{ "componentChunkName": "component---src-templates-issues-tsx", "path": "/issues/353", "result": {"data":{"issuesJson":{"id":"af51f182-cff1-54bd-940a-5698686218c7","title":"lldap/lldap: 一个基于 Rust 编写的轻量 ldap 服务端，提供了简单的 UI 界面，注意，它没有实现完整的 ldap。","number":353,"bodyHTML":"
\n



\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Reposlldap/lldap
Views\"views\"
Stars\"stars\"
Forks\"forks\"
License\"license\"
UpdatedAt\"last-commit\"
CreatedAt\"create-at\"
\n\n

\"\"

\n\n
\n

lldap - Light LDAP implementation for authentication

\n

\nLDAP made easy.\n

\n

\n \n \"Build\"\n \n \n \"Discord\"\n \n \n \"Twitter\n \n \n \"Unsafe\n \n \n \"Codecov\"\n \n
\n \n \"Buy\n \n

\n\n

About

\n

This project is a lightweight authentication server that provides an
\nopinionated, simplified LDAP interface for authentication. It integrates with
\nmany backends, from KeyCloak to Authelia to Nextcloud and
\nmore!

\n

\"Screenshot

\n

It comes with a frontend that makes user management easy, and allows users to
\nedit their own details or reset their password by email.

\n

The goal is not to provide a full LDAP server; if you're interested in that,
\ncheck out OpenLDAP. This server is a user management system that is:

\n\n

It mostly targets self-hosting servers, with open-source components like
\nNextcloud, Airsonic and so on that only support LDAP as a source of external
\nauthentication.

\n

For more features (OAuth/OpenID support, reverse proxy, ...) you can install
\nother components (KeyCloak, Authelia, ...) using this server as the source of
\ntruth for users, via LDAP.

\n

By default, the data is stored in SQLite, but you can swap the backend with
\nMySQL/MariaDB or PostgreSQL.

\n

Installation

\n

With Docker

\n

The image is available at lldap/lldap. You should persist the /data
\nfolder, which contains your configuration and the SQLite database (you can
\nremove this step if you use a different DB and configure with environment
\nvariables only).

\n

Configure the server by copying the lldap_config.docker_template.toml to
\n/data/lldap_config.toml and updating the configuration values (especially the
\njwt_secret and ldap_user_pass, unless you override them with env variables).
\nEnvironment variables should be prefixed with LLDAP_ to override the
\nconfiguration.

\n

If the lldap_config.toml doesn't exist when starting up, LLDAP will use
\ndefault one. The default admin password is password, you can change the
\npassword later using the web interface.

\n

Secrets can also be set through a file. The filename should be specified by the
\nvariables LLDAP_JWT_SECRET_FILE or LLDAP_KEY_SEED_FILE, and the file
\ncontents are loaded into the respective configuration parameters. Note that
\n_FILE variables take precedence.

\n

Example for docker compose:

