Which LDAP is recommended to deploy?
reddit / selfhosted

----------------------------------------------------------------------
mailliwal · 2023-11-18 16:18

Hi,

I would like to deploy LDAP on PVE container.

Tried below but failure to make LDAP connection.

* OpenLDAP (over Alpine container)
* LLDAP (docker)

Mainly for Wi-Fi - Fortigate / radius / Duo 2FA authentication use.

​

May I know any good setup guide or better replacement ?


Thanks

----------------------------------------------------------------------
lllllllillllllillll · 2023-11-18 18:26

LLDAP is definitely the quickest and easiest to setup, but you'll have
to provide more info if you want to get help.

Here's a compose file that should work:

    version: '3'
    services:
      lldap:
        image: nitnelave/lldap:stable
        ports:
          # For LDAP
          - "3890:3890"
          # For the web front-end
          - "17170:17170"
        volumes:
          - "lldap:/data"
          # or bind mount instead:
          # - "./lldap_data:/data"
        environment:
          - UID=1000
          - GID=1000
      - LLDAP_JWT_SECRET=replace_me
      - LLDAP_LDAP_USER_PASS=replace_me
      - LLDAP_LDAP_BASE_DN=dc=replace_with_domain,dc=com

----------------------------------------------------------------------
bsmk_ · 2023-11-18 18:42

Today I would setup Authentik and use their LDAP outpost, but mostly
of my use is SAML so that makes sense for me.

----------------------------------------------------------------------
mailliwal · 2023-11-18 18:57

I could setup, but fortigate firewall / synology failure to connect &
look-up ldap

----------------------------------------------------------------------
jasieqb · 2023-11-18 19:13

If you have 2gb for a separate VM then go with freeipa

----------------------------------------------------------------------
adamshand · 2023-11-19 01:27

I managed OpenLDAP servers professionally for years.  You don't want
to use OpenLDAP unless it's something you want to learn about.

LLDAP (or GLAuth) does everything you need in a homelab context for a
fraction of the effort, complexity, and hassle.

----------------------------------------------------------------------
mailliwal · 2023-11-19 02:40

>nitnelave/lldap:stable

An error code "ldap\_64" while connection. This should be server has
been found but not authenticated ?

----------------------------------------------------------------------
mailliwal · 2023-11-19 02:42

I have tried to install on Alpine, but doesn't know how to configure
(create user / domain, etc.)

----------------------------------------------------------------------
mailliwal · 2023-11-19 04:24

Currently could be connected to LLDAP.

User:     cn=admin,ou=people,dc=test,dc=home

​

But failure to look-up and test credential.

CN:   cn=lldap\_strict\_readonly,ou=groups,dc=test,dc=home

​

Anything wrong ?

----------------------------------------------------------------------
lllllllillllllillll · 2023-11-19 05:01

In a compose file a '#' turns that line into a comment, so that it's
ignored when you run it. You don't need to worry about any config
files if you haven't used lldap before.
I'd recommend downloading a code editor, like VS code or Notepad++, to
make editing a lot easier and clearer.
If you use the example I posted, port 17170 is the web-ui for managing
lldap in your browser.

----------------------------------------------------------------------
ZaxLofful · 2023-11-19 05:30

I use Authentik or keycloak for this stuff, that way I’m not actually
running LDAP; just a connector!

----------------------------------------------------------------------
nibbl0r · 2023-11-19 08:17

I wish I read this post 2 years ago, before I set up my OpenLDAP m(

----------------------------------------------------------------------
adamshand · 2023-11-19 19:13

You have climbed mountains and gained skills.  Congratulations my
friend, now bask in the soothing waters.

----------------------------------------------------------------------
rrrmmmrrrmmm · 2023-11-21 13:10

If you really _only_ want LDAP, take
[LLDAP](https://github.com/lldap/lldap).
But most people might want more and in that case [KanIDM](https://kani
dm.github.io/kanidm/stable/prepare_the_server.html) (LDAP, OAuth2,
RADIUS and more) might be what you're looking for.

Both projects are written in Rust and very lightweight.

----------------------------------------------------------------------
nitnelave · 2023-12-09 09:13

Note that LLDAP doesn't support Synology, due to them requiring local
password hashes. LLDAP's "hashes" are stronger than what they support
(it's a zero knowledge proof), so it doesn't work with Synology.

----------------------------------------------------------------------
EquivalentAd4 · 2023-12-09 09:47

Have you tried Casdoor? It supports LDAP (as server), Radius and 2FA
(via SMS, Email or Authenticator Apps), and a modern web management UI
to do CURDs on users and other resources. Seems to be a good match for
your requirements

----------------------------------------------------------------------
mailliwal · 2023-12-09 10:01

Well noted.

----------------------------------------------------------------------
mailliwal · 2023-12-09 10:01

Better then DUO ?

----------------------------------------------------------------------
nitnelave · 2023-12-09 21:56

They actually both use the same LDAP parsing library, written by the
Kanidm author, FirstYear. Kudos to him, LLDAP probably wouldn't exist
without him!