegistration                                  TOTP self registration activation                                                    ✔
+totp2fTTL                                               TOTP device time to live                                                             ✔
+totp2fUserCanChangeKey                                  Authorize users to change existing TOTP secret                                       ✔
+totp2fUserCanRemoveKey                                  Authorize users to remove existing TOTP secret                                       ✔
+trustedDomains                                          Trusted domains                                                                      ✔
+twitterAppName                                                                                                                               ✔
+twitterAuthnLevel                                       Twitter authentication level                                                         ✔
+twitterKey                                                                                                                                   ✔
+twitterSecret                                                                                                                                ✔
+twitterUserField                                                                                                                             ✔
+u2fActivation                                           U2F activation                                                                       ✔
+u2fAuthnLevel                                           Authentication level for users authentified by password+U2F                          ✔
+u2fLabel                                                Portal label for U2F                                                                 ✔
+u2fLogo                                                 Custom logo for U2F                                                                  ✔
+u2fSelfRegistration                                     U2F self registration activation                                                     ✔
+u2fTTL                                                  U2F device time to live                                                              ✔
+u2fUserCanRemoveKey                                     Authorize users to remove existing U2F key                                           ✔
+upgradeSession                                          Upgrade session activation                                                           ✔
+useRedirectOnError                                      Use 302 redirect code for error (500)                                                       ✔
+useRedirectOnForbidden                                  Use 302 redirect code for forbidden (403)                                            ✔
+useSafeJail                                             Activate Safe jail                                                                   ✔      ✔
+userControl                                             Regular expression to validate login                                                 ✔
+userDB                                                  User module                                                                          ✔
 userLogger                                              User actions logger                                                                  ✔      ✔       ✔       ✔
-userPivot                                                                                                                                    ✔                     
+userPivot                                                                                                                                    ✔
 userSyslogFacility                                      Syslog logger user-actions facility                                                  ✔      ✔       ✔       ✔
-utotp2fActivation                                       UTOTP activation (mixed U2F/TOTP module)                                             ✔                     
-utotp2fAuthnLevel                                       Authentication level for users authentified by password+(U2F or TOTP)                ✔                     
-utotp2fLabel                                            Portal label for U2F+TOTP                                                            ✔                     
-utotp2fLogo                                             Custom logo for U2F+TOTP                                                             ✔                     
+utotp2fActivation                                       UTOTP activation (mixed U2F/TOTP module)                                             ✔
+utotp2fAuthnLevel                                       Authentication level for users authentified by password+(U2F or TOTP)                ✔
+utotp2fLabel                                            Portal label for U2F+TOTP                                                            ✔
+utotp2fLogo                                             Custom logo for U2F+TOTP                                                             ✔
 vhostOptions                                                                                                                                 ✔                      [1]
 viewerAllowBrowser                                      Allow configuration browser                                                          ✔                      ✔
 viewerAllowDiff                                         Allow configuration diff                                                             ✔                      ✔
 viewerHiddenKeys                                        Hidden Conf keys                                                                                    ✔       ✔
-webIDAuthnLevel                                         WebID authentication level                                                           ✔                     
-webIDExportedVars                                       WebID exported variables                                                             ✔                     
-webIDWhitelist                                                                                                                               ✔                     
-whatToTrace                                             Session parameter used to fill REMOTE_USER                                           ✔      ✔              
-wsdlServer                                              Enable /portal.wsdl server                                                           ✔                     
-yubikey2fActivation                                     Yubikey second factor activation                                                     ✔                     
-yubikey2fAuthnLevel                                     Authentication level for users authentified by Yubikey second factor                 ✔                     
-yubikey2fClientID                                       Yubico client ID                                                                     ✔                     
-yubikey2fLabel                                          Portal label for Yubikey second factor                                               ✔                     
-yubikey2fLogo                                           Custom logo for Yubikey 2F                                                           ✔                     
-yubikey2fNonce                                          Yubico nonce                                                                         ✔                     
-yubikey2fPublicIDSize                                   Yubikey public ID size                                                               ✔                     
-yubikey2fSecretKey                                      Yubico secret key                                                                    ✔                     
-yubikey2fSelfRegistration                               Yubikey self registration activation                                                 ✔                     
-yubikey2fTTL                                            Yubikey device time to live                                                          ✔                     
-yubikey2fUrl                                            Yubico server                                                                        ✔                     
-yubikey2fUserCanRemoveKey                               Authorize users to remove existing Yubikey                                           ✔                     
+webIDAuthnLevel                                         WebID authentication level                                                           ✔
+webIDExportedVars                                       WebID exported variables                                                             ✔
+webIDWhitelist                                                                                                                               ✔
+whatToTrace                                             Session parameter used to fill REMOTE_USER                                           ✔      ✔
+wsdlServer                                              Enable /portal.wsdl server                                                           ✔
+yubikey2fActivation                                     Yubikey second factor activation                                                     ✔
+yubikey2fAuthnLevel                                     Authentication level for users authentified by Yubikey second factor                 ✔
+yubikey2fClientID                                       Yubico client ID                                                                     ✔
+yubikey2fLabel                                          Portal label for Yubikey second factor                                               ✔
+yubikey2fLogo                                           Custom logo for Yubikey 2F                                                           ✔
+yubikey2fNonce                                          Yubico nonce                                                                         ✔
+yubikey2fPublicIDSize                                   Yubikey public ID size                                                               ✔
+yubikey2fSecretKey                                      Yubico secret key                                                                    ✔
+yubikey2fSelfRegistration                               Yubikey self registration activation                                                 ✔
+yubikey2fTTL                                            Yubikey device time to live                                                          ✔
+yubikey2fUrl                                            Yubico server                                                                        ✔
+yubikey2fUserCanRemoveKey                               Authorize users to remove existing Yubikey                                           ✔
 zimbraAccountKey                                        Zimbra account session key                                                                  ✔               ✔
 zimbraBy                                                Zimbra account type                                                                         ✔               ✔
 zimbraPreAuthKey                                        Zimbra preauthentication key                                                                ✔               ✔
@@ -622,28 +622,28 @@ Full name                                                                     Ke
 Configuration load timeout                                                    confTimeout          all backends (default: 10)
 Directory                                                                     dirName              :doc:`File<fileconfbackend>`
 DBI connection string                                                         dbiChain             :doc:`CDBI / RDBI<sqlconfbackend>`
-DBI user                                                                      dbiUser              
-DBI password                                                                  dbiPassword          
-DBI table name                                                                dbiTable             
+DBI user                                                                      dbiUser
+DBI password                                                                  dbiPassword
+DBI table name                                                                dbiTable
 Storage directory                                                             dirName              :doc:`File<fileconfbackend>` / :doc:`YAML<yamlconfbackend>`
 LDAP server                                                                   ldapServer           :doc:`LDAP<ldapconfbackend>`
-LDAP port                                                                     ldapPort             
-LDAP base                                                                     ldapConfBase         
-LDAP bind dn                                                                  ldapBindDN           
-LDAP bind password                                                            ldapBindPassword     
-LDAP ObjectClass                                                              ldapObjectClass      
-LDAP ID attribute                                                             ldapAttributeId      
-LDAP content attribute                                                        ldapAttributeContent 
-Certificate authorities file                                                  caFile               
-Certificate authorities directory                                             caPath               
+LDAP port                                                                     ldapPort
+LDAP base                                                                     ldapConfBase
+LDAP bind dn                                                                  ldapBindDN
+LDAP bind password                                                            ldapBindPassword
+LDAP ObjectClass                                                              ldapObjectClass
+LDAP ID attribute                                                             ldapAttributeId
+LDAP content attribute                                                        ldapAttributeContent
+Certificate authorities file                                                  caFile
+Certificate authorities directory                                             caPath
 MongoDB database                                                              dbName               :doc:`MongoDB<mongodbconfbackend>`
-MongoDB collection                                                            collectionName       
+MongoDB collection                                                            collectionName
 REST base URL                                                                 baseUrl              :doc:`REST<restconfbackend>`
-REST realm                                                                    realm                
-REST user                                                                     user                 
-REST password                                                                 password             
+REST realm                                                                    realm
+REST user                                                                     user
+REST password                                                                 password
 SOAP server location (URL)                                                    proxy                :doc:`SOAP<soapconfbackend>`
-`LWP::UserAgent <http://search.cpan.org/perldoc?LWP::UserAgent>`__ parameters proxyOptions         
-SOAP user                                                                     User                 
-SOAP password                                                                 Password             
+`LWP::UserAgent <http://search.cpan.org/perldoc?LWP::UserAgent>`__ parameters proxyOptions
+SOAP user                                                                     User
+SOAP password                                                                 Password
 ============================================================================= ==================== ===========================================================
diff --git a/doc/sources/admin/passwordstore.rst b/doc/sources/admin/passwordstore.rst
index 88fe688e5..7a4522cea 100644
--- a/doc/sources/admin/passwordstore.rst
+++ b/doc/sources/admin/passwordstore.rst
@@ -12,15 +12,15 @@ password variable in session. To bypass this, LL::NG can remember what
 password was given by user on authentication phase.
 
 
-.. important:: 
+.. important::
+
+
 
-    
-    
     -  As this may be a security hole, password store in session is not
        activated by default
     -  This mechanism can only work with authentication backends using a
        login/password form (:doc:`LDAP<authldap>`, :doc:`DBI<authdbi>`, ...)
-    
+
 
 
 Configuration
@@ -40,7 +40,7 @@ to send it in an header:
    Auth-Password => $_password
 
 
-.. tip:: 
+.. tip::
 
     For security reasons, the password is not shown in sessions
     explorer.
diff --git a/doc/sources/admin/performances.rst b/doc/sources/admin/performances.rst
index 321a606df..93abf2839 100644
--- a/doc/sources/admin/performances.rst
+++ b/doc/sources/admin/performances.rst
@@ -18,22 +18,21 @@ databases:
 ============= ======================== ========== ============================== ==================== ==
 \             Lifetime in memory                  Lifetime in Local-Cache (file)                      DB
 ============= ======================== ========== ============================== ==================== ==
-\             Parameter                Default    Parameter                      Default             
+\             Parameter                Default    Parameter                      Default
 Configuration ``checkTime``            1 second                                  Until "reload" order ✔
-Session       ``handlerInternalCache`` 15 seconds ``default_expires_in``\ (*)    10 minutes           ✔
+Session       ``handlerInternalCache`` 15 seconds ``default_expires_in`` [1]_    10 minutes           ✔
 ============= ======================== ========== ============================== ==================== ==
 
-*(*): Manager >> General parameters >> Sessions >> Sessions storage >>
-Cache module options*
+.. [1] Manager >> General parameters >> Sessions >> Sessions storage >> Cache module options
 
 
-.. important:: 
+.. note::
 
     Configuration and sessions are first looked up in-memory, then in
     the cache file, and then in their backing store. This means that after a
-    configuration reload *(using Manager)*, you have to wait for
+    configuration reload (using Manager), you have to wait for
     ``checkTime`` before you can see your changes, or wait for configuration
-    cache expiration in ``checkTime`` is disabled. 
+    cache expiration in ``checkTime`` is disabled.
 
 Global performance
 ------------------
@@ -58,6 +57,8 @@ installed. You should optimize this to launch:
    (or more)
 -  purgeLocalCache: ~ 1 time per hour on each server
 
+.. _performances-handler-performance:
+
 Handler performance
 -------------------
 
@@ -120,7 +121,7 @@ Example for macros:
 
    # boolean macro
    isAdmin -> $uid eq 'foo' or $uid eq 'bar'
-   # other macro 
+   # other macro
    displayName -> $givenName." ".$surName
 
    # Use a boolean macro in a rule
@@ -148,13 +149,13 @@ Using groups in a rule
    ^/admin -> inGroup('admin')
 
 
-.. important:: 
+.. note::
 
     Groups are computed after macros, so a group rule may involve a
     macro value.
 
 
-.. important:: 
+.. important::
 
     Macros and groups are computed in alphanumeric order,
     that is, in the order they are displayed in the manager. For example,
@@ -180,7 +181,7 @@ stored.
    Display-Name -> $displayName ||= $givenName." ".$surName
 
 
-.. tip:: 
+.. tip::
 
     Note that this feature is interesting only for the
     Lemonldap::NG systems protecting a high number of applications
@@ -207,12 +208,15 @@ portal Parameters » Advanced Parameters » Forms)*. Note that this will
 decrease performances.
 
 
-.. tip:: 
+.. tip::
 
     In production environment for network performance, prefer
     using minified versions of javascript and css libs: use
-    ``make install **PROD=yes**``. This is done by default in RPM/DEB
-    packages. 
+    ``make install PROD=yes``. This is done by default in RPM/DEB
+    packages.
+
+
+.. _performances-apachesession-performances:
 
 Apache::Session performances
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -232,7 +236,7 @@ it can be a bottleneck for the portal:
    following
 
 
-.. tip:: 
+.. tip::
 
     Since 1.9.6, LLNG portal and handler check if session is valid
     at each access, so purgeCentralCache cron no longer needs to be launched
@@ -258,7 +262,7 @@ and use the following parameters:
    Password   -> ...
 
 
-.. tip:: 
+.. tip::
 
     Since version 1.90 of Apache::Session, you can use
     Apache::Session::MySQL::NoLock instead
@@ -290,53 +294,54 @@ Look at :doc:`Browseable session backend<browseablesessionbackend>` to
 known which index to choose.
 
 
-.. important:: 
+.. important::
 
     Some Apache::Session module are not fully usable by
     Lemonldap::NG such as Apache::Session::Memcached since these
     modules do not offer capability to browse sessions. They does not allow
     one to use sessions explorer neither manage one-off sessions.
 
+.. _performance-test:
+
 Performance test
 ^^^^^^^^^^^^^^^^
 
 
-.. tip:: 
+.. tip::
 
     A
-    `Apache::Session::Browseable::Redis <https://metacpan.org/module/Apache::Session::Browseable::Redis>`
+    `Apache::Session::Browseable::Redis <https://metacpan.org/module/Apache::Session::Browseable::Redis>`__
     has been created, it is the fastest (except for session explorer,
-    defeated by
-    Apache::Session::Browseable::DBI <https://metacpan.org/module/Apache::Session::Browseable>`__/`LDAP <https://metacpan.org/module/Apache::Session::Browseable::LDAP>`__])
+    defeated by Apache::Session::Browseable:: `DBI <https://metacpan.org/module/Apache::Session::Browseable>`__ / `LDAP <https://metacpan.org/module/Apache::Session::Browseable::LDAP>`__)
 
 This test isn't an "only-backend" test but embedded some LLNG methods,
 so real differences between engines are mitigate here.
 
 ====================================================================== ============================ =================== ========== =================== ===================================== =================== =============
-Backend                                                                                             Portal and handlers                                Session explorer and one-off sessions                    
-====================================================================== ============================ =================== ========== =================== ===================================== =================== =============
+   Backend                                                                                             Portal and handlers                                Session explorer and one-off sessions
+--------------------------------------------------------------------------------------------------- -------------------------------------------------- -----------------------------------------------------------------------
 Name                                                                   Configuration                Insert 1000         Search 1   Purge 500           Parse all                             Search by substring Search by UID
+====================================================================== ============================ =================== ========== =================== ===================================== =================== =============
 Apache::Session::\ **Browseable::LDAP**                                mdb                          159.66              0.0120     49.22               0.1110                                0.0076              0.0050
 Apache::Session::\ **MySQL**                                           No lock                      87.20               **0.0039** 23.14               0.0281                                0.0252              0.0235
-Apache::Session::\ **Browseable::MySQL**                                                            91.79               **0.0039** **0.139** *(1)*     0.0272                                **0.0036**          **0.0026**
-Apache::Session::\ **Browseable::MySQLJSON**                                                        86.06               0.0145     \*\* 0.151*\* *(2)* **0.0104**                            0.0137              0.0038
+Apache::Session::\ **Browseable::MySQL**                                                            91.79               **0.0039** **0.139** [2]_      0.0272                                **0.0036**          **0.0026**
+Apache::Session::\ **Browseable::MySQLJSON**                                                        86.06               0.0145     \*\* 0.151*\* [3]_  **0.0104**                            0.0137              0.0038
 Apache::Session::\ **Postgres**                                                                     18.31               0.0095     13.40               0.0323                                0.0277              0.0264
 Apache::Session::\ **Postgres**                                        Unlogged table               9.16                0.0095     7.91                0.0318                                0.0270              0.0254
-Apache::Session::\ **Browseable::Postgres**                            Unlogged table with indexes  9.24                0.0094     **0.103** *(1)*     0.0301                                **0.0036**          **0.0028**
-Apache::Session::\ **Browseable::PgJSON**                              Unlogged table, json field   9.25                0.0091     **0.108** *(1)*     0.0247                                **0.0035**          **0.0029**
-Apache::Session::\ **Browseable::PgJSON**                              Unlogged table, jsonb field  9.25                0.0091     **0.105** *(1)*     **0.0126**                            **0.0034**          **0.0029**
-Apache::Session::\ **Browseable::PgHstore**                            Unlogged table, hstore field 9.62                0.0111     **0.105** *(1)*     **0.0125**                            **0.0033**          **0.0029**
+Apache::Session::\ **Browseable::Postgres**                            Unlogged table with indexes  9.24                0.0094     **0.103** [2]_      0.0301                                **0.0036**          **0.0028**
+Apache::Session::\ **Browseable::PgJSON**                              Unlogged table, json field   9.25                0.0091     **0.108** [2]_      0.0247                                **0.0035**          **0.0029**
+Apache::Session::\ **Browseable::PgJSON**                              Unlogged table, jsonb field  9.25                0.0091     **0.105** [2]_      **0.0126**                            **0.0034**          **0.0029**
+Apache::Session::\ **Browseable::PgHstore**                            Unlogged table, hstore field 9.62                0.0111     **0.105** [2]_      **0.0125**                            **0.0033**          **0.0029**
 Apache::Session::\ **Redis**                                                                        **2.13**            **0.0033** 1.158               0.0623                                0.0570              0.0550
 Apache::Session::\ **Browseable::Redis**                                                            **2.36**            **0.0033** 1.154               0.0643                                0.1048              **0.0024**
-*The source of this test is available in sources: e2e-tests/sbperf.pl*                                                                                                                                          
 ====================================================================== ============================ =================== ========== =================== ===================================== =================== =============
 
--  **(1) :**\ *"purge" test is done with
-   Apache::\ :doc:`Session::Browseable-1.2.5<session::browseable-1.2.5>`
-   and LLG-2.0. Earlier results are not so good.*
--  **(2) :**\ *"purge" test is done with
-   Apache::\ :doc:`Session::Browseable-1.2.6<session::browseable-1.2.6>`
-   and LLG-2.0.*
+*The source of this test is available in sources: e2e-tests/sbperf.pl*
+
+.. [2]  "purge" test is done with Apache::Session::Browseable-1.2.5
+   and LLG-2.0. Earlier results are not so good.
+.. [3] "purge" test is done with Apache::Session::Browseable-1.2.6
+   and LLG-2.0.
 