\n\n
version: \"3\"\n\nvolumes:\n  lldap_data:\n    driver: local\n\nservices:\n  lldap:\n    image: lldap/lldap:stable\n    ports:\n      # For LDAP, not recommended to expose, see Usage section.\n      #- \"3890:3890\"\n      # For LDAPS (LDAP Over SSL), enable port if LLDAP_LDAPS_OPTIONS__ENABLED set true, look env below\n      #- \"6360:6360\"\n      # For the web front-end\n      - \"17170:17170\"\n    volumes:\n      - \"lldap_data:/data\"\n      # Alternatively, you can mount a local folder\n      # - \"./lldap_data:/data\"\n    environment:\n      - UID=####\n      - GID=####\n      - TZ=####/####\n      - LLDAP_JWT_SECRET=REPLACE_WITH_RANDOM\n      - LLDAP_KEY_SEED=REPLACE_WITH_RANDOM\n      - LLDAP_LDAP_BASE_DN=dc=example,dc=com\n      - LLDAP_LDAP_USER_PASS=adminPas$word\n      # If using LDAPS, set enabled true and configure cert and key path\n      # - LLDAP_LDAPS_OPTIONS__ENABLED=true\n      # - LLDAP_LDAPS_OPTIONS__CERT_FILE=/path/to/certfile.crt\n      # - LLDAP_LDAPS_OPTIONS__KEY_FILE=/path/to/keyfile.key\n      # You can also set a different database:\n      # - LLDAP_DATABASE_URL=mysql://mysql-user:password@mysql-server/my-database\n      # - LLDAP_DATABASE_URL=postgres://postgres-user:password@postgres-server/my-database\n      # If using SMTP, set the following variables\n      # - LLDAP_SMTP_OPTIONS__ENABLE_PASSWORD_RESET=true\n      # - LLDAP_SMTP_OPTIONS__SERVER=smtp.example.com\n      # - LLDAP_SMTP_OPTIONS__PORT=465 # Check your smtp providor's documentation for this setting\n      # - LLDAP_SMTP_OPTIONS__SMTP_ENCRYPTION=TLS # How the connection is encrypted, either \"NONE\" (no encryption, port 25), \"TLS\" (sometimes called SSL, port 465) or \"STARTTLS\" (sometimes called TLS, port 587).\n      # - LLDAP_SMTP_OPTIONS__USER=no-reply@example.com # The SMTP user, usually your email address\n      # - LLDAP_SMTP_OPTIONS__PASSWORD=PasswordGoesHere # The SMTP password\n      # - LLDAP_SMTP_OPTIONS__FROM=no-reply <no-reply@example.com> # The header field, optional: how the sender appears in the email. The first is a free-form name, followed by an email between <>.\n      # - LLDAP_SMTP_OPTIONS__TO=admin <admin@example.com> # Same for reply-to, optional.
\n

Then the service will listen on two ports, one for LDAP and one for the web
\nfront-end.

\n

With Podman

\n

LLDAP works well with rootless Podman either through command line deployment
\nor using quadlets. The example quadlets
\ninclude configuration with postgresql and file based secrets, but have comments
\nfor several other deployment strategies.

\n

With Kubernetes

\n

See https://github.com/Evantage-WS/lldap-kubernetes for a LLDAP deployment for Kubernetes

\n

You can bootstrap your lldap instance (users, groups)
\nusing bootstrap.sh.
\nIt can be run by Argo CD for managing users in git-opt way, or as a one-shot job.

\n

From a package repository

\n

Do not open issues in this repository for problems with third-party
\npre-built packages. Report issues downstream.

\n

Depending on the distribution you use, it might be possible to install lldap
\nfrom a package repository, officially supported by the distribution or
\ncommunity contributed.

\n

Each package offers a systemd service lldap.service or rc.d_lldap rc.d/lldap to (auto-)start and stop lldap.

\nWhen using the distributed packages, the default login is admin/password. You can change that from the web UI after starting the service.

\n
\nArch Linux\n
\n Arch Linux offers unofficial support through the Arch User Repository (AUR).
\n The package descriptions can be used to create and install packages.

\n Support: Discussions
\n Package repository: Arch User Repository

\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
Package nameMaintainerDescription
lldap@ZepmannBuilds the latest stable version.
lldap-bin@ZepmannUses the latest pre-compiled binaries from the releases in this repository.
\n This package is recommended if you want to run LLDAP on a system with limited resources.
lldap-gitBuilds the latest main branch code.
\nLLDAP configuration file: /etc/lldap.toml
\n
\n
\nDebian\n
\n Unofficial Debian support is offered through the openSUSE Build Service.

\n Maintainer: @Masgalor
\n Support: Codeberg, Discussions
\n Package repository: SUSE openBuildService
\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
Available packages:lldapLight LDAP server for authentication.
lldap-extrasMeta-Package for LLDAP and its tools and extensions.
lldap-migration-toolCLI migration tool to go from OpenLDAP to LLDAP.
lldap-set-passwordCLI tool to set a user password in LLDAP.
lldap-cliLLDAP-CLI is an unofficial command line interface for LLDAP.
\nLLDAP configuration file: /etc/lldap/lldap_config.toml
\n
\n
\nCentOS\n
\n Unofficial CentOS support is offered through the openSUSE Build Service.

