Self-host LLDAP

A lightweight LDAP server for user and group management with a web UI, built to be the user directory behind Authelia, Keycloak, Nextcloud and other apps that authenticate over LDAP. It implements an opinionated subset of LDAP rather than a full directory server.

Key facts

What you need

• Any VPS with at least 128 MB of RAM
• A domain you control — most self-hosted setups need HTTPS in front of them
• Under an hour if you've used Docker before

Install

Run these commands on your server:

copy# LLDAP — web UI on :17170; LDAP (:3890) stays internal unless you publish it
LLDAP_PASS=$(openssl rand -hex 12) && echo "admin password: $LLDAP_PASS"
docker run -d --name lldap --restart unless-stopped -p 17170:17170 -v lldap_data:/data \
  -e LLDAP_JWT_SECRET=$(openssl rand -hex 32) -e LLDAP_KEY_SEED=$(openssl rand -hex 32) \
  -e LLDAP_LDAP_BASE_DN=dc=example,dc=com -e LLDAP_LDAP_USER_PASS=$LLDAP_PASS \
  lldap/lldap:stable
# →  http://SERVER_IP:17170  (user: admin)

More in SSO & Identity

SSO & Identity

Authelia

A lightweight, open-source authentication and authorization server providing 2FA and SSO via a forward-auth portal in front of your reverse proxy — a self-hosted gatekeeper for existing apps, not a full identity provider.

Go

moderateRead guide →

SSO & Identity

authentik

An open-source identity provider supporting SAML, OAuth2/OIDC, and LDAP — a flexible, self-hostable alternative to Auth0, Okta, and Azure AD with a visual flow-based login builder.

PythonGoTypeScript

moderateRead guide →

Ca

SSO & Identity

Casdoor

An identity and access management server with a web admin console that exposes one user directory over OAuth 2.0, OIDC, SAML, CAS, LDAP and SCIM, with Casbin-based authorization policies. It runs as a single Go binary backed by MySQL, PostgreSQL or SQLite.

GoReact

easyRead guide →

SSO & Identity

Keycloak

A mature, enterprise-grade open-source identity and access management server — SSO, SAML, and OpenID Connect with user federation, built on Quarkus and backed by Red Hat.

JavaQuarkus

hardRead guide →