 Analysis:
 
@@ -351,6 +356,8 @@ Analysis:
 -  Browseable::Postgres/PgHstore/PgJSON are the best SQL solutions on
    average
 
+.. _performances-ldap-performances:
+
 LDAP performances
 ~~~~~~~~~~~~~~~~~
 
@@ -371,39 +378,39 @@ overlay <http://www.openldap.org/doc/admin24/overlays.html#Reverse%20Group%20Mem
 to do it automatically.
 
 
-.. important:: 
+.. important::
 
     Don't forget to create an index on the field used to
     find users (uid by default)
 
 
-.. tip:: 
+.. tip::
 
     To avoid storing the full group DNs in session data, you can
     use a macro to rewrite ``memberOf``:
-    
+
     -  In \*Exported variables*, export the ``memberOf`` LDAP attribute as a
        ``ldapGroups`` session variable
-    
+
        -  key: ``ldapGroups``
        -  value: ``memberOf``
-    
+
     -  Next, add a ``ldapGroups`` macro that will overwrite the exported
        attribute
-    
+
        -  key: ``ldapGroups``
        -  value:
-    
+
     ::
-    
+
        join("; ",($ldapGroups =~ /cn=(.*?),/g))
-    
+
     ``ldapGroups`` should now contain something like ``admin; su`` just like
     it would if you had used the regular, slower group resolution mechanism.
-    
+
     You can use
-    :doc:`listMatch($ldapGroups, "some_group")<extendedfunctions>` in your
-    access rules. 
+    :ref:`listMatch($ldapGroups, "some_group")<listMatch>` in your
+    access rules.
 
 NGINX performances
 ~~~~~~~~~~~~~~~~~~
@@ -425,8 +432,8 @@ Edit file /etc/nginx/nginx.conf
 .. code:: perl
 
    gzip on; # active la compression Gzip
-   gzip_disable "msie6"; 
-    
+   gzip_disable "msie6";
+
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
diff --git a/doc/sources/admin/platformsoverview.rst b/doc/sources/admin/platformsoverview.rst
index 7986d797f..b736b9179 100644
--- a/doc/sources/admin/platformsoverview.rst
+++ b/doc/sources/admin/platformsoverview.rst
@@ -63,6 +63,8 @@ ReverseProxy Mode
 **LLNG integration in ReverseProxy webserver** :doc:`Inside<configvhost>` Separate process: External LLNG FastCGI/uWSGI servers
 ============================================== ========================== ==============================================================
 
+.. _platformsoverview-external-servers-for-nginx:
+
 External servers for Nginx
 ~~~~~~~~~~~~~~~~~~~~~~~~~~
 
@@ -71,7 +73,7 @@ Nginx supportes natively FastCGI and uWSGI protocoles.
 Therefore, LLNG services can be provided by compatible external servers.
 
 
-.. tip:: 
+.. tip::
 
     FastCGI or uWSGI server(s) can be installed on separate hosts.
     Also you can imagine a global cloud-FastCGI/uWSGI-service for all your
@@ -96,7 +98,7 @@ However, you can use some other FastCGI server engines:
    Node.js <https://github.com/LemonLDAPNG/node-lemonldap-ng-handler#nginx-authorization-server>`__\ (*)
 
 
-.. warning:: 
+.. warning::
 
     (*) LLNG Node.js handler can only be used as Nginx
     \`auth_request\` server, not to serve Portal or Manager
@@ -104,5 +106,5 @@ However, you can use some other FastCGI server engines:
 uWSGI
 ^^^^^
 
--  uWSGI server *(with uwsgi PSGI plugin, see
-   :doc:`Advanced PSGI usage<psgi>`)*
+-  uWSGI server (with uwsgi PSGI plugin, see
+   :doc:`Advanced PSGI usage<psgi>`)
diff --git a/doc/sources/admin/plugincustom.rst b/doc/sources/admin/plugincustom.rst
index 7501ebb52..8e6cbf439 100644
--- a/doc/sources/admin/plugincustom.rst
+++ b/doc/sources/admin/plugincustom.rst
@@ -65,11 +65,11 @@ Create for example the MyPlugin module:
    vi /usr/share/perl5/Lemonldap/NG/Portal/MyPlugin.pm
 
 
-.. tip:: 
+.. tip::
 
     If you do not want to mix files from the distribution with
     your own work, put your own code in
-    ``/usr/local/lib/site_perl/Lemonldap/NG/Portal/MyPlugin.pm``\ 
+    ``/usr/local/lib/site_perl/Lemonldap/NG/Portal/MyPlugin.pm``\
 
 .. code:: perl
 
@@ -93,16 +93,16 @@ Create for example the MyPlugin module:
              return PE_OK;
    }
    sub hello {
-             my ($self, $req) = @_;          
+             my ($self, $req) = @_;
              ...
              return $self->p->sendJSONresponse($req, { hello => 1 });
    }
    sub welcome {
-             my ($self, $req) = @_;          
-                       
+             my ($self, $req) = @_;
+
              my $userid = $req->user;
              $self->p->logger->debug("Call welcome for $userid");
-             
+
              ...
              return $self->p->sendHtml($req, 'template', params => { WELCOME => 1 });
    }
diff --git a/doc/sources/admin/portal.rst b/doc/sources/admin/portal.rst
index a533280df..b0639480f 100644
--- a/doc/sources/admin/portal.rst
+++ b/doc/sources/admin/portal.rst
@@ -59,13 +59,17 @@ Functioning
 
 LL::NG portal is a modular component. It needs 4 modules to work:
 
--  :doc:`Authentication<start>`: how check user credentials
--  :doc:`User database<start>`: where collect user information
--  :doc:`Password database<start>`: where change password
--  :doc:`Identity provider<start>`: how forward user identity
+-  :ref:`Authentication<start-authentication-users-and-password-databases>`:
+   how check user credentials
+-  :ref:`User database<start-authentication-users-and-password-databases>`:
+   where collect user information
+-  :ref:`Password database<start-authentication-users-and-password-databases>`:
+   where change password
+-  :ref:`Identity provider<start-identity-provider>`: how forward user
+   identity
 
 
-.. tip:: 
+.. tip::
 
     Each module can be disabled using the ``Null`` backend.
 
@@ -87,10 +91,10 @@ Kinematics
 #. Redirect user to the asked URL or display menu
 
 
-.. important:: 
+.. note::
 
     See also
-    :doc:`general kinematics presentation<presentation>`.
+    :ref:`general kinematics presentation<presentation-kinematics>`.
 
 URL parameters
 --------------
diff --git a/doc/sources/admin/portalcustom.rst b/doc/sources/admin/portalcustom.rst
index 1a2843932..46d342484 100644
--- a/doc/sources/admin/portalcustom.rst
+++ b/doc/sources/admin/portalcustom.rst
@@ -2,7 +2,7 @@ Portal customization
 ====================
 
 
-.. important:: 
+.. note::
 
     The portal is the visible part of LemonLDAP::NG, all user
     interactions are displayed on it.
@@ -16,11 +16,11 @@ Portal > Customization > Main Logo.
 A blank value disables Main Logo display.
 
 
-.. tip:: 
+.. tip::
 
     - Logo files must be stored in lemonldap-ng-portal/site/htdocs/static/my/path directory
     - Logo file path must be like my/path/logo.png
-    - Main logo is included in Portal templates AND mail body 
+    - Main logo is included in Portal templates AND mail body
 
 Show languages choice
 ~~~~~~~~~~~~~~~~~~~~~
@@ -31,13 +31,13 @@ Portal > Customization > Show languages choice.
 Option enabled by default.
 
 
-.. tip:: 
+.. tip::
+
+
 
-    
-    
     If languages choice is disabled, Portal displays accepted languages by
     your browser (EN by default).
-    
+
 
 
 Custom CSS file
@@ -59,6 +59,9 @@ Sample CSS file, to remove white background of main logo:
      background-color: transparent;
    }
 
+
+.. _portalcustom-skin-customization:
+
 Skin
 ----
 
@@ -134,7 +137,7 @@ Skin customization
 ~~~~~~~~~~~~~~~~~~
 
 
-.. important:: 
+.. important::
 
     If you modify directly the skin files, your
     modifications will certainly be erased on the next upgrade. The best is
@@ -332,7 +335,7 @@ Password Policy
 ~~~~~~~~~~~~~~~
 
 
-.. tip:: 
+.. tip::
 
     Available since version 2.0.6
 
@@ -346,6 +349,8 @@ Password Policy
 -  **Display policy in password form**: enable this to display an
    information message about password policy constraints
 
+.. _portalcustom-other-parameters:
+
 Other parameters
 ----------------
 
diff --git a/doc/sources/admin/portalmenu.rst b/doc/sources/admin/portalmenu.rst
index b80b85ec7..b546dbd7b 100644
--- a/doc/sources/admin/portalmenu.rst
+++ b/doc/sources/admin/portalmenu.rst
@@ -2,10 +2,12 @@ Portal menu
 ===========
 
 
-.. important:: 
+.. note::
 
     The menu is displayed if authentication is successful.
 
+.. _portalmenu-menu-modules:
+
 Menu modules
 ------------
 
@@ -30,6 +32,8 @@ user authenticated trough LDAP or DBI:
 
    $_auth eq LDAP or $_auth eq DBI
 
+.. _portalmenu-categories-and-applications:
+
 Categories and applications
 ---------------------------
 
@@ -56,13 +60,13 @@ Application parameters:
    -  **Enabled**: always display
    -  **Disabled**: never display
    -  **Automatic**: display only if the user can access it
-   -  **Special rule**: specify a :doc:`rule<writingrulesand_headers>`
+   -  **Special rule**: specify a :ref:`rule<rules>`
       or "sp: <name>" where "name" is the key name of the service
       provider, the corresponding rule will be applied *(available for
       CAS, SAML or OpenID-Connect)*
 
 
-.. tip:: 
+.. tip::
 
     Categories and applications are displayed in alphabetical
     order.
@@ -70,7 +74,7 @@ Application parameters:
 |image1|
 
 
-.. tip:: 
+.. tip::
 
     The chosen logo file must be in portal applications logos
     directory (``portal/htdocs/static/common/apps/``). You can set a custom
diff --git a/doc/sources/admin/prereq.rst b/doc/sources/admin/prereq.rst
index c871e8224..d9c78b9c6 100644
--- a/doc/sources/admin/prereq.rst
+++ b/doc/sources/admin/prereq.rst
@@ -8,8 +8,8 @@ To use LemonLDAP::NG, you have the choice of the Web Server :
 
 -  Nginx
 -  Apache 2
--  Any FastCGI or uWSGI compatible Web Server *(*\ **Portal and manager
-   only**\ *)*
+-  Any FastCGI or uWSGI compatible Web Server ( **Portal and manager
+   only**)
 
 For Apache2, you can use all workers mpm-worker, mpm-prefork and
 mpm-event. Mpm-worker works faster and LemonLDAP::NG use the thread
@@ -23,7 +23,7 @@ Perl
 ----
 
 
-.. important:: 
+.. note::
 
     Here the list of Perl modules used in LemonLDAP::NG. Core modules
     must be installed on the system. Other modules are required only if you
@@ -154,12 +154,14 @@ Install dependencies on your system
 -----------------------------------
 
 
-.. warning:: 
+.. warning::
 
     You don't need to install them if you use LL::NG packages.
     With ``apt`` or ``yum``, dependencies will be automatically
     installed.
 
+.. _prereq-apt-get:
+
 APT
 ~~~
 
@@ -181,15 +183,17 @@ For Nginx:
 
    apt install nginx nginx-extras
 
+.. _prereq-yum:
+
 YUM
 ~~~
 
 
-.. tip:: 
+.. tip::
 
     You need `EPEL <http://fedoraproject.org/wiki/EPEL/>`__
     repository. See below how to enable this repository:
-    http://fedoraproject.org/wiki/EPEL/FAQ#howtouse\ 
+    http://fedoraproject.org/wiki/EPEL/FAQ#howtouse\
 
 Perl dependencies:
 
@@ -210,7 +214,7 @@ For Nginx:
    yum install nginx
 
 
-.. important:: 
+.. important::
 
     As you need a recent version of Nginx, the best is to
     install `Nginx official
diff --git a/doc/sources/admin/presentation.rst b/doc/sources/admin/presentation.rst
index 34718d72d..3b6ee9262 100644
--- a/doc/sources/admin/presentation.rst
+++ b/doc/sources/admin/presentation.rst
@@ -19,7 +19,7 @@ Main components
 
 -  **Manager**: used to manage LemonLDAP::NG configuration and to
    explore sessions. Dedicated to administrators
--  **:doc:`Portal<portal>`**: used to authenticate
+-  :doc:`Portal<portal>`: used to authenticate
    users, display applications list and provides identity provider
    service (`SAML <http://en.wikipedia.org/wiki/SAML>`__,
    `OpenID <http://en.wikipedia.org/wiki/OpenID>`__,
@@ -33,7 +33,7 @@ Databases
 ~~~~~~~~~
 
 
-.. important:: 
+.. important::
 
     We call "database" a backend where we can read or write a data.
     This can be a file, an LDAP directory, ...
@@ -44,7 +44,9 @@ We split databases in two categories:
    user database
 -  **Internal databases**: only used by LemonLDAP::NG
 
-Main :doc:`external databases<start>` are:
+Main
+:ref:`external databases<start-authentication-users-and-password-databases>`
+are:
 
 -  **Authentication**: how authenticate users
 -  **User**: where collect user data
@@ -52,18 +54,23 @@ Main :doc:`external databases<start>` are:
 
 Main internal databases are:
 
--  **:doc:`Configuration<start>`**: where
-   configuration is stored. This does not include web server
+-  :ref:`Configuration<start-configuration-database>`:
+   where configuration is stored. This does not include web server
    configuration which is not managed by LemonLDAP::NG
--  **:doc:`Sessions<start>`**: where sessions are
-   stored.
--  **:doc:`Notifications<notifications>`**:
+-  :ref:`Sessions<start-sessions-database>`:
+   where sessions are stored.
+-  :doc:`Notifications<notifications>`:
    messages displayed to connected users
 -  **Cache**: cache for configuration and sessions
 
+
+.. _presentation-kinematics:
+
 Kinematics
 ----------
 
+.. _presentation-login:
+
 Login
 ~~~~~
 
@@ -71,15 +78,16 @@ Login
 
 #. User tries to access protected application, his request is catched by
    Handler
-#. :doc:`SSO cookies<ssocookie>` is not detected,
-   so Handler redirects user to Portal
+#. :doc:`SSO cookies<ssocookie>` is not
+   detected, so Handler redirects user to Portal
 #. User authenticates on Portal
 #. Portal checks authentication
 #. If authentication succeed, Portal collect user data
 #. Portal creates a session to store user data
 #. Portal gets the session key
-#. Portal creates :doc:`SSO cookies<ssocookie>`
-   with session key as value
+#. Portal creates
+   :doc:`SSO cookies<ssocookie>` with
+   session key as value
 #. User is redirected on protected application, with his new cookie
 #. Handler reads session key from cookie and retrieves user session
    datas
@@ -89,8 +97,8 @@ Login
 #. Handler forwards the response to user
 
 Then handler will check
-:doc:`SSO cookies<ssocookie>` for each HTTP
-request.
+:doc:`SSO cookies<ssocookie>` for each
+HTTP request.
 
 Logout
 ~~~~~~
@@ -101,7 +109,8 @@ Default use case:
 #. Portal destroys session and redirects user on itself with an empty
    :doc:`SSO cookies<ssocookie>`
 #. User is redirected on portal and his
-   :doc:`SSO cookies<ssocookie>` is empty
+   :doc:`SSO cookies<ssocookie>` is
+   empty
 
 LemonLDAP::NG is also able to
 :doc:`catch logout request<writingrulesand_headers>`
@@ -120,48 +129,48 @@ configured URL.
 Session expiration
 ~~~~~~~~~~~~~~~~~~
 
-The session expires after 20 hours by default. 
-.. important:: 
+The session expires after 20 hours by default.
+
+.. important::
 
-    
-    
     -  Handlers have a session cache, with a default lifetime of 10 minutes.
        So for Handlers on different physical servers than the Portal, a user
        with an expired session can still be authorized till the cache
        expires.
     -  Sessions are deleted by a scheduled task. Don't forget to install
        cron files !
-    
 
 
-.. _cross_domain_authentication_cda:
+
+.. _cda:
 
 Cross Domain Authentication (CDA)
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
-.. important:: 
+.. note::
 
     For security reason, a cookie provided for a domain cannot be sent
     to another domain. To extend SSO on several domains, a cross-domain
     mechanism is implemented in LemonLDAP::NG.
 
-#. User owns :doc:`SSO cookies<ssocookie>` on the
-   main domain (see :doc:`Login kinematics<presentation>`)
+#. User owns
+   :doc:`SSO cookies<ssocookie>` on the
+   main domain (see :ref:`Login kinematics<presentation-login>`)
 #. User tries to access a protected application in a different domain
 #. Handler does not see
-   :doc:`SSO cookies<ssocookie>` (because it is
-   not in main domain) and redirects user on Portal
+   :doc:`SSO cookies<ssocookie>`
+   (because it is not in main domain) and redirects user on Portal
 #. Portal recognizes the user with its
-   :doc:`SSO cookies<ssocookie>`, and see he is
-   coming from a different domain
+   :doc:`SSO cookies<ssocookie>`, and
+   see he is coming from a different domain
 #. Portal redirects user on protected application with a token as URL
    parameter. The token is linked to a session which contains the real
    session ID
 #. Handler detects URL parameter, gets the real session ID, delete the
    token session and creates a
-   :doc:`SSO cookies<ssocookie>` on its domain,
-   with session ID as value
+   :doc:`SSO cookies<ssocookie>` on its
+   domain, with session ID as value
 
 Authentication, Authorization and Accounting (AAA) mechanisms
 -------------------------------------------------------------
@@ -190,16 +199,18 @@ Authentication process main steps are:
 -  **Grant session**: check rights to open SSO session
 -  **Store**: store user info in session database
 -  **Build cookie**: build
-   :doc:`SSO cookies<ssocookie>` with session ID
+   :doc:`SSO cookies<ssocookie>` with
+   session ID
 -  **Redirect**: redirect user on protected application or on Portal
    (applications menu)
 
-LemonLDAP::NG :doc:`SSO cookies<ssocookie>` are
+LemonLDAP::NG
+:doc:`SSO cookies<ssocookie>` are
 generated by
 `Apache::Session <http://search.cpan.org/perldoc?Apache::Session>`__,
 they are as secure as a 128-bit random cookie. You may use the
-:doc:`securedCookie<ssocookie>` options to avoid
-session hijacking. (since version 1.4.0 you can use SHA256 for
+:doc:`securedCookie<ssocookie>` options
+to avoid session hijacking. (since version 1.4.0 you can use SHA256 for
 generating safer cookies)
 
 Authorization
@@ -212,7 +223,7 @@ defined by:
 -  An access rule
 
 
-.. important:: 
+.. note::
 
     Authorizations are defined inside a virtualhost and takes effect
     only on it. There are no *global* authorizations except the right to
@@ -242,7 +253,7 @@ Some examples:
    -  Access rule: ``$groups =~ /\badministrators\b/``
 
 
-.. tip:: 
+.. tip::
 
     \ ``\b`` means start or end of a word in PCRE (Perl Compatible
     Regular Expressions)
@@ -271,7 +282,7 @@ The real accounting has to be done by the application itself since SSO
 logs can not understand transactions.
 
 LemonLDAP::NG can export
-:doc:`HTTP headers<writingrulesand_headers>`
+:ref:`HTTP headers<headers>`
 either using a proxy or protecting directly the application.
 