\n Maintainer: @Masgalor
\n Support: Codeberg, Discussions
\n Package repository: SUSE openBuildService
\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
Available packages:lldapLight LDAP server for authentication.
lldap-extrasMeta-Package for LLDAP and its tools and extensions.
lldap-migration-toolCLI migration tool to go from OpenLDAP to LLDAP.
lldap-set-passwordCLI tool to set a user password in LLDAP.
lldap-cliLLDAP-CLI is an unofficial command line interface for LLDAP.
\nLLDAP configuration file: /etc/lldap/lldap_config.toml
\n
\n
\nFedora\n
\n Unofficial Fedora support is offered through the openSUSE Build Service.

\n Maintainer: @Masgalor
\n Support: Codeberg, Discussions
\n Package repository: SUSE openBuildService
\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
Available packages:lldapLight LDAP server for authentication.
lldap-extrasMeta-Package for LLDAP and its tools and extensions.
lldap-migration-toolCLI migration tool to go from OpenLDAP to LLDAP.
lldap-set-passwordCLI tool to set a user password in LLDAP.
lldap-cliLLDAP-CLI is an unofficial command line interface for LLDAP.
\nLLDAP configuration file: /etc/lldap/lldap_config.toml
\n
\n
\nOpenSUSE\n
\n Unofficial OpenSUSE support is offered through the openSUSE Build Service.

\n Maintainer: @Masgalor
\n Support: Codeberg, Discussions
\n Package repository: SUSE openBuildService
\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
Available packages:lldapLight LDAP server for authentication.
lldap-extrasMeta-Package for LLDAP and its tools and extensions.
lldap-migration-toolCLI migration tool to go from OpenLDAP to LLDAP.
lldap-set-passwordCLI tool to set a user password in LLDAP.
lldap-cliLLDAP-CLI is an unofficial command line interface for LLDAP.
\nLLDAP configuration file: /etc/lldap/lldap_config.toml
\n
\n
\nUbuntu\n
\n Unofficial Ubuntu support is offered through the openSUSE Build Service.

\n Maintainer: @Masgalor
\n Support: Codeberg, Discussions
\n Package repository: SUSE openBuildService
\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
Available packages:lldapLight LDAP server for authentication.
lldap-extrasMeta-Package for LLDAP and its tools and extensions.
lldap-migration-toolCLI migration tool to go from OpenLDAP to LLDAP.
lldap-set-passwordCLI tool to set a user password in LLDAP.
lldap-cliLLDAP-CLI is an unofficial command line interface for LLDAP.
\nLLDAP configuration file: /etc/lldap/lldap_config.toml
\n
\n
\nFreeBSD\n
\n Official FreeBSD support is offered through the FreeBSD Freshport Build Service.

\n Maintainer: @aokblast
\n Support: Bugzilla, Discussions
\n Package repository: FreeBSD Freshport Build
\n FreeBSD Setup and Migration Manual: Using FreeBSD
\n\n \n \n \n \n \n
Available packages:lldapLight LDAP server for authentication.
\nLLDAP configuration file: /usr/local/lldap_server/lldap_config.toml
\n
\n

From source

\n

Backend

\n

To compile the project, you'll need:

\n\n

Then you can compile the server (and the migration tool if you want):

\n
cargo build --release -p lldap -p lldap_migration_tool
\n

The resulting binaries will be in ./target/release/. Alternatively, you can
\njust run cargo run -- run to run the server.

\n

Frontend

\n

To bring up the server, you'll need to compile the frontend. In addition to
\ncargo, you'll need WASM-pack, which can be installed by running cargo install wasm-pack.

\n

Then you can build the frontend files with

\n
./app/build.sh
\n

(you'll need to run this after every front-end change to update the WASM
\npackage served).

