Reading the repo
Opening the box…
Reading the repo
Opening the box…
How to install on macOS
Light LDAP implementation
GitHub didn't answer, so this is the saved copy from 21 h ago
Will it work on macOS?
The maintainers included scripts/bootstrap.sh. Run it from the cloned folder after reading it.
bash scripts/bootstrap.sh
docs/install.mdThe image is available at lldap/lldap. You should persist the /data
folder, which contains your configuration and the SQLite database (you can
remove this step if you use a different DB and configure with environment
variables only).
Configure the server by copying the lldap_config.docker_template.toml to
/data/lldap_config.toml and updating the configuration values (especially the
jwt_secret and ldap_user_pass, unless you override them with env variables).
Environment variables should be prefixed with LLDAP_ to override the
configuration.
If the lldap_config.toml doesn't exist when starting up, LLDAP will use
default one. The default admin password is password, you can change the
password later using the web interface.
Secrets can also be set through a file. The filename should be specified by the
variables LLDAP_JWT_SECRET_FILE or LLDAP_KEY_SEED_FILE, and the file
contents are loaded into the respective configuration parameters. Note that
_FILE variables take precedence.
Example for docker compose:
:latest tag image or :stable as used in this example.:latest tag image contains recently pushed code or feature tests, in which some instability can be expected.UID and GID no defined LLDAP will use default UID and GID number 1000.TZ is set, default UTC timezone will be used../generate_secrets.shversion: "3"
volumes:
lldap_data:
driver: local
services:
lldap:
image: lldap/lldap:stable
ports:
# For LDAP, not recommended to expose, see Usage section.
#- "3890:3890"
# For LDAPS (LDAP Over SSL), enable port if LLDAP_LDAPS_OPTIONS__ENABLED set true, look env below
#- "6360:6360"
# For the web front-end
- "17170:17170"
volumes:
- "lldap_data:/data"
# Alternatively, you can mount a local folder
# - "./lldap_data:/data"
environment:
- UID=####
- GID=####
- TZ=####/####
- LLDAP_JWT_SECRET=REPLACE_WITH_RANDOM
- LLDAP_KEY_SEED=REPLACE_WITH_RANDOM
- LLDAP_LDAP_BASE_DN=dc=example,dc=com
- LLDAP_LDAP_USER_PASS=CHANGE_ME # If the password contains '$', escape it (e.g. Pas$$word sets Pas$word)
# If using LDAPS, set enabled true and configure cert and key path
# - LLDAP_LDAPS_OPTIONS__ENABLED=true
# - LLDAP_LDAPS_OPTIONS__CERT_FILE=/path/to/certfile.crt
# - LLDAP_LDAPS_OPTIONS__KEY_FILE=/path/to/keyfile.key
# You can also set a different database:
# - LLDAP_DATABASE_URL=mysql://mysql-user:password@mysql-server/my-database
# - LLDAP_DATABASE_URL=postgres://postgres-user:password@postgres-server/my-database
# If using SMTP, set the following variables
# - LLDAP_SMTP_OPTIONS__ENABLE_PASSWORD_RESET=true
# - LLDAP_SMTP_OPTIONS__SERVER=smtp.example.com
# - LLDAP_SMTP_OPTIONS__PORT=465 # Check your smtp provider's documentation for this setting
# - LLDAP_SMTP_OPTIONS__SMTP_ENCRYPTION=TLS # How the connection is encrypted, either "NONE" (no encryption, port 25), "TLS" (sometimes called SSL, port 465) or "STARTTLS" (sometimes called TLS, port 587).
# - LLDAP_SMTP_OPTIONS__USER=no-reply@example.com # The SMTP user, usually your email address
# - LLDAP_SMTP_OPTIONS__PASSWORD=PasswordGoesHere # The SMTP password
# - LLDAP_SMTP_OPTIONS__FROM=no-reply <no-reply@example.com> # The header field, optional: how the sender appears in the email. The first is a free-form name, followed by an email between <>.
# - LLDAP_SMTP_OPTIONS__TO=admin <admin@example.com> # Same for reply-to, optional.
# - LLDAP_HTTP_URL=https://lldap.example.com # URL used in the email template to compose the reset link, also used to tell LLDAP where it lives in the domain/URL to allow for sub-paths
Then the service will listen on two ports, one for LDAP and one for the web front-end.