 An HTTP header is defined by:
@@ -280,7 +291,7 @@ An HTTP header is defined by:
 -  A value
 
 
-.. important:: 
+.. note::
 
     Headers are defined inside a virtualhost and take effect only on
     it. There are no *global* headers.
diff --git a/doc/sources/admin/psgi.rst b/doc/sources/admin/psgi.rst
index 03830288a..e3027bbe4 100644
--- a/doc/sources/admin/psgi.rst
+++ b/doc/sources/admin/psgi.rst
@@ -44,7 +44,7 @@ to replace exactly FastCGI server. You can use it :
 -  with uWSGI **(see below)**
 
 
-.. important:: 
+.. important::
 
     Starman, Twiggy,... are HTTP servers, not FastCGI ones
     !
@@ -63,11 +63,11 @@ LLNG FastCGI Server
 ==================== ===================== ===================== ==========================================================================================
 Command-line options                       Environment variable  Explanation
 ==================== ===================== ===================== ==========================================================================================
-Short                Long                                       
+Short                Long
 -p                   --pid                 PID                   Process PID
 -u                   --user                USER                  Unix uid
 -g                   --group               GROUP                 Unix gid
--n                   --proc                NPROC                 Number of process to launch *(FCGI::ProcManager*)*
+-n                   --proc                NPROC                 Number of process to launch *(FCGI::ProcManager)*
 -s                   --socket              SOCKET                Socket to listen to
 -l                   --listen              LISTEN                Listening address. Examples: ``host:port``, ``:port``, ``/socket/path``
 -f                   --customFunctionsFile CUSTOM_FUNCTIONS_FILE File to load for custom functions
@@ -155,7 +155,7 @@ Simple example:
 .. code:: perl
 
    use Plack::Builder;
-     
+
    my $app   = sub { ... };
    builder {
        enable "Auth::LemonldapNG";
diff --git a/doc/sources/admin/public_pages.rst b/doc/sources/admin/public_pages.rst
index 2b6f00323..6c99e3489 100644
--- a/doc/sources/admin/public_pages.rst
+++ b/doc/sources/admin/public_pages.rst
@@ -2,7 +2,7 @@ Public pages
 ============
 
 
-.. important:: 
+.. note::
 
     Public pages are available since version 1.9.8.
 
diff --git a/doc/sources/admin/quickstart.rst b/doc/sources/admin/quickstart.rst
index 4d8999a19..078570cdd 100644
--- a/doc/sources/admin/quickstart.rst
+++ b/doc/sources/admin/quickstart.rst
@@ -2,18 +2,18 @@ Quick start tutorial
 ====================
 
 
-.. important:: 
+.. important::
 
     This tutorial will guide you into a minimal
     installation and configuration procedure. You need some prerequisites:
-    
+
     -  A computer with a GNU/Linux recent distribution (Debian, Ubuntu,
        CentOS, RHEL, ...) with root privileges
     -  A web browser
     -  The possibility to update your local ``hosts`` file, or an easy
        access to your DNS server
     -  A cup of coffee (or tea, we are open minded)
-    
+
 
 
 Installation
@@ -74,7 +74,7 @@ For example on your local computer:
 
 ::
 
-   echo "192.168.1.30 auth.mydomain.com manager.mydomain.com test1.mydomain.com test2.mydomain.com" >> /etc/hosts 
+   echo "192.168.1.30 auth.mydomain.com manager.mydomain.com test1.mydomain.com test2.mydomain.com" >> /etc/hosts
 
 Run
 ---
diff --git a/doc/sources/admin/radius2f.rst b/doc/sources/admin/radius2f.rst
index 8d8f4ae3d..5d1e259eb 100644
--- a/doc/sources/admin/radius2f.rst
+++ b/doc/sources/admin/radius2f.rst
@@ -7,13 +7,13 @@ LemonLDAP::NG) to verify the validity of an OTP using the standard
 Radius protocol.
 
 
-.. tip:: 
+.. tip::
 
     This page is about using Radius to connect to an external 2FA
     system for the *second factor only*. If your 2FA system works by
     concatenating the user's password and their OTP (LinOTP), you should
     probably be using :doc:`regular Radius authentication<authradius>`
-    instead 
+    instead
 
 After choosing the Radius second factor type, the user is prompted with
 a code that will be checked against the Radius server.
diff --git a/doc/sources/admin/rbac.rst b/doc/sources/admin/rbac.rst
index fc240831e..9d19d2f36 100644
--- a/doc/sources/admin/rbac.rst
+++ b/doc/sources/admin/rbac.rst
@@ -87,8 +87,8 @@ application "AAA".
 Gather roles in session
 ^^^^^^^^^^^^^^^^^^^^^^^
 
-Use the :doc:`LDAP group<authldap>` configuration to store roles as
-groups in the user session:
+Use the :ref:`LDAP group<authldap-groups>` configuration to store roles
+as groups in the user session:
 
 -  Base: ou=roles,dc=example,dc=com
 -  Object class: organizationalRole
diff --git a/doc/sources/admin/redirections.rst b/doc/sources/admin/redirections.rst
index c60f53672..1ea9d5819 100644
--- a/doc/sources/admin/redirections.rst
+++ b/doc/sources/admin/redirections.rst
@@ -5,7 +5,7 @@ Handler Redirections
 --------------------
 
 
-.. important:: 
+.. note::
 
     When a user access a Handler without a cookie, he is redirected on
     portal, and the target URL is encoded in redirection URL (to redirect
@@ -25,7 +25,7 @@ These parameters can be configured in Manager, in ``General Parameters``
 > ``Advanced parameters`` > ``Handler redirections``.
 
 
-.. tip:: 
+.. tip::
 
     These settings can be overridden per virtual host, see
     :doc:`virtual host management<configvhost>`.
@@ -73,7 +73,7 @@ Portal Redirections
 -------------------
 
 
-.. important:: 
+.. note::
 
     If a user is redirected from handler to portal for authentication
     and once he is authenticated, portal redirects him to the redirection
diff --git a/doc/sources/admin/renater.rst b/doc/sources/admin/renater.rst
index f118e1301..1104c9c85 100644
--- a/doc/sources/admin/renater.rst
+++ b/doc/sources/admin/renater.rst
@@ -24,8 +24,8 @@ Configure LL::NG as SAML Service Provider with this
 :doc:`documentation<authsaml>`. You don't need to declare any IDP for
 the moment.
 
-Configure :doc:`SAML Discovery Protocol<samlservice>` to redirect users
-on WAYF Service. The endpoint URL is
+Configure :ref:`SAML Discovery Protocol<samlservice-discovery-protocol>`
+to redirect users on WAYF Service. The endpoint URL is
 https://discovery.renater.fr/renater/WAYF.
 
 Metadata import
@@ -93,7 +93,7 @@ Then run the script:
    /usr/share/lemonldap-ng/bin/importMetadataRenater -m https://metadata.federation.renater.fr/renater/main/main-idps-renater-metadata.xml -r -i "idp-renater-" -s "sp-renater-"
 
 
-.. important:: 
+.. important::
 
     You need to add this in cron to refresh metadata into
     LL::NG configuration.
@@ -104,7 +104,7 @@ Add your SP into the federation
 Go to https://federation.renater.fr/registry and register your SP.
 
 
-.. important:: 
+.. important::
 
     Be sure to check all attributes as mandatory to be able
     to get them in SAML assertions.
@@ -122,7 +122,7 @@ Configure LL::NG as SAML Identity Provider with this
 moment.
 
 
-.. important:: 
+.. important::
 
     If your LL::NG server will act as SP and IDP inside
     Renater federation, you need to set the advanced parameter "Override
@@ -173,7 +173,7 @@ Then run the script:
    /usr/share/lemonldap-ng/bin/importMetadataRenater -m https://metadata.federation.renater.fr/renater/main/main-sps-renater-metadata.xml -r -i "idp-renater" -s "sp-renater"
 
 
-.. important:: 
+.. important::
 
     You need to add this in cron to refresh metadata into
     LL::NG configuration.
diff --git a/doc/sources/admin/resetcertificate.rst b/doc/sources/admin/resetcertificate.rst
index f16919861..eddf54bc1 100644
--- a/doc/sources/admin/resetcertificate.rst
+++ b/doc/sources/admin/resetcertificate.rst
@@ -18,14 +18,14 @@ This plugin allows users to reset their certificate informations.
    successfully reset.
 
 
-.. warning:: 
+.. warning::
+
+
 
-    
-    
     ::
-    
+
            LDAP backend supported only
-    
+
 
 
 Configuration
@@ -55,40 +55,40 @@ Go in Manager, ``General Parameters`` → ``Plugins`` →
          * **Certificat reset mail subject **: Subject of mail sent when certificate is reset
          * **Certificat reset mail content **: (optional): Content of mail sent when certificate is reset
          * **Confirmation mail subject**: Subject of mail sent when certificate reset  is asked
-         * **Confirmation mail content**: (optional) Content of mail sent when certificate is asked    
+         * **Confirmation mail content**: (optional) Content of mail sent when certificate is asked
 
 
-.. important:: 
+.. important::
 
     By default, mail contents are empty in order to use
     templates:
-    
+
     ::
-    
+
          * portal/skins/common/mail_certificateConfirm.tpl
          * portal/skins/common/mail_certificateReset.tpl
-    
+
     If you define custom mail contents in Manager, then templates won't be
-    used. 
+    used.
 
 **Other**
 
 ::
 
       * **Reset Page URL**: URL of certificate reset page (default: [PORTAL]/certificateReset)
-      * **Certificate descrition attribute Name**:  Attribute where to save certificate description name (Default description) 
-      * **Certificate hash attribute Name**:  Attribute where to store certificate hash (Default userCertificate;binary)   
+      * **Certificate descrition attribute Name**:  Attribute where to save certificate description name (Default description)
+      * **Certificate hash attribute Name**:  Attribute where to store certificate hash (Default userCertificate;binary)
       * **Minimun duration before expiration**: number of days of validity before certificate expires. Default 0.
 
 
-.. warning:: 
+.. warning::
+
+
 
-    
-    
     ::
-    
+
            .p12 certificates only.
-    
+
 
 
 .. |image0| image:: /documentation/beta.png
diff --git a/doc/sources/admin/resetpassword.rst b/doc/sources/admin/resetpassword.rst
index da58f0716..dea49b9c0 100644
--- a/doc/sources/admin/resetpassword.rst
+++ b/doc/sources/admin/resetpassword.rst
@@ -23,7 +23,7 @@ Kinematics:
    else the mail only confirm that the password was changed
 
 
-.. tip:: 
+.. tip::
 
     If :doc:`LDAP backend<authldap>` is used, and LDAP password
     policy is enabled, the 'password reset flag is set to true when password
@@ -32,7 +32,7 @@ Kinematics:
     :doc:`LDAP configuration<authldap>`.
 
 
-.. tip:: 
+.. tip::
 
     If the user do a new password reset request but there is
     already a request pending, the user can ask the confirmation mail to be
@@ -42,7 +42,7 @@ Configuration
 -------------
 
 The reset password link must be activated, see
-:doc:`portal customization<portalcustom>`.
+:ref:`portal customization<portalcustom-other-parameters>`.
 
 The SMTP server must be setup, see :doc:`SMTP server setup<smtp>`.
 
@@ -62,14 +62,14 @@ Then go in Manager, ``General Parameters`` » ``Plugins`` »
       when password change is asked
 
 
-.. important:: 
+.. important::
 
     By default, mail content are empty in order to use HTML
     templates:
-    
+
     -  portal/skins/common/mail_confirm.tpl
     -  portal/skins/common/mail_password.tpl
-    
+
     If you define mail contents in Manager, HTML templates will not be used.
 
 
diff --git a/doc/sources/admin/rest2f.rst b/doc/sources/admin/rest2f.rst
index f7e0a3c27..9b1baa2ee 100644
--- a/doc/sources/admin/rest2f.rst
+++ b/doc/sources/admin/rest2f.rst
@@ -31,9 +31,9 @@ Arguments are a list of key/value. Key is the name of JSON entry, value
 is attribute or macro name.
 
 
-.. important:: 
+.. important::
 
-    For Verify URL, you should send $code at least
+    For Verify URL, you should send ``$code`` at least
 
 REST Dialog
 -----------
diff --git a/doc/sources/admin/restconfbackend.rst b/doc/sources/admin/restconfbackend.rst
index 96843b3bb..d32c2c6d9 100644
--- a/doc/sources/admin/restconfbackend.rst
+++ b/doc/sources/admin/restconfbackend.rst
@@ -17,7 +17,7 @@ You can retrieve "human readable" error messages:
 If no <lang> provided, 'en' errors file is returned.
 
 
-.. tip:: 
+.. tip::
 
     Note that REST is not a real configuration backend, but just a
     proxy system to access to your configuration over the network
diff --git a/doc/sources/admin/restminihowto.rst b/doc/sources/admin/restminihowto.rst
index d5f94fad3..0de8103e5 100644
--- a/doc/sources/admin/restminihowto.rst
+++ b/doc/sources/admin/restminihowto.rst
@@ -3,8 +3,8 @@ Configure LemonLDAP::NG to use REST proxy mechanism
 
 LL::NG use 2 internal databases to store its configuration and sessions.
 It can be configured to use REST instead of direct access to those
-databases (for remote servers). 
-.. tip:: 
+databases (for remote servers).
+.. tip::
 
     This mechanism can be used to
     secure access for remote servers that cross an unsecured network to
@@ -15,7 +15,7 @@ Use REST for Lemonldap::NG configuration
 
 Steps:
 
--  :doc:`Choose and configure your main configuration storage system<start>`
+-  :ref:`Choose and configure your main configuration storage system<start-configuration-database>`
 -  Follow :doc:`REST configuration backend<restconfbackend>` page
 -  Restart all your remote Apache servers
 
@@ -24,5 +24,5 @@ Use REST for Lemonldap::NG sessions
 
 Steps:
 
--  :doc:`Choose and configure your main sessions storage system<start>`
+-  :ref:`Choose and configure your main sessions storage system<start-sessions-database>`
 -  Follow :doc:`REST sessions backend<restsessionbackend>` page
diff --git a/doc/sources/admin/restservices.rst b/doc/sources/admin/restservices.rst
index de34341b9..138b860de 100644
--- a/doc/sources/admin/restservices.rst
+++ b/doc/sources/admin/restservices.rst
@@ -12,9 +12,10 @@ Authentication
 
 The authentication service is always available with REST, you just need
 to send credentials on portal URL. But by default, the portal is
-protected by :doc:`one time tokens to prevent CSRF<security>`. You must
-disable them or set a rule (configuration parameter ``requireToken``) so
-token will not be required for REST requests, for example:
+protected by :ref:`one time tokens to prevent CSRF<security-portal>`.
+You must disable them or set a rule (configuration parameter
+``requireToken``) so token will not be required for REST requests, for
+example:
 
 .. code:: perl
 
@@ -48,17 +49,17 @@ The JSON response fields are:
    field
 
 
-.. tip:: 
+.. tip::
 
     You can also get the cookie by reading the response header
     ``Cookie`` returned by the portal.
 
 
-.. important:: 
+.. important::
 
     Before version 2.0.4, the response to a success
     authentication had no ``id`` field, and ``error`` field was named
-    ``code`` *(use Cookie header to get id value)*.
+    ``code`` (use Cookie header to get id value).
 
 Example
 ^^^^^^^
@@ -70,15 +71,15 @@ Example
    curl -H "Accept: application/json" -d user=rtyler -d password=rtyler http://auth.example.com/ | json_pp
 
 
-.. important:: 
+.. important::
 
     With ``cURL > 7.18.0``, to include special characters
     like @, & or + in the cURL POST data:
-    
+
     ::
-    
+
        curl -H "Accept: application/json" -d name=rtyler --data-urlencode passwd=@31&3+*J http://auth.example.com/ | json_pp
-    
+
 
 
 -  Response for bad authentication:
@@ -104,7 +105,7 @@ Sessions
 ~~~~~~~~
 
 REST functions for sessions are protected by Web Server, you can change
-this in :doc:`portal configuration<configlocation>`.
+this in :ref:`portal configuration<configlocation-portal>`.
 
 See :doc:`REST session backend documentation<restsessionbackend>` for
 more.
@@ -113,7 +114,7 @@ Configuration
 ~~~~~~~~~~~~~
 
 REST functions for configuration are protected by Web Server, you can
-change this in :doc:`portal configuration<configlocation>`.
+change this in :ref:`portal configuration<configlocation-portal>`.
 
 See :doc:`REST configuration backend documentation<restconfbackend>` for
 more.
diff --git a/doc/sources/admin/restsessionbackend.rst b/doc/sources/admin/restsessionbackend.rst
index 2896c2e58..fba5c3c40 100644
--- a/doc/sources/admin/restsessionbackend.rst
+++ b/doc/sources/admin/restsessionbackend.rst
@@ -14,7 +14,7 @@ LL::NG portal provides REST end points for sessions management:
 -  PUT /sessions/<type>/<session-id> : update some keys
 -  DELETE /sessions/<type>/<session-id> : delete a session
 
-Sessions for connected users *(used by :doc:`LLNG Proxy<authproxy>`)*:
+Sessions for connected users (used by :doc:`LLNG Proxy<authproxy>`):
 
 -  GET /session/my/<type> : get session datas
 -  GET /session/my/<type>/key : get session key
@@ -52,17 +52,24 @@ Then, set ``Lemonldap::NG::Common::Apache::Session::REST`` in
 sensitive):
 
 =================== ======================================== ==================================================
-Required parameters                                         
-=================== ======================================== ==================================================
+Required parameters
+---------------------------------------------------------------------------------------------------------------
 Name                Comment                                  Example
+=================== ======================================== ==================================================
 **baseUrl**         URL of sessions REST end point           http://auth.example.com/index.fcgi/sessions/global
-Optional parameters                                         
+=================== ======================================== ==================================================
+
+=================== ======================================== ==================================================
+Optional parameters
+---------------------------------------------------------------------------------------------------------------
+Name                Comment                                  Example
+=================== ======================================== ==================================================
 **user**            Username to use for auth basic mechanism
 **password**        Password to use for auth basic mechanism
 =================== ======================================== ==================================================
 
 
-.. important:: 
+.. important::
 
     By default, user password and other secret keys are
     hidden by LLNG REST server. You can force REST server to export their
@@ -99,7 +106,7 @@ For example, if real sessions are stored in
    globalStorageOptions = { 'Directory' => '/var/lib/lemonldap-ng/sessions/', 'LockDirectory' => '/var/lib/lemonldap-ng/sessions/lock/', }
 
 
-.. tip:: 
+.. tip::
 
     Session explorer and "single session" features can't be used
     using this backend. Session explorer and portal must be launched with
diff --git a/doc/sources/admin/rules_examples.rst b/doc/sources/admin/rules_examples.rst
index 526e0b5d9..6a46b7390 100644
--- a/doc/sources/admin/rules_examples.rst
+++ b/doc/sources/admin/rules_examples.rst
@@ -2,7 +2,7 @@ Rules examples
 ==============
 
 This page contains a few useful Perl expressions you can use in your
-:doc:`Handler rules<writingrulesand_headers>`, SAML/OIDC/CAS security
+:ref:`Handler rules<rules>`, SAML/OIDC/CAS security
 rules, 2FA Activation rules, etc.
 
 Using session attributes
@@ -22,10 +22,10 @@ attribute you see there can be used in a rule!
    etc.
 
