ldap-rp

Proxy LDAP requests to different LDAP servers based on base DN. Based on code from kanidm/ldap-proxy under the MPL license.

Features

• No TLS setup ; use only in trusted networks
• LDAP bind requests
• LDAP search requests
• Configurable listening port
• Default fallback to /etc/ldap-rp/config.toml
• Unix Domain Socket support (incoming requests)
• Unix Domain Socket garbage collection (incoming requests)
• Unix Domain Socket support (outgoing requests)
• not planned: TLS termination (incoming requests)
• not planned: TLS backend connections (outgoing requests)
• not planned: TLS SNI passthrough

Running

Create a configuration file config.toml with the following:

# Where to listen to incoming connections ([::1]:389 by default, requires privileges)
#  - ip/port: `127.0.0.1:3389` (ipv4 only on localhost) `[::1]:3389` (ipv4/ipv6 on localhost),
#             `0.0.0.0:3389` (ipv4 only on all interfaces, `[::]:3389` (ipv4/ipv6 on any interface)
#  - socket: `./ldap.sock` for a socket in the current working directory
#            `/var/run/ldap.sock` for a socket with an absolute path
listen = "[::]:3389"
[[mapping]]
from = "a.localhost"
to = "example.com"
backend = "127.0.0.1:4389"
[[mapping]]
from = "b.localhost"
to = "example.com"
backend = "127.0.0.1:5389"

By default, ldap-rp will look for a config file in /etc/ldap-rp/config.toml but you can change that with the --config CLI flag.

You can now run:

ldap-rp --config config.toml

Testing your setup

Once you have a LDAP server running, you can test your settings with the ldapwhoami command from the openldap package:

# Test when listening on port 3389
ldapwhoami -H ldap://localhost:3389 -D "cn=b,ou=people,dc=a,dc=localhost" -W
# Test when listening on socket /run/ldap-rp/ldap-rp.sock, where `/` is escaped
# with `%2F` and the protocol is changed to `ldapi`
ldapwhoami -H ldapi://%2Frun%2Fldap-rp%2Fldap-rp.sock -D "cn=b,ou=people,dc=a,dc=localhost" -W