LLDAP works well with rootless Podman either through command line deployment or using quadlets. The example quadlets include configuration with postgresql and file based secrets, but have comments for several other deployment strategies.
See https://github.com/Evantage-WS/lldap-kubernetes for a LLDAP deployment for Kubernetes
You can bootstrap your lldap instance (users, groups) using bootstrap.sh. It can be run by Argo CD for managing users in git-opt way, or as a one-shot job.
LLDAP can be installed on TrueNAS SCALE using the built-in Apps catalog, allowing users to deploy and manage LLDAP directly from the TrueNAS web interface without manually maintaining containers.
To install:
TrueNAS supports selecting certificates for LDAPS and configuring a public web URL. When LDAPS is enabled, it is recommended to disable the unencrypted LDAP port to ensure secure communication.
A full, step-by-step TrueNAS-specific guide (including recommended ports, certificate configuration, and common integrations) is available here:
👉 example_configs/truenas-install.md
Do not open issues in this repository for problems with third-party pre-built packages. Report issues downstream.
Depending on the distribution you use, it might be possible to install LLDAP from a package repository, officially supported by the distribution or community contributed.
Each package offers a systemd service lldap.service or rc.d_lldap rc.d/lldap to (auto-)start and stop lldap.<br>
When using the distributed packages, the default login is admin/password. You can change that from the web UI after starting the service.
To compile the project, you'll need:
sudo apt install curl gzipThen you can compile the server (and the migration tool if you want):
cargo build --release -p lldap -p lldap_migration_tool
The resulting binaries will be in ./target/release/. Alternatively, you can
just run cargo run -- run to run the server.
To bring up the server, you'll need to compile the frontend. In addition to
cargo, you'll need WASM-pack, which can be installed by running cargo install wasm-pack.
Then you can build the frontend files with
./app/build.sh
(you'll need to run this after every front-end change to update the WASM package served).
The default config is in src/infra/configuration.rs, but you can override it
by creating an lldap_config.toml, setting environment variables or passing
arguments to cargo run. Have a look at the docker template:
lldap_config.docker_template.toml.
You can also install it as a systemd service, see lldap.service.
Docker images are provided for AMD64, ARM64 and ARM/V7.
If you want to cross-compile yourself, you can do so by installing
cross:
cargo install cross
cross build --target=armv7-unknown-linux-musleabihf -p lldap --release
./app/build.sh
(Replace armv7-unknown-linux-musleabihf with the correct Rust target for your
device.)
You can then get the compiled server binary in
target/armv7-unknown-linux-musleabihf/release/lldap and the various needed files
(index.html, main.js, pkg folder) in the app folder. Copy them to the
Raspberry Pi (or other target), with the folder structure maintained (app
files in an app folder next to the binary).
Then run bash setup.sh. It stops at the first error and is safe to run again. Servers and tests aren't started; it lists them at the end. Read it first.
Needs Git: xcode-select --install
git clone https://github.com/lldap/lldap.git cd lldap
Rust 1.91.0
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh rustup show # installs the pinned toolchain
cargo build
cargo test
The simplest way to use LLDAP is through the web front-end. There you can create users, set passwords, add them to groups and so on. Users can also connect to the web UI and change their information, or request a password reset link (if you configured the SMTP client).
You can create and manage custom attributes through the Web UI, or through the community-contributed CLI frontend ( Zepmann/lldap-cli). This is necessary for some service integrations.
The bootstrap.sh script can enforce a list of users/groups/attributes from a given file, reflecting it on the server.
To manage the user, group and membership lifecycle in an infrastructure-as-code scenario you can use the unofficial LLDAP terraform provider in the terraform registry.
LLDAP is also very scriptable, through its GraphQL API. See the Scripting docs for more info.
If you are using containers, a sample architecture could look like this:
*-rootless version of the images to be able to
start directly as that user, once you got the permissions right. Just don't
forget to change from the UID/GID env vars to the uid docker-compose
field.No reports for macOS yet.
GitManual AI Agent reads the 9 key files and writes a step-by-step guide for macOS. Once written, it's saved for everyone.