 
-.. tip:: 
+.. tip::
 
     In Perl, ``eq`` means *Equal* and must be used on strings.
-    ``==`` should be used only on numbers 
+    ``==`` should be used only on numbers
 
 -  Restricting access to specific groups
 
@@ -65,11 +65,11 @@ attribute you see there can be used in a rule!
    $_auth ne 'Demo'
 
 
-.. tip:: 
+.. tip::
 
     In Perl, ``ne`` means *Not Equal* and must be used on
     strings. ``\b`` means *word Boundary*. (?:) means *non capturing*
-    parenthesis. 
+    parenthesis.
 
 Using environment variables
 ---------------------------
diff --git a/doc/sources/admin/samlservice.rst b/doc/sources/admin/samlservice.rst
index 27d123c28..e784fa313 100644
--- a/doc/sources/admin/samlservice.rst
+++ b/doc/sources/admin/samlservice.rst
@@ -2,7 +2,7 @@ SAML service configuration
 ==========================
 
 
-.. important:: 
+.. note::
 
     SAML service configuration is a common step to configure LL::NG as
     :doc:`SAML SP<authsaml>` or :doc:`SAML IDP<idpsaml>`.
@@ -18,7 +18,7 @@ particular:
 -  Set SAML end points
 
 
-.. important:: 
+.. important::
 
     Service configuration will be used to generate LL::NG
     SAML metadata, that will be shared with other providers. It means that
@@ -45,7 +45,7 @@ You can use official Debian packages or those available here:
 http://deb.entrouvert.org/.
 
 
-.. tip:: 
+.. tip::
 
     We recommend Lasso 2.6 for the SHA256 support, so use the
     stretch-testing repository of deb.entrouvert.org.
@@ -60,7 +60,7 @@ RHEL/CentOS/Fedora
 ^^^^^^^^^^^^^^^^^^
 
 RPMs are available in LL::NG RPM "extras" repository (see
-:doc:`installrpm#yum_repository<installrpm>`)
+:ref:`installrpm#yum_repository<installrpm-yum-repository>`)
 
 Then install lasso and lasso-perl packages:
 
@@ -69,7 +69,7 @@ Then install lasso and lasso-perl packages:
    yum install lasso lasso-perl
 
 
-.. important:: 
+.. important::
 
     Only 64bits package are available.
 
@@ -85,7 +85,7 @@ Service configuration
 Go in Manager and click on ``SAML 2 Service`` node.
 
 
-.. tip:: 
+.. tip::
 
     You can use #PORTAL# in values to replace the portal
     URL.
@@ -97,18 +97,20 @@ Your EntityID, often use as metadata URL, by default
 #PORTAL#/saml/metadata.
 
 
-.. important:: 
+.. note::
 
     The value will be use in metadata main markup:
-    
+
     .. code:: xml
-    
+
        <EntityDescriptor entityID="http://auth.example.com/saml/metadata">
          ...
        </EntityDescriptor>
-    
 
 
+
+.. _samlservice-security-parameters:
+
 Security parameters
 ~~~~~~~~~~~~~~~~~~~
 
@@ -122,7 +124,7 @@ To define keys, you can:
 -  generate new public and private keys (``New keys`` button)
 
 
-.. tip:: 
+.. tip::
 
     You can enter a password to protect private key with a
     password. It will be prompted if you generate keys, else you can set it
@@ -136,16 +138,16 @@ SAML components (expiration date, common name, etc.), but will just be a
 public key wrapper.
 
 
-.. tip:: 
+.. tip::
 
     You can easily generate a certificate to replace your public
     key by saving the private key in a file, and use ``openssl`` commands to
     issue a self-signed certificate:
-    
+
     ::
-    
+
        $ openssl req -new -key private.key -out cert.pem -x509 -days 3650
-    
+
 
 
 -  **Use certificate in response**: Certificate will be sent inside SAML
@@ -153,7 +155,7 @@ public key wrapper.
 -  **Signature method**: set the signature algorithm
 
 
-.. important:: 
+.. important::
 
     Default value is RSA SHA1 for compatibility purpose but
     we recommend to use RSA SHA256. This requires to test all partners to
@@ -167,7 +169,7 @@ identifier, carried in SAML messages. You can configure here which field
 of LL::NG session will be associated to a NameID format.
 
 
-.. important:: 
+.. note::
 
     This parameter is used by :doc:`SAML IDP<idpsaml>` to fill the
     NameID in authentication responses.
@@ -180,7 +182,7 @@ Customizable NameID formats are:
 -  Kerberos
 
 
-.. tip:: 
+.. tip::
 
     For example, if you are using
     :doc:`AD as authentication backend<authldap>`, you can use
@@ -192,6 +194,8 @@ Other NameID formats are automatically managed:
 -  **Persistent**: NameID is restored from previous sessions
 -  **Undefined**: Default NameID format is used
 
+.. _samlservice-authentication-contexts:
+
 Authentication contexts
 ~~~~~~~~~~~~~~~~~~~~~~~
 
@@ -200,7 +204,7 @@ be associated to an `SAML authentication
 context <http://docs.oasis-open.org/security/saml/v2.0/saml-authn-context-2.0-os.pdf>`__.
 
 
-.. important:: 
+.. note::
 
     This parameter is used by :doc:`SAML IDP<idpsaml>` to fill the
     authentication context in authentication responses. It will use the
@@ -220,19 +224,19 @@ Organization
 ~~~~~~~~~~~~
 
 
-.. important:: 
+.. note::
 
     This concerns all parameters for the Organization metadata
     section:
-    
+
     .. code:: xml
-    
+
        <Organization>
          <OrganizationName xml:lang="en">Example</OrganizationName>
          <OrganizationDisplayName xml:lang="en">Example</OrganizationDisplayName>
          <OrganizationURL xml:lang="en">http://www.example.com</OrganizationURL>
        </Organization>
-    
+
 
 
 -  **Display Name**: should be displayed on IDP, this is often your
@@ -244,19 +248,20 @@ Service Provider
 ~~~~~~~~~~~~~~~~
 
 
-.. important:: 
+.. note::
 
     This concerns all parameters for the Service Provider metadata
     section:
-    
+
     .. code:: xml
-    
+
        <SPSSODescriptor>
          ...
        </SPSSODescriptor>
-    
 
 
+.. _samlservice-general-options:
+
 General options
 ^^^^^^^^^^^^^^^
 
@@ -266,7 +271,7 @@ General options
    assertions are signed.
 
 
-.. tip:: 
+.. tip::
 
     These options can then be overridden for each Identity
     Provider.
@@ -308,17 +313,17 @@ Identity Provider
 ~~~~~~~~~~~~~~~~~
 
 
-.. important:: 
+.. note::
 
     This concerns all parameters for the Service Provider metadata
     section:
-    
+
     .. code:: xml
-    
+
        <IDPSSODescriptor>
          ...
        </IDPSSODescriptor>
-    
+
 
 
 General parameters
@@ -329,7 +334,7 @@ General parameters
      * **Want Authentication Request Signed**: set to On to require that received authentication request are signed.
 
 
-.. tip:: 
+.. tip::
 
     This option can then be overridden for each Service
     Provider.
@@ -377,17 +382,17 @@ Attribute Authority
 ~~~~~~~~~~~~~~~~~~~
 
 
-.. important:: 
+.. note::
 
     This concerns all parameters for the Attribute Authority metadata
     section
-    
+
     .. code:: xml
-    
+
        <AttributeAuthorityDescriptor>
          ...
        </AttributeAuthorityDescriptor>
-    
+
 
 
 Attribute Service
@@ -423,20 +428,22 @@ customize it:
    this case, you can fill here the IDP entityID, for example:
    ``https://auth.example.com/saml/metadata/idp``.
 
+.. _samlservice-saml-sessions-module-name-and-options:
+
 SAML sessions module name and options
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
 By default, the main session module is used to store SAML temporary data
 (like relay-states), but SAML sessions need to use a session module
 compatible with the
-:doc:`sessions restrictions feature<features>`.
+:ref:`sessions restrictions feature<session-restrictions>`.
 
 This is not the case of :doc:`Memcached<memcachedsessionbackend>` for
 example. In this case, you can choose a different module to manage SAML
 sessions.
 
 
-.. tip:: 
+.. tip::
 
     You can also choose a different session module to split SSO
     sessions and SAML sessions.
@@ -458,11 +465,13 @@ Configuration parameters are:
 -  **Writer URL**: URL used by SAML IDP to write the cookie. Leave blank
    to deactivate the feature.
 
+.. _samlservice-discovery-protocol:
+
 Discovery Protocol
 ^^^^^^^^^^^^^^^^^^
 
 
-.. important:: 
+.. note::
 
     Discovery Protocol is also know as `WAYF
     Service <http://www.switch.ch/aai/support/tools/wayf.html>`__. More
@@ -474,7 +483,7 @@ Instead user is redirected on the discovery service and is redirected
 back to LL::NG with the chosen IDP.
 
 
-.. important:: 
+.. important::
 
     If the chosen IDP is not registered in LL::NG, user will
     be redirected to discovery service again.
diff --git a/doc/sources/admin/secondfactor.rst b/doc/sources/admin/secondfactor.rst
index f0b1bea77..92f7c2b9a 100644
--- a/doc/sources/admin/secondfactor.rst
+++ b/doc/sources/admin/secondfactor.rst
@@ -29,18 +29,18 @@ The E-Mail, External and REST 2F modules
 parameters.
 
 
-.. tip:: 
+.. tip::
 
     If you want to force a 2F registration on first login, you can
     use 'Require 2FA'. You can also use a rule to force 2FA registration
-    only for some users. 
-.. tip:: 
+    only for some users.
+.. tip::
 
     You can display a message if an
     expired second factor has been removed by enabling 'Display a message if
-    an expired SF is removed' option or setting a rule. 
+    an expired SF is removed' option or setting a rule.
 
-.. tip:: 
+.. tip::
 
     Link to second factor Manager is automatically display if at least a
     SFA module is enabled. You can set a rule to display or not the
diff --git a/doc/sources/admin/securetoken.rst b/doc/sources/admin/securetoken.rst
index 2b4f40a4d..eaa2439c4 100644
--- a/doc/sources/admin/securetoken.rst
+++ b/doc/sources/admin/securetoken.rst
@@ -32,7 +32,7 @@ set type in your configuration file:
    ``fastcgi_param VHOSTTYPE SecureToken;``
 
 
-.. important:: 
+.. note::
 
     This handler uses Apache2Filter Module to hide token, prefer
     :doc:`Handling server webservice calls<servertoserver>` for other
@@ -58,13 +58,13 @@ SecureToken parameters are the following:
    application without secure token (default: yes)
 
 
-.. important:: 
+.. important::
 
     Due to Handler API change in 1.9, you need to set these
     attributes in ``lemonldap-ng.ini`` and not in Manager, for example:
-    
+
     .. code:: ini
-    
+
        [handler]
        secureTokenMemcachedServers = 127.0.0.1:11211
        secureTokenExpiration = 60
@@ -72,5 +72,5 @@ SecureToken parameters are the following:
        secureTokenUrls = .*
        secureTokenHeader = Auth-Token
        secureTokenAllowOnError = 1
-    
+
 
diff --git a/doc/sources/admin/security.rst b/doc/sources/admin/security.rst
index 755b5ed06..fdacc7c4b 100644
--- a/doc/sources/admin/security.rst
+++ b/doc/sources/admin/security.rst
@@ -12,7 +12,7 @@ use more than 1 server. If some of your servers are not in the same
 :doc:`SOAP access<soapconfbackend>` for those servers.
 
 
-.. tip:: 
+.. tip::
 
     You can use different type of access:
     :doc:`SQL<sqlconfbackend>`, :doc:`File<fileconfbackend>` or
@@ -20,7 +20,8 @@ use more than 1 server. If some of your servers are not in the same
     :doc:`SOAP<soapconfbackend>` for remote servers.
 
 Next, you have to configure the SOAP access as described
-:doc:`here<soapconfbackend>` since SOAP access is denied by default.
+:ref:`here<soapconfbackend-next-configure-soap-for-your-remote-servers>`
+since SOAP access is denied by default.
 
 Protect the Manager
 -------------------
@@ -70,13 +71,16 @@ To protect the manager by LL::NG, you just have to set this in
    protection = manager
 
 
-.. important:: 
+.. important::
 
     Before, you have to create the virtual host
     ``manager.your.domain`` in the manager and set a
-    :doc:`rules<writingrulesand_headers>`, else access to the manager will
+    :ref:`rule<rules>`, else access to the manager will
     be denied.
 
+
+.. _security-portal:
+
 Portal
 ------
 
@@ -107,16 +111,16 @@ LLNG portal now embeds the following features:
    Security » Cross-Origin Resource Sharing)*
 
 
-.. important:: 
+.. important::
+
+
 
-    
-    
     -  Brute-force attack protection is DISABLED by default
     -  Browser implementations of formAction directive are inconsistent
        (e.g. Firefox doesn't block the redirects whereas Chrome does).
        Administrators may have to modify formAction value with wildcard
        likes ``*``.
-    
+
 
 
 Split portal when using SOAP/REST
@@ -126,17 +130,19 @@ If you use :doc:`SOAP<soapsessionbackend>` or
 :doc:`REST<restsessionbackend>` session backend, dedicate a portal
 especially for these internal requests.
 
+.. _security-write-good-rules:
+
 Write good rules
 ----------------
 
 Order your rules
 ~~~~~~~~~~~~~~~~
 
-:doc:`Rules<writingrulesand_headers>` are applied in alphabetical order
+:ref:`Rules<rules>` are applied in alphabetical order
 (comment and regular expression). The first matching rule is applied.
 
 
-.. important:: 
+.. important::
 
     The "default" rule is only applied if no other rule
     matchs
@@ -151,7 +157,7 @@ For example, if these rules are used without comments:
 Regular expression Rule           Comment
 ================== ============== =======
 ^/pub/admin/       $uid eq "root"
-^/pub/             accept        
+^/pub/             accept
 ================== ============== =======
 
 Then the second rule will be applied first, so every authenticated user
@@ -167,52 +173,52 @@ Regular expression Rule           Comment
 ================== ============== =======
 
 
-.. tip:: 
+.. tip::
+
+
 
-    
-    
     -  Reload the Manager to see the effective order
     -  Use rule comments to order your rules
-    
+
 
 
 Be careful with URL parameters
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-You can write :doc:`rules<writingrulesand_headers>` matching any
+You can write :ref:`rules<rules>` matching any
 component of URL to protect including GET parameters, but be careful.
 
 For example with this rule on the ``access`` parameter:
 
-=========================== ====================== =======
-Regular expression          Rule                   Comment
-=========================== ====================== =======
-^/index.php\?.*access=admin $groups =~ /\badmin\b/
-default                     accept                
-=========================== ====================== =======
+=============================== ========================== =======
+Regular expression              Rule                       Comment
+=============================== ========================== =======
+``^/index.php\?.*access=admin`` ``$groups =~ /\badmin\b/``
+``default``                     ``accept``
+=============================== ========================== =======
 
 Then a user that try to access to one of the following will be granted !
 
--  /index.php?access=admin&access=other
--  /index.php?Access=admin
+-  ``/index.php?access=admin&access=other``
+-  ``/index.php?Access=admin``
 
 You can use the following rules instead:
 
-================================= ====================== =======
-Regular expression                Rule                   Comment
-================================= ====================== =======
-^/(?i)index.php\?.*access.*access deny                   0_bad
-^/(?i)index.php\?.*access=admin   $groups =~ /\badmin\b/ 1_admin
-default                           accept                
-================================= ====================== =======
+===================================== ========================== =======
+Regular expression                    Rule                       Comment
+===================================== ========================== =======
+``^/(?i)index.php\?.*access.*access`` ``deny``                   0_bad
+``^/(?i)index.php\?.*access=admin``   ``$groups =~ /\badmin\b/`` 1_admin
+``default``                           ``accept``
+===================================== ========================== =======
 
 
-.. tip:: 
+.. tip::
 
-    \ **(?i)** means case no sensitive.
+     **(?i)** means case no sensitive.
 
 
-.. warning:: 
+.. warning::
 
     Remember that rules written on GET parameters must be
     tested.
@@ -229,7 +235,7 @@ IP in rules
 ~~~~~~~~~~~
 
 
-.. warning:: 
+.. warning::
 
     If you are running LemonLDAP::NG behind a reverse proxy,
     make sure you check the
@@ -238,6 +244,8 @@ IP in rules
     you only specify trusted proxy addresses so that an attacker cannot
     forge the ``X-Forwarded-For`` header
 
+.. _security-reverseproxies:
+
 Secure reverse-proxies
 ----------------------
 
@@ -284,6 +292,8 @@ of:
    parameters in `mod_ssl
    documentation <http://httpd.apache.org/docs/2.2/mod/mod_ssl.html>`__)
 
+.. _security-configure-security-settings:
+
 Configure security settings
 ---------------------------
 
@@ -340,19 +350,19 @@ Go in Manager, ``General parameters`` » ``Advanced parameters`` »
    ``Access-Control-Allow-Origin`` value with ' '.
 
 
-.. important:: 
+.. important::
 
     If URLs are protected with AuthBasic handler, you have
     to disable CSRF token by setting a special rule based on callers IP
     address like this :
-    
-    requireToken => $env->{REMOTE_ADDR} !~ /^127\.0\.[1-3]\.1$/ 
 
-.. warning:: 
+    requireToken => $env->{REMOTE_ADDR} !~ /^127\.0\.[1-3]\.1$/
+
+.. warning::
 
     Enable global storage for one time tokens will downgrade
     Portal performance!!!
-    
+
     Must ONLY be use with outdated or low performance Load Balancer.
 
 Fail2ban
@@ -416,7 +426,8 @@ We recommend to use :
 SAML
 ----
 
-See :doc:`samlservice#security_parameters<samlservice>`
+See
+:ref:`samlservice#security_parameters<samlservice-security-parameters>`
 
 .. |image0| image:: /documentation/manager-rule.png
    :class: align-center
diff --git a/doc/sources/admin/selfmadeapplication.rst b/doc/sources/admin/selfmadeapplication.rst
index 87a0b5be9..5032e5feb 100644
--- a/doc/sources/admin/selfmadeapplication.rst
+++ b/doc/sources/admin/selfmadeapplication.rst
@@ -11,19 +11,19 @@ Your application can know the connected user using:
 -  HTTP header (in all cases)
 
 To get more information on user (name, mail, etc.), you have to read
-:doc:`HTTP headers<writingrulesand_headers>`.
+:ref:`HTTP headers<headers>`.
 