\n

The default config is in src/infra/configuration.rs, but you can override it
\nby creating an lldap_config.toml, setting environment variables or passing
\narguments to cargo run. Have a look at the docker template:
\nlldap_config.docker_template.toml.

\n

You can also install it as a systemd service, see
\nlldap.service.

\n

Cross-compilation

\n

Docker images are provided for AMD64, ARM64 and ARM/V7.

\n

If you want to cross-compile yourself, you can do so by installing
\ncross:

\n
cargo install cross\ncross build --target=armv7-unknown-linux-musleabihf -p lldap --release\n./app/build.sh
\n

(Replace armv7-unknown-linux-musleabihf with the correct Rust target for your
\ndevice.)

\n

You can then get the compiled server binary in
\ntarget/armv7-unknown-linux-musleabihf/release/lldap and the various needed files
\n(index.html, main.js, pkg folder) in the app folder. Copy them to the
\nRaspberry Pi (or other target), with the folder structure maintained (app
\nfiles in an app folder next to the binary).

\n

Usage

\n

The simplest way to use LLDAP is through the web front-end. There you can
\ncreate users, set passwords, add them to groups and so on. Users can also
\nconnect to the web UI and change their information, or request a password reset
\nlink (if you configured the SMTP client).

\n

You can create and manage custom attributes through the Web UI, or through the
\ncommunity-contributed CLI frontend (
\nZepmann/lldap-cli). This is necessary
\nfor some service integrations.

\n

The bootstrap.sh script can enforce a list of
\nusers/groups/attributes from a given file, reflecting it on the server.

\n

To manage the user, group and membership lifecycle in an infrastructure-as-code
\nscenario you can use the unofficial LLDAP terraform provider in the terraform registry.

\n

LLDAP is also very scriptable, through its GraphQL API. See the
\nScripting docs for more info.

\n

Recommended architecture

\n

If you are using containers, a sample architecture could look like this:

\n\n

Client configuration

\n

Compatible services

\n

Most services that can use LDAP as an authentication provider should work out
\nof the box. For new services, it's possible that they require a bit of tweaking
\non LLDAP's side to make things work. In that case, just create an issue with
\nthe relevant details (logs of the service, LLDAP logs with verbose=true in
\nthe config).

\n

General configuration guide

\n

To configure the services that will talk to LLDAP, here are the values:

\n\n

Testing group membership through memberOf is supported, so you can have a
\nfilter like: (memberOf=cn=admins,ou=groups,dc=example,dc=com).

\n

The administrator group for LLDAP is lldap_admin: anyone in this group has
\nadmin rights in the Web UI. Most LDAP integrations should instead use a user in
\nthe lldap_strict_readonly or lldap_password_manager group, to avoid granting full
\nadministration access to many services. To prevent privilege escalation users in the
\nlldap_password_manager group are not allowed to change passwords of admins in the
\nlldap_admin group.

\n

Integration with OS's

\n

Integration with Linux accounts is possible, through PAM and nslcd. See PAM
\nconfiguration guide.

\n

Integration with Windows (e.g. Samba) is WIP.

\n

Sample client configurations

\n

Some specific clients have been tested to work and come with sample
\nconfiguration files, or guides. See the example_configs
\nfolder for help with:

\n\n

Incompatible services

\n

Though we try to be maximally compatible, not every feature is supported; LLDAP
\nis not a fully-featured LDAP server, intentionally so.

\n

LDAP browsing tools are generally not supported, though they could be. If you
\nneed to use one but it behaves weirdly, please file a bug.

\n

Some services use features that are not implemented, or require specific
\nattributes. You can try to create those attributes (see custom attributes in
\nthe Usage section).

\n

Finally, some services require password hashes so they can validate themselves
\nthe user's password without contacting LLDAP. This is not and will not be
\nsupported, it's incompatible with our password hashing scheme (a zero-knowledge
\nproof). Furthermore, it's generally not recommended in terms of security, since
\nit duplicates the places from which a password hash could leak.

