selfhoster1312/llldap
Watch
1
0
Fork
You've already forked llldap
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
llldap/README.md

2.4 KiB
Raw Blame History

llldap

Important

You may be looking for lldap instead, a more mature solution with a different feature set.

Is your Lightweight Directory Access Protocol server too heavy and too cumbersome? If your lldap not light enough or are you looking for a solution which supports virtualhosts and multiple-value attributes such as mail aliases? llldap might be just for you!*

Warning

This is not production-ready yet.

Comparison to lldap

Compared to lldap, llldap:

  • does not use an SQLite database, but simple text files
  • does not use GraphQL to build an API, and therefore does not require custom logic in the client (JS/WASM)
  • supports virtualhosts out-of-the-box
  • supports mailalias with multiple values in search queries
  • support listening on unix domain sockets (UDS) out-of-the-box

Design

Important

Most of these design decisions have not been implemented yet.

  • different users can have the same username across different domains, so foo@bar.com is not the same user as foo@baz.com
  • service accounts are separated from normal user accounts, and do not have an associated domain; they allow 3rd-party programs to connect via LDAP with special sets of permissions
  • service groups are separated from normal user groups, and do not have an associated domain; they are meant to store permissions (eg. admins, or mail)
  • aliases are supported, but remain associated with a user account forever (more details)
  • TODO: should users be able to create custom groups/aliases? that sounds useful, but may need monitoring to prevent accidental/malicious abuse (such as registering comptabilité@ or legalteam@)

Potential future features

We may explore in the future:

  • i18n domains (punycode)
  • i18n user identifiers (TODO: check compatibility with other tools)
  • RTL languages
  • hierarchical groups
  • fine-grained permissions (RBAC)
  • running with different async runtimes
  • implying base DN from HTTP HOST header (to have auth.a.localhost and auth.b.localhost where users can login without adding the domain part)
  • making the core logic reusable as a library for custom LDAP behavior
  • per-user/domain data retention policies to keep logs of login attempts
  • per-domain admins

License

GNU AGPL v3