 
-.. tip:: 
+.. tip::
 
     If your application is based on `Perl CGI
     package <http://search.cpan.org/perldoc?CGI>`, you can simply replace
-    CGI by Lemonldap::NG::Handler::CGI 
+    CGI by Lemonldap::NG::Handler::CGI
 
 Code snippet
 ------------
 
-Examples with a :doc:`configured header<writingrulesand_headers>` named
+Examples with a :ref:`configured header<headers>` named
 'Auth-User':
 
 Perl
@@ -40,6 +40,8 @@ PHP
 
    print "Connected user: ".$_SERVER["HTTP_AUTH_USER"];
 
+.. _selfmadeapplication-perl-auto-protected-cgi:
+
 Perl auto-protected CGI
 -----------------------
 
@@ -51,9 +53,9 @@ First create a PSGI module based on Lemonldap::NG::Handler:
 .. code:: perl
 
    package My::PSGI;
-     
+
    use base "Lemonldap::NG::Handler::PSGI"; # or Lemonldap::NG::Handler::PSGI::OAuth2, etc…
-     
+
    sub init {
        my ($self,$args) = @_;
        $self->protection('manager');
@@ -66,17 +68,17 @@ First create a PSGI module based on Lemonldap::NG::Handler:
        # $self->error
        return 1;
    }
-     
+
    sub handler {
        my ( $self, $req ) = @_;
 
        # Will be called only if authorisated
        my $userId = $self->userId($req);
        #...
-       
+
        # Return JSON
        # $self->sendJSONresponse(...);
-       
+
        # or Return HTML
        $self->sendHtml($req, "myskin/mytemplate", ( params => { 'userId' => $userId }) );
    }
@@ -86,7 +88,7 @@ They create a FCGI script like this:
 .. code:: perl
 
    #!/usr/bin/env perl
-    
+
    use My::PSGI;
    use Plack::Handler::FCGI;
 
diff --git a/doc/sources/admin/servertoserver.rst b/doc/sources/admin/servertoserver.rst
index 69bbbb05a..903b863a4 100644
--- a/doc/sources/admin/servertoserver.rst
+++ b/doc/sources/admin/servertoserver.rst
@@ -50,7 +50,7 @@ You can also set ServiceToken default timeout (30 seconds) by editing
    handlerServiceTokenTTL = 30
 
 
-.. important:: 
+.. note::
 
     Service token timeout can be set for each virtual hosts.
 
diff --git a/doc/sources/admin/sessions.rst b/doc/sources/admin/sessions.rst
index 2dbd5277e..a0d3a53a7 100644
--- a/doc/sources/admin/sessions.rst
+++ b/doc/sources/admin/sessions.rst
@@ -3,7 +3,7 @@ Sessions
 
 LL::NG rely on a session mechanism with the session ID as a shared
 secret between the user (in :doc:`SSO cookie<ssocookie>`) and the
-:doc:`session database<start>`.
+:ref:`session database<start-sessions-database>`.
 
 To configure sessions, go in Manager, ``General Parameters`` »
 ``Sessions``:
@@ -17,7 +17,7 @@ To configure sessions, go in Manager, ``General Parameters`` »
    when activity timeout is set.
 
 
-.. warning:: 
+.. warning::
 
     Session activity timeout requires Handlers to have a write
     access to sessions database.
@@ -26,9 +26,9 @@ To configure sessions, go in Manager, ``General Parameters`` »
    session, see :doc:`Grant Session plugin documentation<grantsession>`
 -  **Sessions Storage**: you can define here which session backend to
    use, with the backend options. See
-   :doc:`sessions database configuration<start>` to know which modules
-   you can use. Here are some global options that you can use with all
-   sessions backends:
+   :ref:`sessions database configuration<start-sessions-database>` to
+   know which modules you can use. Here are some global options that you
+   can use with all sessions backends:
 
    -  **generateModule**: allows one to override the default module that
       generates sessions identifiers. For security reasons, we recommend
@@ -47,7 +47,7 @@ To configure sessions, go in Manager, ``General Parameters`` »
       that belong to a different user on that IP address are removed
    -  **Display deleted sessions**: display deleted sessions on
       authentication phase.
-   -  \**Display other sessions \**: display other sessions on
+   -  **Display other sessions**: display other sessions on
       authentication phase, with a link to delete them.
 
 -  **Persistent sessions**: are used for storing users log in history,
@@ -58,7 +58,7 @@ To configure sessions, go in Manager, ``General Parameters`` »
    -  **Disable storage**: Do not store user persitent sessions.
 
 
-.. important:: 
+.. important::
 
     Note that since HTTP protocol is not connected,
     restrictions are not applied to the new session: the oldest are
@@ -74,7 +74,7 @@ Command-line tools
 .. code:: shell
 
    # Delete all sessions opened by user "dwho"
-   $ llngDeleteSession dwho 
+   $ llngDeleteSession dwho
    # Delete all sessions opened by user starting with "dh"
    $ llngDeleteSession dh*
    # Delete all sessions:
diff --git a/doc/sources/admin/sfextra.rst b/doc/sources/admin/sfextra.rst
index b4173475c..236defdd8 100644
--- a/doc/sources/admin/sfextra.rst
+++ b/doc/sources/admin/sfextra.rst
@@ -49,24 +49,21 @@ factors of the same type.
 See the :doc:`parameters list<parameterlist>` page for a full list of
 parameters you may overload. Here are the most useful ones:
 
--  E-Mail
-
-::
-
-       * ''mail2fLogo''
-       * ''mailSessionKey''
-       * ''mail2fCodeRegex''
-       * ''mail2fSubject''
-       * ''mail2fBody''
-   * External
-       * ''ext2fLogo''
-       * ''ext2fCodeActivation''
-       * ''ext2FSendCommand''
-       * ''ext2FValidateCommand''
-   * REST
-       * ''rest2fLogo''
-       * ''rest2fVerifyUrl''
-       * ''rest2fVerifyArgs'' (must be a JSON object)
-       * ''rest2fInitUrl''
-       * ''rest2fInitArgs'' (must be a JSON object)
+* E-Mail
+   * ``mail2fLogo``
+   * ``mailSessionKey``
+   * ``mail2fCodeRegex``
+   * ``mail2fSubject``
+   * ``mail2fBody``
+* External
+   * ``ext2fLogo``
+   * ``ext2fCodeActivation``
+   * ``ext2FSendCommand``
+   * ``ext2FValidateCommand``
+* REST
+   * ``rest2fLogo``
+   * ``rest2fVerifyUrl``
+   * ``rest2fVerifyArgs`` (must be a JSON object)
+   * ``rest2fInitUrl``
+   * ``rest2fInitArgs`` (must be a JSON object)
 
diff --git a/doc/sources/admin/smtp.rst b/doc/sources/admin/smtp.rst
index dc2311170..092792d7a 100644
--- a/doc/sources/admin/smtp.rst
+++ b/doc/sources/admin/smtp.rst
@@ -13,10 +13,10 @@ Go in ``General Parameters`` > ``Advanced Parameters`` > ``SMTP``:
      * ** SSL/TLS protocol** and **SSL/TLS options**: Here you can enable SMTPS or startTLS
 
 
-.. tip:: 
+.. tip::
+
+
 
-    
-    
     -  If no SMTP server is configured, the mail will be sent via the local
        sendmail program. Else, Net::SMTP module is required to use the SMTP
        server
@@ -24,7 +24,7 @@ Go in ``General Parameters`` > ``Advanced Parameters`` > ``SMTP``:
        ``mail.example.com:25``
     -  If authentication is configured, ``Authen::SASL`` and
        ``MIME::Base64`` modules are required
-    
+
 
 
 -  **Mail headers**:
diff --git a/doc/sources/admin/soapconfbackend.rst b/doc/sources/admin/soapconfbackend.rst
index 0eeb20f2e..5ad5ac4a8 100644
--- a/doc/sources/admin/soapconfbackend.rst
+++ b/doc/sources/admin/soapconfbackend.rst
@@ -5,16 +5,16 @@ You can share your configuration over the network using SOAP proxy
 system.
 
 
-.. tip:: 
+.. tip::
 
     Note that SOAP is not a real configuration backend, but just a
     proxy system to access to your configuration over the network
 
 
-.. important:: 
+.. important::
 
     SOAP has been deprecated. Prefer to use
-    :doc:`REST configuration backend<restconfbackend>`\ 
+    :doc:`REST configuration backend<restconfbackend>`\
 
 Configuration
 -------------
@@ -31,7 +31,7 @@ First, configure your real backend
 -  Configure your web server to allow remote access. Remote SOAP access
    is disabled by default. You must change it as follow :
 
-\* in ``portal-apache2.conf`` :
+- in ``portal-apache2.conf`` :
 
 .. code:: apache
 
@@ -40,7 +40,7 @@ First, configure your real backend
        Require ip 192.168.2.0/24
    </Location>
 
-\* in ``portal-nginx.conf`` :
+- in ``portal-nginx.conf`` :
 
 .. code:: nginx
 
@@ -49,6 +49,8 @@ First, configure your real backend
      allow 192.168.2.0/24;
    }
 
+.. _soapconfbackend-next-configure-soap-for-your-remote-servers:
+
 Next, configure SOAP for your remote servers
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
diff --git a/doc/sources/admin/soapminihowto.rst b/doc/sources/admin/soapminihowto.rst
index 496f36112..494e9c359 100644
--- a/doc/sources/admin/soapminihowto.rst
+++ b/doc/sources/admin/soapminihowto.rst
@@ -3,8 +3,8 @@ Configure LemonLDAP::NG to use SOAP proxy mechanism
 
 LL::NG use 2 internal databases to store its configuration and sessions.
 It can be configured to use SOAP instead of direct access to those
-databases (for remote servers). 
-.. tip:: 
+databases (for remote servers).
+.. tip::
 
     This mechanism can be used to
     secure access for remote servers that cross an unsecured network to
@@ -17,7 +17,7 @@ Use SOAP for Lemonldap::NG configuration
 
 Steps:
 
--  :doc:`Choose and configure your main configuration storage system<start>`
+-  :ref:`Choose and configure your main configuration storage system<start-configuration-database>`
 -  Follow :doc:`SOAP configuration backend<soapconfbackend>` page
 -  Restart all your remote Apache servers
 
@@ -26,5 +26,5 @@ Use SOAP for Lemonldap::NG sessions
 
 Steps:
 
--  :doc:`Choose and configure your main sessions storage system<start>`
+-  :ref:`Choose and configure your main sessions storage system<start-sessions-database>`
 -  Follow :doc:`SOAP sessions backend<soapsessionbackend>` page
diff --git a/doc/sources/admin/soapservices.rst b/doc/sources/admin/soapservices.rst
index 3c781982b..2dd7f6721 100644
--- a/doc/sources/admin/soapservices.rst
+++ b/doc/sources/admin/soapservices.rst
@@ -10,7 +10,7 @@ Portal SOAP services
 
 SOAP functions are not accessible by network by default. SOAP functions
 are protected by Web Server, you can change this in
-:doc:`portal configuration<configlocation>`.
+:ref:`portal configuration<configlocation-portal>`.
 
 -  Read-only functions (index.pl/sessions or index.pl/adminSessions
    paths):
@@ -42,12 +42,12 @@ are protected by Web Server, you can change this in
       :doc:`Notifications system<notifications>` for more)
 
 
-.. important:: 
+.. important::
 
     When you use
     :doc:`SOAP sessions backend<soapsessionbackend>`, it is recommended to
     use read-only URL (/index.fcgi/sessions). Write session path is needed
-    only if you use a remote session explorer or a remote portal 
+    only if you use a remote session explorer or a remote portal
 
 WSDL
 ----
diff --git a/doc/sources/admin/soapsessionbackend.rst b/doc/sources/admin/soapsessionbackend.rst
index 3e016298a..9c64d9076 100644
--- a/doc/sources/admin/soapsessionbackend.rst
+++ b/doc/sources/admin/soapsessionbackend.rst
@@ -36,14 +36,15 @@ Then, set ``Lemonldap::NG::Common::Apache::Session::SOAP`` in
 sensitive):
 
 =================== ============================== ===========================================
-Required parameters                               
-=================== ============================== ===========================================
+Required parameters
+----------------------------------------------------------------------------------------------
 Name                Comment                        Example
+=================== ============================== ===========================================
 **proxy**           URL of sessions SOAP end point http://auth.example.com/index.fcgi/sessions
 =================== ============================== ===========================================
 
 
-.. tip:: 
+.. tip::
 
     Use /adminSessions if the Handler need to modify the session,
     for example if you configured an idle timeout.
@@ -102,10 +103,10 @@ For example, if real sessions are stored in
    globalStorageOptions = { 'Directory' => '/var/lib/lemonldap-ng/sessions/', 'LockDirectory' => '/var/lib/lemonldap-ng/sessions/lock/', }
 
 
-.. tip:: 
+.. tip::
 
     If your sessions explorer is on the same server that the
     portal, either use the **adminSessions** end point in Manager
     configuration, or override the ``globalStorage`` and
     ``globalStorageOptions`` parameters in section all (and not portal) of
-    ``lemonldap-ng.ini``. 
+    ``lemonldap-ng.ini``.
diff --git a/doc/sources/admin/sqlconfbackend.rst b/doc/sources/admin/sqlconfbackend.rst
index 050505134..6ac1d0d44 100644
--- a/doc/sources/admin/sqlconfbackend.rst
+++ b/doc/sources/admin/sqlconfbackend.rst
@@ -7,7 +7,7 @@ There is 2 types of SQL configuration backends for LemonLDAP::NG:
 -  **RDBI**: triple store storage
 
 
-.. tip:: 
+.. tip::
 
     You can use any database engine if it provides a Perl Driver.
     You will find here examples for MySQL and PostgreSQL, but other engines
@@ -80,13 +80,13 @@ components needs just a read access. You can also use the same user for
 all.
 
 
-.. tip:: 
+.. tip::
 
     You can use different dbiUser strings:
-    
+
     -  one with read/write rights for servers hosting the manager
     -  one with just read rights for other servers
-    
+
 
 
 For example (suppose that our servers are in 10.0.0.0/24 network):
diff --git a/doc/sources/admin/sqlsessionbackend.rst b/doc/sources/admin/sqlsessionbackend.rst
index 094e9a9f2..97c722721 100644
--- a/doc/sources/admin/sqlsessionbackend.rst
+++ b/doc/sources/admin/sqlsessionbackend.rst
@@ -13,6 +13,8 @@ SQL session backend can be used with many SQL databases such as:
 Setup
 -----
 
+.. _sqlsessionbackend-prepare-the-database:
+
 Prepare the database
 ~~~~~~~~~~~~~~~~~~~~
 
@@ -20,10 +22,10 @@ Your database must have a specific table to host sessions. Here are some
 examples for main databases servers.
 
 
-.. important:: 
+.. important::
 
     If your database doesn't accept UTF-8 characters in
-    'text' field, use 'blob' instead of 'text'. 
+    'text' field, use 'blob' instead of 'text'.
 
 MySQL
 ^^^^^
@@ -44,20 +46,20 @@ Create sessions table:
        );
 
 
-.. important:: 
+.. important::
 
     Change ``char(32)`` by ``varchar(64)`` if you use the
     now recommended SHA256 hash algorithm. See
     :doc:`Sessions<sessions>` for more details
 
 
-.. tip:: 
+.. tip::
 
     You can change table name ``sessions`` to whatever you want,
     just adapt the parameter ``TableName`` in module options.
 
 
-.. important:: 
+.. important::
 
     For a better UTF-8 support, use
     `DBD::MariaDB <https://metacpan.org/pod/DBD::MariaDB>`__ with
@@ -101,7 +103,7 @@ Create table:
    lemonldap-ng=> q
 
 
-.. important:: 
+.. important::
 
     Change ``char(32)`` by ``varchar(64)`` if you use the
     now recommended SHA256 hash algorithm. See
@@ -117,9 +119,10 @@ for PostgreSQL) in ``General parameters`` » ``Sessions`` »
 parameters (case sensitive):
 
 =================== ================================================= ====================================
-Required parameters                                                  
-=================== ================================================= ====================================
+Required parameters
+----------------------------------------------------------------------------------------------------------
 Name                Comment                                           Example
+=================== ================================================= ====================================
 **DataSource**      The `DBI <https://metacpan.org/pod/DBI>`__ string dbi:Pg:dbname=sessions;host=10.2.3.1
 **UserName**        The database username                             lemonldap-ng
 **Password**        The database password                             mysuperpassword
@@ -134,24 +137,25 @@ connector (https://metacpan.org/pod/DBD::Oracle,
 `DBD::Pg <https://metacpan.org/pod/DBD::Pg>`__,...)
 
 
-.. important:: 
+.. important::
 
     For MySQL, you need to set additional parameters:
-    
+
     -  LockDataSource
     -  LockUserName
     -  LockPassword
-    
 
 
 
-.. tip:: 
+
+.. tip::
 
     For better performances, you can use specific
     :doc:`browseable session backend<browseablesessionbackend>`.
-    
+
     Learn more at
-    :doc:`how to increase Data Base performances<performances>`. 
+    :ref:`how to increase Data Base performances<performances-apachesession-performances>`.
+
 
 UTF8 support
 ^^^^^^^^^^^^
diff --git a/doc/sources/admin/ssoaas.rst b/doc/sources/admin/ssoaas.rst
index 30facfc8f..bfb5586eb 100644
--- a/doc/sources/admin/ssoaas.rst
+++ b/doc/sources/admin/ssoaas.rst
@@ -16,8 +16,8 @@ LL::NG affords all these services (except application logs of course,
 but headers are provided to permit this).
 
 Headers setting is an another LL::NG service. LL::NG can provide any
-user attributes to an application *(see
-:doc:`Rules and headers<writingrulesand_headers>`)*
+user attributes to an application (see
+:doc:`Rules and headers<writingrulesand_headers>`)
 
 ``*aaS`` means that application can drive underlying layer (IaaS for
 infrastructure, PaaS for platform,…). So for us, ``SSOaaS`` must provide
@@ -28,11 +28,12 @@ just use it, not manage it.
 LL::NG affords some features that can be used to provide SSO as a
 service: a web application can manage its rules and headers. Docker or
 VM images (Nginx only) includes LL::NG Nginx configuration that aims to
-a global :doc:`LL::NG authorization server<platformsoverview>`. By
-default, all authenticated users can access and one header is set:
+a global
+:ref:`LL::NG authorization server<platformsoverview-external-servers-for-nginx>`.
+By default, all authenticated users can access and one header is set:
 ``Auth-User``. If application gives a RULES_URL parameter that refers to
 a JSON file, authorization server will read it, apply specified rules
-and set required headers *(see :doc:`DevOps Handler<devopshandler>`)*.
+and set required headers (see :doc:`DevOps Handler<devopshandler>`).
 
 There are two different architectures to do this:
 
@@ -75,7 +76,7 @@ request authorization from a central FastCGI server:
        fastcgi_param HOST $http_host;
        # Keep original request (LLNG server will received /lmauth)
        fastcgi_param X_ORIGINAL_URI  $request_uri;
-       
+
        # Set dynamically rules (LLNG will poll it every 10 mn)
        fastcgi_param RULES_URL http://rulesserver/my.json
      }
@@ -115,14 +116,14 @@ FastCGI" configuration.
    <VirtualHost ...>
        ServerName app.tls
        PerlHeaderParserHandler Lemonldap::NG::Handler::ApacheMP2::FCGIClient
-       
+
        # This must point to the central FastCGI server
        PerlSetVar LLNG_SERVER 192.0.2.1:9090
-       
+
        # Declare this vhost as a DevOps vhost, so that we do not have
        # to declare it in the LemonLDAP::NG Manager
        PerlSetVar VHOSTTYPE DevOps
-       
+
        # This URL will be fetched by the central FastCGI server and
        # used to make the authentication decision about this virtualhost
        # Make sure the central FastCGI server can reach it
diff --git a/doc/sources/admin/ssocookie.rst b/doc/sources/admin/ssocookie.rst
index bc443e192..3a88c42fa 100644
--- a/doc/sources/admin/ssocookie.rst
+++ b/doc/sources/admin/ssocookie.rst
@@ -5,9 +5,9 @@ SSO cookie
 ----------
 
 The SSO cookie is built by the portal (as described in the
-:doc:`login kinematic<presentation>`), or by the Handler
-for cross domain authentication (see
-:doc:`CDA kinematic<presentation>`).
+:ref:`login kinematic<presentation-login>`), or by the
+Handler for cross domain authentication (see
+:ref:`CDA kinematic<cda>`).
 
 To edit SSO cookie parameters, go in Manager, ``General Parameters`` >
 ``Cookies``:
@@ -38,13 +38,13 @@ To edit SSO cookie parameters, go in Manager, ``General Parameters`` >
    expiration time and use a session cookie.
 
 
-.. warning:: 
+.. warning::
 
     When you change cookie expiration time, it is written on
     the user hard disk unlike session cookie
 
 
-.. important:: 
+.. important::
 
     Changing the domain value will not update other
     configuration parameters, like virtual host names, portal URL, etc. You
@@ -62,7 +62,7 @@ portal by:
    POST, SAML, etc.)
 
 
-.. warning:: 
+.. warning::
 
     The portal URL **must** be inside SSO domain. If secured
     cookie is enabled, the portal URL **must** be HTTPS.
diff --git a/doc/sources/admin/start.rst b/doc/sources/admin/start.rst
index c3e1dce04..3cc40b0b4 100644
--- a/doc/sources/admin/start.rst
+++ b/doc/sources/admin/start.rst
@@ -32,7 +32,7 @@ Installation
 -  :doc:`Installation on RHEL/CentOS with packages<installrpm>`
 -  :doc:`Installation on Suse Linux Enterprise Server with packages<installsles>`
 -  :doc:`Run in LemonLDAP::NG in Docker<docker>`
--  :doc:`Node.js handler<nodehandler>` |image2|
+-  :doc:`Node.js handler<nodehandler>` |new|
 
 After installation
 ~~~~~~~~~~~~~~~~~~
@@ -43,7 +43,10 @@ After installation
    configuration)*
 -  :doc:`Deploy Apache configuration<configapache>`
 -  :doc:`Deploy LemonLDAP::NG on Plack servers family<configplack>`
-   *(Twiggy, Starman, Corona,...)* |image4|
+   *(Twiggy, Starman, Corona,...)* |new|
+
+
+.. _start-configuration:
 