\n

In that category, the most prominent is Synology. It is, to date, the only
\nservice that seems definitely incompatible with LLDAP.

\n

Migrating from SQLite

\n

If you started with an SQLite database and would like to migrate to
\nMySQL/MariaDB or PostgreSQL, check out the DB
\nmigration docs.

\n

Comparisons with other services

\n

vs OpenLDAP

\n

OpenLDAP is a monster of a service that implements
\nall of LDAP and all of its extensions, plus some of its own. That said, if you
\nneed all that flexibility, it might be what you need! Note that installation
\ncan be a bit painful (figuring out how to use slapd) and people have mixed
\nexperiences following tutorials online. If you don't configure it properly, you
\nmight end up storing passwords in clear, so a breach of your server would
\nreveal all the stored passwords!

\n

OpenLDAP doesn't come with a UI: if you want a web interface, you'll have to
\ninstall one (not that many look nice) and configure it.

\n

LLDAP is much simpler to setup, has a much smaller image (10x smaller, 20x if
\nyou add PhpLdapAdmin), and comes packed with its own purpose-built web UI.
\nHowever, it's not as flexible as OpenLDAP.

\n

vs FreeIPA

\n

FreeIPA is the one-stop shop for identity management:
\nLDAP, Kerberos, NTP, DNS, Samba, you name it, it has it. In addition to user
\nmanagement, it also does security policies, single sign-on, certificate
\nmanagement, linux account management and so on.

\n

If you need all of that, go for it! Keep in mind that a more complex system is
\nmore complex to maintain, though.

\n

LLDAP is much lighter to run (<10 MB RAM including the DB), easier to
\nconfigure (no messing around with DNS or security policies) and simpler to
\nuse. It also comes conveniently packed in a docker container.

\n

vs Kanidm

\n

Kanidm is an up-and-coming Rust identity management
\nplatform, covering all your bases: OAuth, Linux accounts, SSH keys, Radius,
\nWebAuthn. It comes with a (read-only) LDAPS server.

\n

It's fairly easy to install and does much more; but their LDAP server is
\nread-only, and by having more moving parts it is inherently more complex. If
\nyou don't need to modify the users through LDAP and you're planning on
\ninstalling something like KeyCloak to provide
\nmodern identity protocols, check out Kanidm.

\n

I can't log in!

\n

If you just set up the server, can get to the login page but the password you
\nset isn't working, try the following:

\n\n

Discord Integration

\n

Use this bot to Automate discord role syncronization for paid memberships.

\n\n

Contributions

\n

Contributions are welcome! Just fork and open a PR. Or just file a bug.

\n

We don't have a code of conduct, just be respectful and remember that it's just
\nnormal people doing this for free on their free time.

\n

Make sure that you run cargo fmt from the root before creating the PR. And if
\nyou change the GraphQL interface, you'll need to regenerate the schema by
\nrunning ./export_schema.sh.

\n

Join our Discord server if you have any
\nquestions!

","updatedAt":"2025-05-21T16:10:22Z","upvoteCount":null,"author":{"login":"eryajf","avatarUrl":"https://avatars.githubusercontent.com/u/33259379?u=e4a4090a38ac2473aaed4ef9945233636776c6c3&v=4","url":"https://github.com/eryajf"},"category":null,"labels":{"edges":[{"node":{"name":"更多","color":"25B472"}},{"node":{"name":"OpenLDAP","color":"508193"}},{"node":{"name":"lldap","color":"435425"}}]},"comments":{"edges":[]}}},"pageContext":{"number":353,"previous":{"title":"SuperManito/LinuxMirrors: GNU/Linux 更换系统软件源脚本及 Docker 安装脚本","number":352},"next":{"title":"tstack/lnav: 终端的日志文件查看器，轻松合并、尾随、搜索、过滤和查询日志文件","number":354}}}, "staticQueryHashes": ["151096407","2861350382"]}