LLDAP (Light LDAP) is a lightweight authentication server that provides a simplified, opinionated LDAP interface for self-hosted services. Written in Rust and licensed under the GPL-3.0, it gives you a user and group directory with a friendly web interface, without asking you to learn the subtleties of slapd or hand-write directory schemas. The current release is 0.6.3, published in April 2026.

Key Features

• Simplified LDAP interface — an opinionated subset of LDAP aimed at authentication, not general-purpose directory browsing. Users live under ou=people and groups under ou=groups with sensible defaults, and memberOf group filtering works out of the box.
• Web user management — create users and groups, set passwords and manage memberships from the browser; users can sign in to edit their own details or reset their password by email.
• Zero-knowledge password handling — passwords are handled with the OPAQUE protocol, so the server never stores a password hash. Passwords therefore cannot be exported as hashes to third-party services.
• Pluggable database backend — SQLite by default for a single-file, low-resource install, with MySQL/MariaDB and PostgreSQL supported for larger deployments.
• GraphQL API and scripting — the whole server is scriptable through its GraphQL API, with an official bootstrap.sh script for enforcing users, groups and attributes from a file, plus a community Terraform provider for infrastructure-as-code user management.
• Scoped administrative groups — lldap_admin grants full web-UI administration, while lldap_password_manager and lldap_strict_readonly let you grant services the least privilege they need; password managers cannot change admin passwords, preventing privilege escalation.
• Custom attributes — add your own attributes when a service needs a schema field LLDAP does not ship by default.
• Flexible deployment — official OCI images for Docker and Podman (including rootless variants), Kubernetes, TrueNAS SCALE and packages for Arch Linux, Debian, Ubuntu, CentOS, Fedora, openSUSE and FreeBSD, or build from source.
• Low resource footprint — a single lightweight binary and a small database file, happy on a Raspberry Pi or a small VPS.

Why Use LLDAP?

Many self-hosted applications — Nextcloud, Airsonic, Jellyfin, Paperless-ngx and countless others — support authentication over LDAP but nothing more modern. Standing up OpenLDAP for that job usually means learning slapd configuration, writing LDIF, and managing a directory service that is far more powerful than the task requires. LLDAP takes the opposite approach: it is deliberately not a full LDAP server, but a small user-management system that happens to speak LDAP. The result is a service you can install in minutes, manage through a web UI, and pair with an SSO front end such as Authelia, Keycloak or Authentik for OAuth/OpenID Connect support. The trade-offs are explicit: LDAP browsing tools are generally unsupported, services that demand raw password hashes (notably Synology) are incompatible by design, and Windows/Samba integration is still a work in progress.

Use Cases

• Providing a central user store for a homelab or small-company stack of self-hosted applications.
• Backing an SSO gateway such as Authelia, Authentik or Keycloak with a lightweight directory instead of OpenLDAP.
• Replacing a heavyweight directory service you never fully configured or maintained.
• Enforcing users, groups and memberships from a file or Terraform rather than by hand.
• Giving people self-service password reset without exposing password hashes to any other service.
• Running a directory on modest hardware — a single container and one SQLite file.

Platforms

Linux and FreeBSD (packages for Arch, Debian, Ubuntu, CentOS, Fedora, openSUSE) · Docker/Podman (x86-64, ARM64 and ARMv7 images) · Kubernetes · TrueNAS SCALE · build from source with Rust

Licence

GPL-3.0 (open source)

Website

github.com/lldap/lldap · Installation guide

Alternatives

• Authelia — open source SSO and 2FA portal that pairs with LLDAP as its user backend
• Keycloak — full identity and access management server with OIDC, OAuth 2.0 and SAML 2.0
• authentik — open source identity provider with a built-in LDAP outpost