 Configuration
 -------------
@@ -72,6 +75,9 @@ Portal
 -  :doc:`Captcha<captcha>`
 -  :doc:`Public pages<public_pages>`
 
+
+.. _start-authentication-users-and-password-databases:
+
 Authentication, users and password databases
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
@@ -81,62 +87,81 @@ Authentication, users and password databases
 Official Backends                                                    Authentication                                  Users    Password
 ==================================================================== =============================================== ======== ========
 :doc:`Active Directory<authad>`                                      ✔                                               ✔        ✔
-:doc:`Apache (Basic, NTLM, OTP, ...)<authapache>`                    ✔                                                       
-:doc:`CAS<authcas>`                                                  ✔                                               |image8|
+:doc:`Apache (Basic, NTLM, OTP, ...)<authapache>`                    ✔
+:doc:`CAS<authcas>`                                                  ✔                                               |new|
 :doc:`SQL Databases<authdbi>`                                        ✔                                               ✔        ✔
 :doc:`Demonstration<authdemo>`                                       ✔                                               ✔        ✔
-:doc:`Facebook<authfacebook>`                                        ✔                                               ✔       
-:doc:`GitHub<authgithub>` |image9|  [1]_                             ✔                                                       
-:doc:`GPG<authgpg>` |image10|  [2]_                                  ✔                                                       
-:doc:`Kerberos<authkerberos>` |image11|                              ✔                                                       
+:doc:`Facebook<authfacebook>`                                        ✔                                               ✔
+:doc:`GitHub<authgithub>` |new|  [1]_                                ✔
+:doc:`GPG<authgpg>` |new|  [2]_                                      ✔
+:doc:`Kerberos<authkerberos>` |new|                                  ✔
 :doc:`LDAP<authldap>`                                                ✔                                               ✔        ✔
-:doc:`LinkedIn<authlinkedin>`                                        ✔                                                       
+:doc:`LinkedIn<authlinkedin>`                                        ✔
 :doc:`Null<authnull>`                                                ✔                                               ✔        ✔
-:doc:`OpenID Connect<authopenidconnect>`                             ✔                                               ✔       
-:doc:`PAM<authpam>` |image12|                                        ✔                                                       
-:doc:`Proxy LL::NG<authproxy>`                                       ✔                                               ✔       
-:doc:`Radius<authradius>`                                            ✔                                                       
-:doc:`REST<authrest>` |image13|                                      ✔                                               ✔        ✔
-:doc:`SAML 2.0 / Shibboleth<authsaml>`                               ✔                                               ✔       
-:doc:`Slave<authslave>`                                              ✔                                               ✔       
-:doc:`SSL<authssl>`                                                  ✔                                                       
-:doc:`Twitter<authtwitter>`                                          ✔                                                       
-:doc:`WebID<authwebid>`                                              ✔                                               ✔       
-[STRIKEOUT::doc:`Yubikey<authyubikey>`]                              *Deprecated, replaced by Yubikey second factor*         
-:doc:`Custom modules<authcustom>` |image14|                          ✔                                               ✔        ✔
-Combo Backends                                                       Authentication                                  Users    Password
-:doc:`Choice by users<authchoice>`                                   ✔                                               ✔        ✔
-:doc:`Combination of auth schemes<authcombination>` |image15|        ✔                                               ✔       
-[STRIKEOUT::doc:`Multiple backends stack<authmulti>`]                *Deprecated, replaced by Combination*                   
+:doc:`OpenID Connect<authopenidconnect>`                             ✔                                               ✔
+:doc:`PAM<authpam>` |new|                                            ✔
+:doc:`Proxy LL::NG<authproxy>`                                       ✔                                               ✔
+:doc:`Radius<authradius>`                                            ✔
+:doc:`REST<authrest>` |new|                                          ✔                                               ✔        ✔
+:doc:`SAML 2.0 / Shibboleth<authsaml>`                               ✔                                               ✔
+:doc:`Slave<authslave>`                                              ✔                                               ✔
+:doc:`SSL<authssl>`                                                  ✔
+:doc:`Twitter<authtwitter>`                                          ✔
+:doc:`WebID<authwebid>`                                              ✔                                               ✔
+:doc:`Yubikey<authyubikey>` |deprecated|                             *Replaced by* :doc:`yubikey2f`
+:doc:`Custom modules<authcustom>` |new|                              ✔                                               ✔        ✔
+==================================================================== =============================================== ======== ========
+
+==================================================================== ================================================= ======== ========
+Combo Backends                                                       Authentication                                    Users    Password
+==================================================================== ================================================= ======== ========
+:doc:`Choice by users<authchoice>`                                   ✔                                                 ✔        ✔
+:doc:`Combination of auth schemes<authcombination>` |new|            ✔                                                 ✔
+:doc:`Multiple backends stack<authmulti>` |deprecated|               *Replaced by* :doc:`Combination<authcombination>`
+==================================================================== ================================================= ======== ========
+
+==================================================================== =============================================== ======== ========
 Obsolete Backends                                                    Authentication                                  Users    Password
-:doc:`OpenID<authopenid>`                                            ✔                                               ✔       
-:doc:`Remote LL::NG<authremote>`                                     ✔                                               ✔       
-Second factor (:doc:`documentation<secondfactor>`)                   Authentication                                          
-:doc:`TOTP-or-U2F<utotp2f>` |image16|                                ✔                                                       
-:doc:`U2F<u2f>` |image17|                                            ✔                                                       
-:doc:`TOTP<totp2f>` *(Google Authenticator,...)* |image18|           ✔                                                       
-:doc:`E-mail Second Factor<mail2f>` |image19|                        ✔                                                       
-:doc:`External Second Factor<external2f>` *(OTP, SMS,...)* |image20| ✔                                                       
-:doc:`Radius Second Factor<radius2f>` |image21|  [3]_                ✔                                                       
-:doc:`REST Second Factor<rest2f>` |image22|                          ✔                                                       
-:doc:`Yubikey<yubikey2f>` |image23|                                  ✔                                                       
-:doc:`Additional second factors<sfextra>` |image24|  [4]_            ✔                                                       
-Auth addons                                                          Authentication                                          
-:doc:`Auto Signin<autosignin>` |image25|                             ✔                                                       
 ==================================================================== =============================================== ======== ========
+:doc:`OpenID<authopenid>`                                            ✔                                               ✔
+:doc:`Remote LL::NG<authremote>`                                     ✔                                               ✔
+==================================================================== =============================================== ======== ========
+
+==================================================================== ==============
+Second factor (:doc:`documentation<secondfactor>`)                   Authentication
+==================================================================== ==============
+:doc:`TOTP-or-U2F<utotp2f>` |new|                                    ✔
+:doc:`U2F<u2f>` |new|                                                ✔
+:doc:`TOTP<totp2f>` *(Google Authenticator,...)* |new|               ✔
+:doc:`E-mail Second Factor<mail2f>` |new|                            ✔
+:doc:`External Second Factor<external2f>` *(OTP, SMS,...)* |new|     ✔
+:doc:`Radius Second Factor<radius2f>` |new|  [3]_                    ✔
+:doc:`REST Second Factor<rest2f>` |new|                              ✔
+:doc:`Yubikey<yubikey2f>` |new|                                      ✔
+:doc:`Additional second factors<sfextra>` |new|  [4]_                ✔
+==================================================================== ==============
+
+==================================================================== ==============
+Auth addons                                                          Authentication
+==================================================================== ==============
+:doc:`Auto Signin<autosignin>` |new|                                 ✔
+==================================================================== ==============
+
+
+.. _start-identity-provider:
 
 Identity provider
 ^^^^^^^^^^^^^^^^^
 
 
-.. tip:: 
+.. tip::
+
+
 
-    
-    
     -  All identity provider protocols can be used simultaneously
     -  LemonLDAP::NG can be used as a
        :doc:`proxy between those protocols<federationproxy>`
-    
+
 
 
 |image26|
@@ -152,7 +177,7 @@ Protocol                                                              Service Pr
 ===================================================================== ================ =================
 
 
-.. tip:: 
+.. tip::
 
     * Issuers timeout : Delay for issuers to submit their authentication requests
     * To avoid a bad/expired token and lose redirection to the SP protected
@@ -161,7 +186,7 @@ Protocol                                                              Service Pr
       by editing ``lemonldap-ng.ini`` in section [portal]:
 
     .. code:: ini
-    
+
        [portal]
        forceGlobalStorageIssuerOTT = 1
 
@@ -170,26 +195,26 @@ Attacks and Protection
 ^^^^^^^^^^^^^^^^^^^^^^
 
 
-.. tip:: 
+.. tip::
 
     To learn or find out more about security, go to
-    :doc:`Security<security>` documentation 
+    :doc:`Security<security>` documentation
 
 |image27|
 
-======================================== =============== ============================
-Attack                                   LLNG protection System Integrator protection
-======================================== =============== ============================
-:doc:`Brute Force<bruteforceprotection>` ✔               ✔
-:doc:`Page Content<security>`            ✔              
-:doc:`CSRF<security>`                    ✔              
-Deny of Service                                          ✔
-:doc:`Invisible iFrame<portalcustom>`    ✔               ✔
-Man-in-the-Middle                                        ✔
-Software Exploit                                         ✔
-:doc:`SSO by-passing<security>`                          ✔
-:doc:`XSS<safejail>`                     ✔              
-======================================== =============== ============================
+====================================================== =============== ============================
+Attack                                                 LLNG protection System Integrator protection
+====================================================== =============== ============================
+:doc:`Brute Force<bruteforceprotection>`               ✔               ✔
+:ref:`Page Content<security-portal>`                   ✔
+:ref:`CSRF<security-portal>`                           ✔
+Deny of Service                                                        ✔
+:ref:`Invisible iFrame<portalcustom-other-parameters>` ✔               ✔
+Man-in-the-Middle                                                      ✔
+Software Exploit                                                       ✔
+:ref:`SSO by-passing<security-reverseproxies>`                         ✔
+:doc:`XSS<safejail>`                                   ✔
+====================================================== =============== ============================
 
 Plugins
 ^^^^^^^
@@ -199,30 +224,30 @@ Plugins
 ==================================================================== ============================================================================================================================================
 Name                                                                 Description
 ==================================================================== ============================================================================================================================================
-:doc:`Auto Signin<autosignin>` |image29|                             Auto Signin Addon
-:doc:`Brute Force protection<bruteforceprotection>` |image30|        User must wait to log in after some failed login attempts
+:doc:`Auto Signin<autosignin>` |new|                                 Auto Signin Addon
+:doc:`Brute Force protection<bruteforceprotection>` |new|            User must wait to log in after some failed login attempts
 :doc:`CDA<cda>`                                                      Cross Domain Authentication
-:doc:`Check state<checkstate>` |image31|                             Check state plugin (test page)
-:doc:`Check user<checkuser>`  [5]_ |image32|                         Check access rights, transmitted headers and session attibutes for a specific user and URL
-:doc:`Configuration viewer<viewer>` |image33|                        Edit WebSSO configuration in Read Only mode
-:doc:`Context switching<contextswitching>`  [6]_\ |image34|          Switch context other users
+:doc:`Check state<checkstate>` |new|                                 Check state plugin (test page)
+:doc:`Check user<checkuser>`  [5]_ |new|                             Check access rights, transmitted headers and session attibutes for a specific user and URL
+:doc:`Configuration viewer<viewer>` |new|                            Edit WebSSO configuration in Read Only mode
+:doc:`Context switching<contextswitching>`  [6]_\ |new|              Switch context other users
 :doc:`Custom<plugincustom>`                                          Write a custom plugin
 :doc:`Decrypt value<decryptvalue>`  [7]_\ |image35|                  Decrypt ciphered values
-:doc:`Display login history<loginhistory>`                          
+:doc:`Display login history<loginhistory>`
 :doc:`Force Authentication<forcereauthn>`                            Force authentication to access to Portal
 :doc:`Global Logout<globallogout>`  [8]_                             Suggest to close all opened sessions at logout
 :doc:`Grant Sessions<grantsession>`                                  Rules to apply before allowing a user to open a session
-:doc:`Impersonation<impersonation>`  [9]_\ |image36|                 Allow users to use another identity
-:doc:`Notifications system<notifications>`                          
+:doc:`Impersonation<impersonation>`  [9]_\ |new|                     Allow users to use another identity
+:doc:`Notifications system<notifications>`
 :doc:`Portal Status<status>`                                         Experimental portal status page
 :doc:`Public pages<public_pages>`                                    Enable public pages system
 :doc:`Refresh session API<refreshsessionapi>`  [10]_                 Plugin that provides an API to refresh a user session
-:doc:`Reset password by mail<resetpassword>`                        
+:doc:`Reset password by mail<resetpassword>`
 :doc:`Reset certificate by mail<resetcertificate>`  [11]_\ |image37| Allow users to reset their certificate
-:doc:`REST services<restservices>` |image38|                         REST server for :doc:`Proxy<authproxy>`
-:doc:`SOAP services<soapservices>` *(deprecated)*                    SOAP server for :doc:`Proxy<authproxy>`
-Stay connected |image39|                                             Enable persistent connection on same browser
-Upgrade session |image40|                                            This plugin explains to an already authenticated user that a higher authentication level is required to access the URL instead of reject him
+:doc:`REST services<restservices>` |new|                             REST server for :doc:`Proxy<authproxy>`
+:doc:`SOAP services<soapservices>` |deprecated|                      SOAP server for :doc:`Proxy<authproxy>`
+Stay connected |new|                                                 Enable persistent connection on same browser
+Upgrade session |new|                                                This plugin explains to an already authenticated user that a higher authentication level is required to access the URL instead of reject him
 ==================================================================== ============================================================================================================================================
 
 Handlers
@@ -233,23 +258,25 @@ Handlers
 Handlers are software control agents to be installed on your web servers
 *(Nginx, Apache, PSGI like Plack based servers or Node.js)*.
 
-==================================================================== ========================================== ============================================================= =========================================== ================================================================================== =============================================== ======================================================================================================================
-Handler type                                                         Apache                                     LLNG FastCGI/uWSGI server (Nginx, or :doc:`SSOaaS<ssoaas>`)   `Plack\* servers <https://plackperl.org>`__ Node.js  ( `express apps <http://expressjs.com/>`__\  or :doc:`SSOaaS<ssoaas>`)    :doc:`Self protected apps<selfmadeapplication>`   Comment
-==================================================================== ========================================== ============================================================= =========================================== ================================================================================== =============================================== ======================================================================================================================
-Main *(default handler)*                                             ✔                                          ✔                                                             ✔                                           :doc:`Partial<nodehandler>` ** [12]_ **                                             ✔                                              
-:doc:`AuthBasic<handlerauthbasic>`                                   ✔                                          ✔                                                             ✔                                                                                                                              ✔                                               Designed for some server-to-server applications
-:doc:`CDA<cda>`                                                      ✔                                          ✔                                                             ✔                                                                                                                              ✔                                               For Cross Domain Authentication
-:doc:`DevOps<devopshandler>`  (:doc:`SSOaaS<ssoaas>`)  |image42|     ✔                                          ✔                                                             ✔                                           ✔                                                                                                                                  Allows application developers to define their own rules and headers inside their applications
-:doc:`DevOpsST<devopssthandler>`  (:doc:`SSOaaS<ssoaas>`)  |image43| ✔                                          ✔                                                             ✔                                           ✔                                                                                                                                  Enables both :doc:`DevOps<devopshandler>` and :doc:`Service Token<servertoserver>`
-:doc:`OAuth2<oauth2handler>`  [13]_\ |image44|                       ✔                                          ✔                                                             ✔                                                                                                                              ✔                                               Uses OpenID Connect/OAuth2 access token to check authentication and authorization, can be used to protect Web Services
-:doc:`Secure Token<securetoken>`                                     ✔                                          ✔                                                             ✔                                                                                                                                                                              Designed to secure exchanges between a LLNG reverse-proxy and a remote app
-:doc:`Service Token<servertoserver>` |image45| *(Server-to-Server)*  ✔                                          ✔                                                             ✔                                           ✔                                                                                  ✔                                               Designed to permit underlying requests *(API-Based Infrastructure)*
-:doc:`Zimbra PreAuth<applications/zimbra>`                           ✔                                                             ✔                                           ✔                                                                                                                                 
-==================================================================== ========================================== ============================================================= =========================================== ================================================================================== =============================================== ======================================================================================================================
+==================================================================== ========== ============================================================= =========================================== ================================================================================== =============================================== ======================================================================================================================
+Handler type                                                         Apache     LLNG FastCGI/uWSGI server (Nginx, or :doc:`SSOaaS<ssoaas>`)   `Plack servers <https://plackperl.org>`__   Node.js  ( `express apps <http://expressjs.com/>`__\  or :doc:`SSOaaS<ssoaas>`)    :doc:`Self protected apps<selfmadeapplication>`   Comment
+==================================================================== ========== ============================================================= =========================================== ================================================================================== =============================================== ======================================================================================================================
+Main *(default handler)*                                             ✔          ✔                                                             ✔                                           :doc:`Partial<nodehandler>` ** [12]_ **                                             ✔
+:doc:`AuthBasic<handlerauthbasic>`                                   ✔          ✔                                                             ✔                                                                                                                              ✔                                               Designed for some server-to-server applications
+:doc:`CDA<cda>`                                                      ✔          ✔                                                             ✔                                                                                                                              ✔                                               For Cross Domain Authentication
+:doc:`DevOps<devopshandler>`  (:doc:`SSOaaS<ssoaas>`)  |new|         ✔          ✔                                                             ✔                                           ✔                                                                                                                                  Allows application developers to define their own rules and headers inside their applications
+:doc:`DevOpsST<devopssthandler>`  (:doc:`SSOaaS<ssoaas>`)  |new|     ✔          ✔                                                             ✔                                           ✔                                                                                                                                  Enables both :doc:`DevOps<devopshandler>` and :doc:`Service Token<servertoserver>`
+:doc:`OAuth2<oauth2handler>`  [13]_\ |new|                           ✔          ✔                                                             ✔                                                                                                                              ✔                                               Uses OpenID Connect/OAuth2 access token to check authentication and authorization, can be used to protect Web Services
+:doc:`Secure Token<securetoken>`                                     ✔          ✔                                                             ✔                                                                                                                                                                              Designed to secure exchanges between a LLNG reverse-proxy and a remote app
+:doc:`Service Token<servertoserver>` |new| *(Server-to-Server)*      ✔          ✔                                                             ✔                                           ✔                                                                                  ✔                                               Designed to permit underlying requests *(API-Based Infrastructure)*
+:doc:`Zimbra PreAuth<applications/zimbra>`                           ✔          ✔                                                             ✔
+==================================================================== ========== ============================================================= =========================================== ================================================================================== =============================================== ======================================================================================================================
 
