vibhuvioio/openldap repository overview

⁠OpenLDAP Docker - Docs⁠

Production-ready OpenLDAP container with enterprise features.

📖 Documentation⁠ | 🐳 Docker Hub⁠

⁠Features

⁠Core Features

• Multi-master replication - High availability with 3+ node clusters
• TLS/SSL support - Secure LDAP connections
• Custom schema support - Hot-load your own object classes
• Database indices - Optimized for performance (cn, uid, mail, sn, givenname, member, memberOf)
• Query limits - DoS protection (500 soft / 1000 hard limit)
• Connection timeouts - Auto-close idle connections (600s)

⁠Security Features

• Non-root execution - Runs as ldap user (UID 55)
• Secure ACLs - Password protection, authenticated access required
• Health checks - Built-in Docker health monitoring
• Signal handling - Graceful shutdown on SIGTERM/SIGINT
• Vulnerability scanning - Trivy scans on every build

⁠Optional Overlays

• memberOf - Track group membership on user entries
• ppolicy - Password policies (min length, history, lockout)
• auditlog - Audit trail of all modifications

⁠Quick Start

⁠Single Container

# Run OpenLDAP with default settings
docker run -d \
  --name openldap \
  -e LDAP_DOMAIN=example.com \
  -e LDAP_ADMIN_PASSWORD=changeme \
  -p 389:389 \
  -v ldap-data:/var/lib/ldap \
  -v ldap-config:/etc/openldap/slapd.d \
  vibhuvioio/openldap:latest

# Test connection
ldapsearch -x -H ldap://localhost:389 \
  -D "cn=Manager,dc=example,dc=com" \
  -w changeme \
  -b "dc=example,dc=com"

⁠Multi-Node Cluster

Run a 3-node multi-master replication cluster:

Node 1:

docker run -d \
  --name openldap-node1 \
  --hostname openldap-node1 \
  -e LDAP_DOMAIN=example.com \
  -e LDAP_ADMIN_PASSWORD=changeme \
  -e ENABLE_REPLICATION=true \
  -e SERVER_ID=1 \
  -e REPLICATION_PEERS=openldap-node2,openldap-node3 \
  -p 389:389 \
  -v ldap-data-node1:/var/lib/ldap \
  -v ldap-config-node1:/etc/openldap/slapd.d \
  --network ldap-network \
  vibhuvioio/openldap:latest

Node 2:

docker run -d \
  --name openldap-node2 \
  --hostname openldap-node2 \
  -e LDAP_DOMAIN=example.com \
  -e LDAP_ADMIN_PASSWORD=changeme \
  -e ENABLE_REPLICATION=true \
  -e SERVER_ID=2 \
  -e REPLICATION_PEERS=openldap-node1,openldap-node3 \
  -p 390:389 \
  -v ldap-data-node2:/var/lib/ldap \
  -v ldap-config-node2:/etc/openldap/slapd.d \
  --network ldap-network \
  vibhuvioio/openldap:latest

Node 3:

docker run -d \
  --name openldap-node3 \
  --hostname openldap-node3 \
  -e LDAP_DOMAIN=example.com \
  -e LDAP_ADMIN_PASSWORD=changeme \
  -e ENABLE_REPLICATION=true \
  -e SERVER_ID=3 \
  -e REPLICATION_PEERS=openldap-node1,openldap-node2 \
  -p 391:389 \
  -v ldap-data-node3:/var/lib/ldap \
  -v ldap-config-node3:/etc/openldap/slapd.d \
  --network ldap-network \
  vibhuvioio/openldap:latest

⁠Configuration

⁠Environment Variables

See the Configuration Guide⁠ for the complete reference.

⁠Volumes

⁠Database Size Limit

The MDB (LMDB) backend is configured with a default maximum database size of 1 GB (olcDbMaxSize: 1073741824). This is the maximum size the database file can grow to.

Important: The MDB database size is fixed at creation time and cannot be changed without reconfiguring the database. Plan your size before loading production data.

⁠Docker Compose

services:
  openldap:
    image: vibhuvioio/openldap:latest
    environment:
      - LDAP_DOMAIN=example.com
      - LDAP_ADMIN_PASSWORD=changeme
      - ENABLE_MEMBEROF=true
    ports:
      - "389:389"
    volumes:
      - ldap-data:/var/lib/ldap
      - ldap-config:/etc/openldap/slapd.d
      - ./logs:/logs

volumes:
  ldap-data:
  ldap-config:

⁠Kubernetes

See the OpenLDAP Docker documentation⁠ for Kubernetes deployment guides, Helm charts, and production best practices.

⁠CI/CD and Testing

This repository includes GitHub Actions workflows for continuous integration and publishing:

⁠Integration Tests

The integration test suite validates:

1. Basic + ACL — LDAP connectivity and anonymous access restrictions
2. Overlay Features — memberOf, password policy, audit log functionality
3. TLS/SSL — StartTLS and LDAPS connectivity
4. Idempotency — Restart without errors, data persistence
5. Docker Secrets — Password loading from secret files

Run them locally from the use-cases/ directory.

⁠Overlays Guide

⁠Enable memberOf

environment:
  - ENABLE_MEMBEROF=true

Allows queries like: (memberOf=cn=admins,ou=Groups,dc=example,dc=com)

⁠Enable Audit Logging

environment:
  - ENABLE_AUDIT_LOG=true
volumes:
  - ./logs:/logs

View audit trail: docker exec openldap cat /logs/audit.log

⁠Enable Password Policy

environment:
  - ENABLE_PASSWORD_POLICY=true

Enforces: min 8 chars, 5 history, lockout after 5 failures

⁠Use Cases

Example deployments for different scenarios:

⁠Documentation

Full documentation is available at vibhuvioio.com/openldap-docker⁠:

⁠Known Limitations

⁠Replication Credentials in Cleartext

Multi-master replication uses simple bind authentication with the admin password stored in cleartext within the OpenLDAP configuration database (cn=config). Anyone with read access to cn=config can view these credentials.

Mitigation:

• Limit access to the config database through strict ACLs
• Use a dedicated replication user with minimal privileges
• Monitor access to the OpenLDAP container

⁠License

MIT License

⁠Security

This project uses automated security scanning:

Please report security vulnerabilities by opening a GitHub Issue⁠ or emailing [email protected]⁠.

Developed by Vibhuvi OiO⁠