 LLNG databases
 ~~~~~~~~~~~~~~
 
+.. _start-configuration-database:
+
 Configuration database
 ^^^^^^^^^^^^^^^^^^^^^^
 
@@ -258,26 +285,37 @@ Configuration database
 LL::NG needs a storage system to store its own configuration (managed by
 the manager). Choose one in the following list:
 
-=========================================== ========= ==============================================================================================================================================================================
+=========================================== ========= ====================================================================
 Backend                                     Shareable Comment
-=========================================== ========= ==============================================================================================================================================================================
-:doc:`File (JSON)<fileconfbackend>`                   Not shareable between servers except if used in conjunction with :doc:`REST<restconfbackend>` or with a shared file system (NFS,...). Selected by default during installation.
-:doc:`YAML<yamlconfbackend>` |image47|                Same as :doc:`File<fileconfbackend>` but in YAML format instead of JSON
+=========================================== ========= ====================================================================
+:doc:`File (JSON)<fileconfbackend>`                   Not shareable between servers except
+                                                      if used in conjunction with :doc:`REST<restconfbackend>`
+                                                      or with a shared file system (NFS,...).
+                                                      Selected by default during installation.
+:doc:`YAML<yamlconfbackend>` |new|                    Same as :doc:`File<fileconfbackend>` but in YAML format
+                                                      instead of JSON
 :doc:`SQL (RDBI/CDBI)<sqlconfbackend>`      ✔         Recommended for large-scale systems. Prefer CDBI.
-:doc:`LDAP<ldapconfbackend>`                ✔        
-:doc:`MongoDB<mongodbconfbackend>`          ✔        
-:doc:`SOAP<soapconfbackend>` *(deprecated)* ✔         Proxy backend to be used in conjunction with another configuration backend. \ **Can be used to secure another backend** for remote servers.
-:doc:`REST<restconfbackend>` |image48|      ✔         Proxy backend to be used in conjunction with another configuration backend. \ **Can be used to secure another backend** for remote servers.
-:doc:`Local<localconfbackend>` |image49|              Use only lemonldap-ng.ini parameters.
-=========================================== ========= ==============================================================================================================================================================================
+:doc:`LDAP<ldapconfbackend>`                ✔
+:doc:`MongoDB<mongodbconfbackend>`          ✔
+:doc:`SOAP<soapconfbackend>` |deprecated|   ✔         Proxy backend to be used in conjunction with another
+                                                      configuration backend. \ **Can be used to secure another backend**
+                                                      for remote servers.
+:doc:`REST<restconfbackend>` |new|          ✔         Proxy backend to be used in conjunction with another configuration
+                                                      backend. \ **Can be used to secure another backend** for
+                                                      remote servers.
+:doc:`Local<localconfbackend>` |new|                  Use only lemonldap-ng.ini parameters.
+=========================================== ========= ====================================================================
 
 
-.. tip:: 
+.. tip::
 
     You can not start with an empty configuration, so read
     :doc:`how to change configuration backend<changeconfbackend>` to convert
     your existing configuration into another one.
 
+
+.. _start-sessions-database:
+
 Sessions database
 ^^^^^^^^^^^^^^^^^
 
@@ -290,34 +328,34 @@ modules family. All
 style modules are usable except for some features.
 
 
-.. important:: 
+.. important::
 
     If you plan to use LLNG in a large-scale system, take a
-    look at :doc:`Performance Test<performances>` to choose the right
+    look at :ref:`Performance Test<performance-test>` to choose the right
     backend. A :doc:`Browseable SQL backend<browseablesessionbackend>` is
-    generally a good choice. 
+    generally a good choice.
 
 ================================================================ ========= ================================================ ==================================================== ================== =================================================================================================================================================================================================
-Backend                                                          Shareable :doc:`Session explorer<features>`                :doc:`Session restrictions<features>`                Session expiration Comment
+Backend                                                          Shareable :ref:`Session explorer<session-explorer>`        :ref:`Session restrictions<session-restrictions>`    Session expiration Comment
 ================================================================ ========= ================================================ ==================================================== ================== =================================================================================================================================================================================================
 :doc:`File<filesessionbackend>`                                            ✔                                                ✔                                                    ✔                  Not shareable between servers except if used in conjunction with :doc:`REST session backend<restsessionbackend>` or with a shared file system (NFS,...). Selected by default during installation.
 :doc:`SQL<sqlsessionbackend>`                                    ✔         ✔                                                ✔                                                    ✔                  Unoptimized for :doc:`session explorer<features>` and :doc:`single session<features>` features.
-:doc:`LDAP<ldapsessionbackend>`                                  ✔         ✔                                                ✔                                                    ✔                  
+:doc:`LDAP<ldapsessionbackend>`                                  ✔         ✔                                                ✔                                                    ✔
 :doc:`Redis<nosqlsessionbackend>`                                ✔         ✔                                                ✔                                                    ✔                  The fastest. Must be secured by network access control.
 :doc:`MongoDB<mongodbsessionbackend>`                            ✔         ✔                                                ✔                                                    ✔                  Must be secured by network access control.
 :doc:`Browseable (SQL, Redis or LDAP)<browseablesessionbackend>` ✔         ✔                                                ✔                                                    ✔                  **Optimized** for :doc:`session explorer<features>` and :doc:`single session<features>` features.
-:doc:`REST<restsessionbackend>` |image51|                        ✔         ✔                                                ✔                                                    ✔                  Proxy backend to be used in conjunction with another session backend.
+:doc:`REST<restsessionbackend>` |new|                            ✔         ✔                                                ✔                                                    ✔                  Proxy backend to be used in conjunction with another session backend.
                                                                                                                                                                                                     **Can be used to secure another backend** for remote servers.
-:doc:`SOAP<soapsessionbackend>` *(deprecated)*                   ✔         ✔                                                ✔                                                    ✔                  Proxy backend to be used in conjunction with another session backend.
+:doc:`SOAP<soapsessionbackend>`  |deprecated|                    ✔         ✔                                                ✔                                                    ✔                  Proxy backend to be used in conjunction with another session backend.
                                                                                                                                                                                                     **Can be used to secure another backend** for remote servers.
 ================================================================ ========= ================================================ ==================================================== ================== =================================================================================================================================================================================================
 
 
-.. tip:: 
+.. tip::
 
     You can migrate from one session backend to another using the
-    :doc:`session conversion script<changesessionbackend>`. (|image52|
-    *since 2.0.7*) 
+    :doc:`session conversion script<changesessionbackend>`. (|new|
+    *since 2.0.7*)
 
 Applications protection
 -----------------------
@@ -336,7 +374,7 @@ Well known compatible applications
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
-.. important:: 
+.. note::
 
     Here is a list of well known applications that are compatible with
     LL::NG. A full list is available on
@@ -376,8 +414,8 @@ Advanced features
 -  :doc:`Forward logout to applications<logoutforward>`
 -  :doc:`Secure Token Handler<securetoken>`
 -  :doc:`AuthBasic Handler<handlerauthbasic>`
--  :doc:`SSO as a Service<ssoaas>` *(SSOaaS)* |image55|
--  :doc:`Handling server webservice calls<servertoserver>` |image56|
+-  :doc:`SSO as a Service<ssoaas>` *(SSOaaS)* |new|
+-  :doc:`Handling server webservice calls<servertoserver>` |new|
 -  `LemonLDAP::NG kubernetes
    controller <https://github.com/lemonldap-ng-controller/lemonldap-ng-controller>`__
 -  :doc:`Safe jail<safejail>`
@@ -401,7 +439,7 @@ Mini howtos
 -  :doc:`Create a protocol proxy<federationproxy>` *(SAML to OpenID, CAS
    to SAML ,...)*
 -  :doc:`Convert HTTP header into environment variable<header_remote_user_conversion>`
--  :doc:`Connect to Renater Federation<renater>` |image58|
+-  :doc:`Connect to Renater Federation<renater>` |new|
 -  :doc:`Run LemonLDAP::NG components behind a reverse proxy<behindproxyminihowto>`
 -  :doc:`Configure LL::NG to use an outgoing proxy<useoutgoingproxy>`
 
@@ -415,7 +453,7 @@ Exploitation
 -  :doc:`SELinux<selinux>`
 -  :doc:`Handler status page<status>`
 -  :doc:`Portal state check<checkstate>` *(health check for fail-over)*
-   |image60|
+   |new|
 -  :doc:`Monitoring<monitoring>`
 -  :doc:`Logs settings<logs>`
 -  :doc:`Error messages<error>`
@@ -455,8 +493,8 @@ To add a new language:
 -  translate the 3 files
 -  then we will append them in sources.
 
-If you don't want to publish your translation *(``XX`` must be replaced
-by your language code)*:
+If you don't want to publish your translation (``XX`` must be replaced
+by your language code):
 
 -  Manager: translate
    ``lemonldap-ng-manager/site/htdocs/static/languages/en.json`` in
@@ -520,140 +558,61 @@ by your language code)*:
 
 .. |image0| image:: /icons/kthememgr.png
 .. |image1| image:: /icons/warehause.png
-.. |image2| image:: /documentation/new.png
-   :width: 35px
 .. |image3| image:: /icons/clean.png
-.. |image4| image:: /documentation/new.png
-   :width: 35px
 .. |image5| image:: /icons/lists.png
 .. |image6| image:: /icons/colors.png
 .. |image7| image:: /icons/gpg.png
-.. |image8| image:: /documentation/new.png
-   :width: 35px
-.. |image9| image:: /documentation/new.png
-   :width: 35px
-.. |image10| image:: /documentation/new.png
-   :width: 35px
-.. |image11| image:: /documentation/new.png
-   :width: 35px
-.. |image12| image:: /documentation/new.png
-   :width: 35px
-.. |image13| image:: /documentation/new.png
-   :width: 35px
-.. |image14| image:: /documentation/new.png
-   :width: 35px
-.. |image15| image:: /documentation/new.png
-   :width: 35px
-.. |image16| image:: /documentation/new.png
-   :width: 35px
-.. |image17| image:: /documentation/new.png
-   :width: 35px
-.. |image18| image:: /documentation/new.png
-   :width: 35px
-.. |image19| image:: /documentation/new.png
-   :width: 35px
-.. |image20| image:: /documentation/new.png
-   :width: 35px
-.. |image21| image:: /documentation/new.png
-   :width: 35px
-.. |image22| image:: /documentation/new.png
-   :width: 35px
-.. |image23| image:: /documentation/new.png
-   :width: 35px
-.. |image24| image:: /documentation/new.png
-   :width: 35px
-.. |image25| image:: /documentation/new.png
-   :width: 35px
 .. |image26| image:: /icons/personal.png
 .. |image27| image:: /icons/neotux.png
 .. |image28| image:: /icons/personal.png
-.. |image29| image:: /documentation/new.png
-   :width: 35px
-.. |image30| image:: /documentation/new.png
-   :width: 35px
-.. |image31| image:: /documentation/new.png
-   :width: 35px
-.. |image32| image:: /documentation/new.png
-   :width: 35px
-.. |image33| image:: /documentation/new.png
-   :width: 35px
-.. |image34| image:: /documentation/new.png
-   :width: 35px
 .. |image35| image:: /documentation/beta.png
    :width: 35px
-.. |image36| image:: /documentation/new.png
-   :width: 35px
 .. |image37| image:: /documentation/beta.png
    :width: 35px
-.. |image38| image:: /documentation/new.png
-   :width: 35px
-.. |image39| image:: /documentation/new.png
-   :width: 35px
-.. |image40| image:: /documentation/new.png
-   :width: 35px
 .. |image41| image:: /icons/gpg.png
-.. |image42| image:: /documentation/new.png
-   :width: 35px
-.. |image43| image:: /documentation/new.png
-   :width: 35px
-.. |image44| image:: /documentation/new.png
-   :width: 35px
-.. |image45| image:: /documentation/new.png
-   :width: 35px
 .. |image46| image:: /icons/utilities.png
-.. |image47| image:: /documentation/new.png
-   :width: 35px
-.. |image48| image:: /documentation/new.png
-   :width: 35px
-.. |image49| image:: /documentation/new.png
-   :width: 35px
 .. |image50| image:: /icons/kmultiple.png
-.. |image51| image:: /documentation/new.png
-   :width: 35px
-.. |image52| image:: /documentation/new.png
-   :width: 35px
 .. |image53| image:: /icons/access.png
 .. |image54| image:: /icons/neotux.png
-.. |image55| image:: /documentation/new.png
-   :width: 35px
-.. |image56| image:: /documentation/new.png
-   :width: 35px
 .. |image57| image:: /icons/jabber_protocol.png
-.. |image58| image:: /documentation/new.png
-   :width: 35px
 .. |image59| image:: /icons/xeyes.png
-.. |image60| image:: /documentation/new.png
-   :width: 35px
 
-.. |adfs| image:: applications/microsoft-adfs.png                        
+.. |new| image:: /documentation/new.png
+   :alt: new
+
+.. |deprecated| image:: /documentation/deprecated.png
+   :alt: deprecated
+
+
+.. |adfs| image:: applications/microsoft-adfs.png
    :target: applications/adfs.html
-.. |alfresco| image:: applications/alfresco_logo.png                         
+.. |alfresco| image:: applications/alfresco_logo.png
    :target: applications/alfresco.html
-.. |awx| image:: applications/logo-awx.png                              
+.. |awx| image:: applications/logo-awx.png
    :target: applications/awx.html
-.. |bugzilla| image:: applications/bugzilla_logo.png                         
+.. |bugzilla| image:: applications/bugzilla_logo.png
    :target: applications/bugzilla.html
-.. |dokuwiki| image:: applications/dokuwiki_logo.png                         
+.. |dokuwiki| image:: applications/dokuwiki_logo.png
    :target: applications/dokuwiki.html
-.. |drupal| image:: applications/drupal_logo.png                           
+.. |drupal| image:: applications/drupal_logo.png
    :target: applications/drupal.html
-.. |fusiondirectory| image:: applications/fusiondirectory-logo.jpg                  
+.. |fusiondirectory| image:: applications/fusiondirectory-logo.jpg
    :target: applications/fusiondirectory.html
-.. |gitlab| image:: applications/gitlab_logo.png                           
+.. |gitlab| image:: applications/gitlab_logo.png
    :target: applications/gitlab.html
-.. |glpi| image:: applications/glpi_logo.png                             
+.. |glpi| image:: applications/glpi_logo.png
    :target: applications/glpi.html
-.. |liferay| image:: applications/liferay_logo.png                          
+.. |liferay| image:: applications/liferay_logo.png
    :target: applications/liferay.html
-.. |mediawiki| image:: applications/mediawiki_logo.png                        
+.. |mediawiki| image:: applications/mediawiki_logo.png
    :target: applications/mediawiki.html
-.. |nextcloud| image:: applications/nextcloud-logo.png                        
+.. |nextcloud| image:: applications/nextcloud-logo.png
    :target: applications/nextcloud.html
-.. |simplesamlphp| image:: applications/simplesamlphp_logo.png                    
+.. |simplesamlphp| image:: applications/simplesamlphp_logo.png
    :target: applications/simplesamlphp.html
-.. |wordpress| image:: applications/wordpress_logo.png                        
+.. |wordpress| image:: applications/wordpress_logo.png
    :target: applications/wordpress.html
-.. |xwiki| image:: applications/xwiki.png                                 
+.. |xwiki| image:: applications/xwiki.png
    :target: applications/xwiki.html
-.. |zimbra| image:: applications/zimbra_logo.png                           
+.. |zimbra| image:: applications/zimbra_logo.png
    :target: applications/zimbra.html
diff --git a/doc/sources/admin/status.rst b/doc/sources/admin/status.rst
index c1587e185..12fb14d52 100644
--- a/doc/sources/admin/status.rst
+++ b/doc/sources/admin/status.rst
@@ -27,11 +27,11 @@ statistics and save them in their local cache. This means that if
 several Handlers are deployed, each will manage its own statistics.
 
 
-.. tip:: 
+.. tip::
 
     This page can be browsed for example by
     `MRTG <http://oss.oetiker.ch/mrtg/>`__ using the
-    :doc:`MRTG monitoring script<mrtg>`. 
+    :doc:`MRTG monitoring script<mrtg>`.
 
 Statistics are collected through a daemon launched by the Handler. It
 can be supervised in system processes.
@@ -88,7 +88,7 @@ configuration:
 Then restart Apache.
 
 
-.. tip:: 
+.. tip::
 
     You should change the ``Allow`` directive to match
     administration IP, or use another Apache protection mean.
diff --git a/doc/sources/admin/totp2f.rst b/doc/sources/admin/totp2f.rst
index 64e094480..5751b2655 100644
--- a/doc/sources/admin/totp2f.rst
+++ b/doc/sources/admin/totp2f.rst
@@ -12,7 +12,7 @@ LLNG can propose users to register this kind of software to increase
 authentication level.
 
 
-.. tip:: 
+.. tip::
 
     Note that it's a second factor, not an authentication module.
     Users are authenticated both by login form and TOTP.
@@ -66,7 +66,7 @@ In the manager (advanced parameters), you just have to enable it:
    the choice screen
 
 
-.. important:: 
+.. important::
 
     If you want to use a custom rule for "activation" and
     want to keep self-registration, you must include this in your rule that
@@ -97,8 +97,8 @@ Developer corner
 
 If you have another TOTP registration interface, you have to set these
 keys in Second Factor Devices array (JSON) in your user-database. Then
-map it to the \_2fDevices attribute *(see
-:doc:`exported variables<exportedvars>`)*:
+map it to the \_2fDevices attribute (see
+:doc:`exported variables<exportedvars>`):
 
 .. code:: json
 
diff --git a/doc/sources/admin/u2f.rst b/doc/sources/admin/u2f.rst
index fc41735d4..6563f248a 100644
--- a/doc/sources/admin/u2f.rst
+++ b/doc/sources/admin/u2f.rst
@@ -10,7 +10,7 @@ LLNG can propose to users to register their keys. When done, 2F
 registered users can not login without using their key.
 
 
-.. tip:: 
+.. tip::
 
     Note that it's a second factor, not an authentication module.
     Users are authenticated by both login form and U2F form.
@@ -31,7 +31,7 @@ For other systems, use CPAN. Before compiling it, you must install
 Yubico's C library headers.
 
 
-.. important:: 
+.. important::
 
     An HTTPS portal is required to use U2F
 
@@ -58,7 +58,7 @@ In the manager (second factors), you just have to enable it:
    the choice screen
 
 
-.. important:: 
+.. important::
 
     If you want to use a custom rule for "activation" and
     enable self-registration, you have to include this in your rule:
@@ -75,8 +75,8 @@ Browser compatibility
    -  38 to 56 with `U2F Support
       Add-on <https://addons.mozilla.org/fr/firefox/addon/u2f-support-add-on/>`__
    -  57 to 59, with "security.webauth.u2f" set to "true" in
-      about:config *(see*\ `Yubico
-      explanations <https://www.yubico.com/2017/11/how-to-navigate-fido-u2f-in-firefox-quantum/>`__\ *)*
+      about:config (see `Yubico
+      explanations <https://www.yubico.com/2017/11/how-to-navigate-fido-u2f-in-firefox-quantum/>`__)
    -  probably enabled by default for versions ≥ 60
 
 -  Opera ≥ 40
@@ -104,15 +104,15 @@ Developer corner
 
 If you have another U2F registration interface, you have to set these
 keys in Second Factor Devices array (JSON) in your user-database. Then
-map it to the \_2fDevices attribute *(see
-:doc:`exported variables<exportedvars>`)*:
+map it to the \_2fDevices attribute (see
+:doc:`exported variables<exportedvars>`):
 
 .. code:: perl
 
    $_2fDevices = [{"name" : "MyU2FKey" , "type" : "U2F" , "_userKey" : "########" , "_keyHandle":"########" , "epoch":"1524078936"}, ...]
 
 
-.. important:: 
+.. important::
 
     \ ``_userKey`` must be base64 encoded
 
diff --git a/doc/sources/admin/upgrade.rst b/doc/sources/admin/upgrade.rst
index 28d494dff..6899d0d86 100644
--- a/doc/sources/admin/upgrade.rst
+++ b/doc/sources/admin/upgrade.rst
@@ -5,7 +5,7 @@ Please apply general caution as you would with any software: have
 backups and a rollback plan ready!
 
 
-.. warning:: 
+.. warning::
 
     If you have
     :doc:`installed LemonLDAP::NG from official RPMs<installrpm>`, you may
@@ -153,12 +153,14 @@ manager API config:
 -  CAS logout starts validating the service= parameter, but only if you
    use the CAS Access control policy. The URL sent in the service=
    parameter will be checked against
-   :doc:`known CAS applications<idpcas>`, Virtual Hosts, and
-   :doc:`trusted domains<security>`. Add your target domain to trusted
-   domains if you suddenly start having "Invalid URL" messages on logout
+   :ref:`known CAS applications<idpcas-configuring-cas-applications>`,
+   Virtual Hosts, and
+   :ref:`trusted domains<security-configure-security-settings>`. Add
+   your target domain to trusted domains if you suddenly start having
+   "Invalid URL" messages on logout
 -  Improvements in cryptographic functions: to take advantage of them,
    **you must change the encryption key** of LemonLDAP::NG (see
-   :doc:`CLI example<cli_examples>`).
+   :ref:`CLI example<cli-examples-encryption-key>`).
 -  Debian packaging: FastCGI / uWsgi servers require llng-lmlog.conf and
    llng-lua-headers.conf. Those configuration files are now provided by
    lemonldap-ng-handler package and installed in /etc/nginx/snippets
@@ -168,7 +170,7 @@ Upgrade from 1.9 to 2.0
 =======================
 
 
-.. important:: 
+.. important::
 
     2.0 is a major release, lot of things have been changed.
     You must read this document before upgrade.
@@ -186,7 +188,7 @@ upgrade must be done in the following order:
 #. manager server
 
 
-.. important:: 
+.. important::
 
     You must revalidate your configuration using the
     manager.
@@ -195,7 +197,7 @@ Installation
 ------------
 
 
-.. important:: 
+.. important::
 
     French documentation is no more available. Only English
     version of this documentation is maintained now.
@@ -225,7 +227,8 @@ Configuration
    -  **languages** *(manager and portal)*: accepted languages
 
 -  Portal skins are now in ``/usr/share/lemonldap-ng/portal/templates``.
-   See :doc:`skin customization<portalcustom>` to adapt your templates.
+   See :ref:`skin customization<portalcustom-skin-customization>` to
+   adapt your templates.
 -  User module in authentication parameters now provides a "Same as
    authentication" value. You must revalidate it in the manager since
    all special values must be replaced by this *(Multi, Choice, Proxy,
@@ -246,14 +249,14 @@ Configuration
    :doc:`how to run LL::NG behind a reverse proxy<behindproxyminihowto>`.
 
 
-.. important:: 
+.. important::
 
     Apache mod_perl has got lot of troubleshooting problems
-    since 2.4 version *(many segfaults,...)*, especially when using MPM
+    since 2.4 version (many segfaults,...), especially when using MPM
     worker or MPM event. That's why LL::NG doesn't use anymore
-    ModPerl::Registry: all is now handled by FastCGI *(portal and manager)*,
+    ModPerl::Registry: all is now handled by FastCGI (portal and manager),
     except for Apache2 Handler.
-    
+
     **For Handlers, it is now recommended to migrate to Nginx**, but Apache
     2.4 is still supported with MPM prefork.
 
@@ -265,7 +268,7 @@ configuration stored in local cache every 10 minutes. So it has to be
 reload like every handler.
 
 
-.. important:: 
+.. important::
 
     If you want to use reload mechanism on a portal only
     host, you must install a handler in Portal host to be able to refresh
@@ -286,7 +289,7 @@ Kerberos or SSL usage
    added since 2.0. This module solves many Kerberos integration
    problems *(usage in conjunction with other backends, better error
    display,…)*. However, you can retain the old integration manner
-   *(using :doc:`Apache authentication module<authapache>`)*.
+   (using :doc:`Apache authentication module<authapache>`).
 -  For :doc:`SSL<authssl>`, a new :doc:`Ajax option<authssl>` can be
    used in the same idea: so SSL can be used in conjunction with other
    backends.
@@ -348,11 +351,9 @@ Handlers
 Rules and headers
 -----------------
 
-::
-
-   * hostname() and remote_ip() are no more provided to avoid some name conflicts //(replaced by $ENV{})//
-   * ''$ENV{<cgi_variable>}'' is now available everywhere: see [[writingrulesand_headers|Writing rules and headers]]
-   * some variable names have changed. See [[variables]] document
+* hostname() and remote_ip() are no more provided to avoid some name conflicts *replaced by `$ENV{}`)*
+* `$ENV{<cgi_variable>}` is now available everywhere: see :doc:`writingrulesand_headers`
+* some variable names have changed. See :doc:`variables` document
 
 Opening conditions
 ------------------
@@ -387,7 +388,7 @@ SOAP/REST services
 -  SOAP services can be replaced by new REST services
 
 
-.. important:: 
+.. important::
 
     \ :doc:`AuthBasic Handler<handlerauthbasic>` uses now
     REST services instead of SOAP.
@@ -443,4 +444,4 @@ handlers, they must be rewritten, see
 :doc:`customhandlers<customhandlers>`.
 
 If you used self protected CGI, you also need to rewrite them, see
-:doc:`documentation<selfmadeapplication>`.
+:ref:`documentation<selfmadeapplication-perl-auto-protected-cgi>`.
diff --git a/doc/sources/admin/utotp2f.rst b/doc/sources/admin/utotp2f.rst
index 0e807ebf0..1d30f12e5 100644
--- a/doc/sources/admin/utotp2f.rst
+++ b/doc/sources/admin/utotp2f.rst
@@ -26,14 +26,14 @@ In the manager (second factors), you just have to enable it:
    the choice screen
 
 
-.. tip:: 
+.. tip::
 
     Every other parameters of :doc:`U2F<u2f>` and
     :doc:`TOTP<totp2f>` can be set in the corresponding 2F modules except
     that you should not enable them.
 
 
-.. important:: 
+.. important::
 
     If you want to give a different level for U2F or TOTP,
     leave this parameter blank and set U2F and TOTP "authentication level"
diff --git a/doc/sources/admin/variables.rst b/doc/sources/admin/variables.rst
index 3ed0dca3d..41a2abead 100644
--- a/doc/sources/admin/variables.rst
+++ b/doc/sources/admin/variables.rst
@@ -16,7 +16,7 @@ kind of variables:
 
 -  internal variables, managed by LemonLDAP::NG
 -  :doc:`exported variables<exportedvars>` collected from UserDB backend
--  :doc:`macro and groups<performances>`
+-  :ref:`macro and groups<macros_and_groups>`
 
 When you know the key of the variable, you just have to prefix it with
 the dollar sign to use it, for example to test if ``uid`` variable match
@@ -27,7 +27,7 @@ the dollar sign to use it, for example to test if ``uid`` variable match
    $uid eq "coudot"
 
 
-.. tip:: 
+.. tip::
 
     You can inspect a user session with the sessions explorer (in
     Manager)
diff --git a/doc/sources/admin/viewer.rst b/doc/sources/admin/viewer.rst
index 0fec705d3..c5e582e7c 100644
--- a/doc/sources/admin/viewer.rst
+++ b/doc/sources/admin/viewer.rst
@@ -30,27 +30,27 @@ Parameters are set in ``lemonldap-ng.ini`` file, section [manager]:
    -  **viewerAllowDiff**: enable "difference with previous" link
 
 
-.. warning:: 
+.. warning::
+
+
 
-    
-    
     You have to set access rules to allow/deny users to access modules.
-    
+
     In Manager: \* Declare a Virtual Host : manager.example.com \* Set an
     access rule for each enabled module :
-    
+
     #. Configuration : ^/(.*?\.(fcgi|psgi)/)?(manager\.html|confs|$) = $uid
        eq 'dwho'
     #. Notifications : ^/(.*?\.(fcgi|psgi)/)?notifications = $uid eq 'dwho'
     #. Sessions : ^/(.*?\.(fcgi|psgi)/)?sessions = $uid eq 'dwho'
     #. Viewer : ^/(.*?\.(fcgi|psgi)/)?viewer = $uid =~ /\b(?:dwho|rtyler)\b/
     #. Default : $uid =~ /\b(?:dwho|rtyler)\b/
-    
 
 
 
-.. important:: 
+
+.. important::
 
     To avoid that Read-Only users can access to
     configuration module by using default route, keep in mind to set
-    'defaultModule' option 
+    'defaultModule' option
diff --git a/doc/sources/admin/webserviceprotection.rst b/doc/sources/admin/webserviceprotection.rst
index c160ef773..33e82b58a 100644
--- a/doc/sources/admin/webserviceprotection.rst
+++ b/doc/sources/admin/webserviceprotection.rst
@@ -48,11 +48,11 @@ For example:
 
 .. code:: javascript
 
-   { 
-     "family_name" : "OUDOT", 
-     "name" : "Clément OUDOT", 
-     "email" : "clement@example.com", 
-     "sub" : "coudot" 
+   {
+     "family_name" : "OUDOT",
+     "name" : "Clément OUDOT",
+     "email" : "clement@example.com",
+     "sub" : "coudot"
    }
 
 Introspection
@@ -94,7 +94,7 @@ HTTP headers to know which user is connected.
 
    curl \
       -H "Authorization: Bearer a74d504ec9e784785e70a1da2b95d1d2" \
-      https://oauth2.example.ccom/rest/myapi 
+      https://oauth2.example.ccom/rest/myapi
 
 .. code:: javascript
 
diff --git a/doc/sources/admin/writingrulesand_headers.rst b/doc/sources/admin/writingrulesand_headers.rst
index c73f67438..8b369e632 100644
--- a/doc/sources/admin/writingrulesand_headers.rst
+++ b/doc/sources/admin/writingrulesand_headers.rst
@@ -7,24 +7,24 @@ headers added to the request to give datas to the application (for logs,
 profiles,...).
 
 
-.. important:: 
+.. important::
 
     Note that variables designed by $xx correspond to the
     name of the :doc:`exported variables<exportedvars>` or
-    :doc:`macro names<performances>` except for ``$ENV{<cgi-header>}`` which
-    correspond to CGI header *(``$ENV{REMOTE_ADDR}`` for example)*.
+    :ref:`macro names<macros_and_groups>` except for ``$ENV{<cgi-header>}`` which
+    correspond to CGI header (``$ENV{REMOTE_ADDR}`` for example).
 
 Available $ENV variables
 ------------------------
 
 The %ENV table provides:
 
--  all headers in CGI format *(``User-Agent`` becomes
-   ``HTTP_USER_AGENT``)*
+-  all headers in CGI format (``User-Agent`` becomes
+   ``HTTP_USER_AGENT``)
 -  some CGI variables depending on the context:
 
-   -  For portal: all CGI standard variables *(you can add custom
-      headers using ``fastcgi_param`` with Nginx)*,
+   -  For portal: all CGI standard variables (you can add custom
+      headers using ``fastcgi_param`` with Nginx),
    -  For Apache handler: REMOTE_ADDR, QUERY_STRING, REQUEST_URI,
       SERVER_PORT, REQUEST_METHOD,
    -  For Nginx handler: all variables given by ``fastcgi_param``
@@ -37,6 +37,8 @@ The %ENV table provides:
 
 See also :doc:`extended functions<extendedfunctions>`.
 
+.. _rules:
+
 Rules
 -----
 
@@ -51,36 +53,35 @@ Examples:
 =============================================================================================================================================== ================== ======================================
 Goal                                                                                                                                            Regular expression Rule
 =============================================================================================================================================== ================== ======================================
-Restrict /admin/ directory to user bart.simpson                                                                                                 ^/admin/          
+Restrict /admin/ directory to user bart.simpson                                                                                                 ^/admin/
 Restrict /js/ and /css/ directory to authenticated users                                                                                        ^/(css|js)/        accept
 Deny access to /config/ directory                                                                                                               ^/config/          deny
 Do not restrict /public/                                                                                                                        ^/public/          skip
 Do not restrict /skip/ and restrict other to authenticated users                                                                                ^/skip/            $ENV{REQUEST_URI} =~ /skip/ ? skip : 1
 Makes authentication optional, but authenticated users are seen as such (that is, user data are sent to the app through HTTP headers)           ^/forum/           unprotect
-Restrict access to the whole site to users that have the LDAP description field set to "LDAP administrator" (must be set in exported variables) default           
+Restrict access to the whole site to users that have the LDAP description field set to "LDAP administrator" (must be set in exported variables) default
 =============================================================================================================================================== ================== ======================================
 
 The "**default**" access rule is used if no other access rule match the
 current URL.
 
 
-.. tip:: 
+.. tip::
 
     See :doc:`the rules examples page<rules_examples>` for a few
-    common use cases 
+    common use cases
+
+
+.. tip::
 
 
-.. tip:: 
 
-    
-    
     -  Comments can be used to order your rules: rules are applied in the
        alphabetical order of comment (or regexp in there is no comment). See
-       :doc:`security chapter<security>` to learn more about writing
-       good rules.
-    -  See :doc:`performances<performances>` to know how to use macros and
-       groups in rules.
-    
+       :ref:`security chapter<security-write-good-rules>` to learn more
+       about writing good rules.
+    -  See :ref:`performances<performances-handler-performance>` to know how
+       to use macros and groups in rules.
 
 
 Rules can also be used to intercept logout URL:
@@ -94,7 +95,7 @@ Logout user from current application and from Lemonldap::NG and redirect it to h
 ================================================================================================================= =================== ====
 
 
-.. warning:: 
+.. warning::
 
     \ ``logout_app`` and ``logout_app_sso`` rules are not
     available on Nginx, only on Apache.
@@ -103,7 +104,7 @@ By default, user will be redirected on portal if no URL defined, or on
 the specified URL if any.
 
 
-.. important:: 
+.. important::
 
     Only current application is concerned by logout_app\*
     targets. Be careful with some applications which doesn't verify
@@ -121,8 +122,8 @@ values are:
 -  0 for :doc:`Null<authnull>`
 -  1 for :doc:`CAS<authcas>`, :doc:`old OpenID-2<authopenid>`,
    :doc:`Facebook<authfacebook>`,…
--  2 for web-form based authentication *(:doc:`LDAP<authldap>`,
-   :doc:`DBI<authdbi>`,…)*
+-  2 for web-form based authentication (:doc:`LDAP<authldap>`,
+   :doc:`DBI<authdbi>`,…)
 -  3 for :doc:`Yubikey<authyubikey>`
 -  4 for :doc:`Kerberos<authapache>`
 -  5 for :doc:`SSL<authssl>`
@@ -139,12 +140,14 @@ There are three ways to impose users a higher authentication level:
    backend).
 
 
-.. tip:: 
+.. tip::
 
     Instead of returning a 403 code, "minimum level" returns user
     to a form that explain that a higher level is required and propose to
     reauthenticate himself.
 
+.. _headers:
+
 Headers
 -------
 
@@ -163,34 +166,35 @@ Give display name             Display-Name $givenName." ".$surName
 Give a non ascii data         Display-Name
 ============================= ============ =======================
 
-As described in :doc:`performances chapter<performances>`, you can use
-macros, local macros,...
+As described in
+:ref:`performances chapter<performances-handler-performance>`, you can
+use macros, local macros,...
+
+
+.. important::
 
 
-.. important:: 
 
-    
-    
     -  Since many HTTP servers refuse non ascii headers, it is recommended
        to use encode_base64() function to transmit those headers
     -  Don't forget to add an empty string as second argument to
        encode_base64 function to avoid a "newline" characters insertion in
        result
     -  Header names must contain only letters and "-" character
-    
 
 
 
-.. tip:: 
+
+.. tip::
 
     By default, SSO cookie is hidden. So protected applications
     cannot retrieve SSO session key. But you can forward this key if
     absolutely needed:
-    
+
     ::
-    
+
        Session-ID => $_session_id
-    
+
 
 
 Available functions
@@ -219,8 +223,8 @@ rule is applied. Example with precedence order for test.sub.example.com:
 #. test*.sub.example.com
 #. %.sub.example.com
 #. \*.sub.example.com
-#. \*.example.com *(``%.example.com`` does not match
-   test.sub.example.com)*
+#. \*.example.com (``%.example.com`` does not match
+   test.sub.example.com)
 
 .. |image0| image:: /documentation/manager-rule.png
    :class: align-center
diff --git a/doc/sources/admin/yubikey2f.rst b/doc/sources/admin/yubikey2f.rst
index 107c8b3f5..a062dddb1 100644
--- a/doc/sources/admin/yubikey2f.rst
+++ b/doc/sources/admin/yubikey2f.rst
@@ -44,7 +44,7 @@ In the manager (second factors), you just have to enable it:
    the choice screen
 
 
-.. important:: 
+.. important::
 
     If you want to use a custom rule for "activation" and
     want to keep self-registration, you must include this in your rule:
@@ -57,8 +57,8 @@ Provisioning
 
 If you don't want to use self-registration, set public part of user's
 yubikey in Second Factor Devices array (JSON) in your user-database.
-Then map it to the \_2fDevices attribute *(see
-:doc:`exported variables<exportedvars>`)*:
+Then map it to the \_2fDevices attribute (see
+:doc:`exported variables<exportedvars>`):
 
 .. code:: json