10

I'm looking for a good LDAP editor. This is a priorized list of requirements:

  1. Not tightly integrated to any specific LDAP server (for example, Fedora Directory have a built-in editor, which is not useful with other LDAP directories)
  2. Easy to use - preferably GUI, as command line programs tend to require quite a bit of memorized commands and keys.
  3. Obviously, adding/modifying/deleting objects and attributes. Schema changes are out-of-scope, but of course, some support is a plus.
  4. Human readable attribute names - standard fields are not too self-explanatory (sn, cn, o, l etc.)
  5. Search for
    • Objects in the tree - for example, users under specific organization
    • Attributes and attribute values - when there's tens or hundreds of attributes for object, manually finding the right attribute is a bit cumbersome.
  6. Preferably batch editing: select multiple objects and edit specific attributes. For example, setting password expiration dates for multiple users.
  7. Linking in UI: going from group page to group member page should be easy.
  8. Reverse relations: for example, (command to) show all groups user is member of.
  9. Connection profiles, supporting more than one server. It's annoying to enter server details when changing the server.

Paid software is ok, as long as price is reasonable (no more than 200€), and pricing does not depend on the size or number of accessed LDAP directories. Linux/OS X/Windows/self-hosted webapp are fine. For dedicated applications, cross-platform is obviously a plus.

2
  • 1
    I never found a LDAP tool that could connect to all LDAP installations. I use different tools and use the one that works in the specific case.
    – juergen d
    Feb 13 '14 at 19:44
  • @juergend weird LDAP installations you have encountered. But yeah, probably no tool that works with every possible LDAP server exists. Similarly, no LDAP library works with every server, but all common ones seem to have pretty damn good compatibility.
    – Olli
    Feb 13 '14 at 20:01
3

I did use each of these three LDAP browser in different projects:

There are all free but the one which give the most features is Apache Directory Studio. After saying that, I am not an LDAP expert to say it does all the things you asked; for me it was way too much complicated and slow compared to the first one (LDAP Admin).

The pros and cons for that list are:

  • LDAP Admin
    • pros: fast and lightweight
    • cons: limited for edition and probably not a tool for ldap administrators; run only on Windows
  • jXplorer
    • pros: multiplatform (java based); simple
    • cons: a bit slow;
  • Apache Directory Studio
    • pros: a lot of functionalities; eclipse based (GUI; many options)
    • cons: eclipse based (slow startup); complicated for simple task.

As your feature list is long, I think the best fit would be Apache Director Studio.

The following list names all features you ask for:

  1. It supports all LDAP servers as long they use the LDAP protocol.
  2. OK, but a bit slow to startup (like all eclipse based programs)
  3. OK, contains a value editor for each specific types (images, text, etc...)
  4. I am note sure, but I think it support different views like one with aliases (in preferences).
  5. a) LDAP Browser supports many filtering options like searching in a specific ou.
    b) Not sure what features you re looking for; the LDAP Browser have several preferences to search for specific
  6. LDAP Browser have some wizards like Batch operation wizard
  7. Not sure, but you can see the tree, then passing from one group to any member should not be an issue.
  8. Not sure, but searching / filtering have a lot of advanced features; I think it sould be possible by using advanced filtering
  9. You can create several Connection and Project for managing your different server or projects

UPDATE:

I recently switched permanently to Apache Directory Studio for all my LDAP tasks (read-only) and the nice feature others does not have is the Saved Searches: I can for example look all users starting by a specific pattern and who have their account locked. With 8Gb available RAM (my machine have 16Gb but a VM takes 8Gb) the speed of the GUI is good.

0
2

I'm the author of web2ldap. So my recommendation is biased of course.

But it's fun for me to point out its features by walking through your requirements:

  1. Not tightly integrated to any specific LDAP server (for example, Fedora Directory have a built-in editor, which is not useful with other LDAP directories)

See the LDAP servers mentioned on the compability list.

One of my personal use-cases is digging into unknown LDAP servers of my customers.

  1. Easy to use - preferably GUI, as command line programs tend to require quite a bit of memorized commands and keys.

"Easy to use" is a rather blurry term and really depends on whether people are willing to learn. web2ldap is a pure HTML application. Whether it matches your personal preferences is up to you.

  1. Obviously, adding/modifying/deleting objects and attributes.

Yes.

Note that web2ldap has the most complete schema support of all LDAP clients out there to guide the user to do the right thing.

It also contains some measures to explicitly provoke conflicts when two people are modifying the same entry. Not sure whether other LDAP clients do something like this.

Schema changes are out-of-scope, but of course, some support is a plus.

There's no schema editor in web2ldap. And frankly I've never seen a good one and could not come up with a sufficiently good design one myself. Schema changes are rare anyway and personally I'm write schema like code.

But there's a very powerful schema viewer showing cross-references back and forth the schema descriptions including object class and attribute type inheritance. Much more powerful than everything else I've seen so far.

  1. Human readable attribute names - standard fields are not too self-explanatory (sn, cn, o, l etc.)

This is not solved at attribute level because there's no good solution at that level: Too many differences to cover.

Mainly you can use really simple HTML templates for designing parts of the user interface. You can customize those, e.g. using your own terms, adding documentation links to your internal Wiki, etc.

  1. Search for Objects in the tree - for example, users under specific organization

Of course all kinds of search operations are available. You can add your own HTML templates for different search forms.

Attributes and attribute values - when there's tens or hundreds of attributes for object, manually finding the right attribute is a bit cumbersome.

You can limit the attributes displayed but that's rather cumbersome. I'd say simply use the web browser's search functionality to find the attribute in the page.

  1. Preferably batch editing: select multiple objects and edit specific attributes. For example, setting password expiration dates for multiple users.

web2ldap can do bulk modify on search results displayed before. Note that this is only useful for experienced users and of course you can shoot yourself in the foot very easily.

  1. Linking in UI: going from group page to group member page should be easy.

I'm a lazy guy. I'm too lazy to manually construct searches all the time while exploring entries.

Therefore I've implemented all kind of cross-linking between known attributes and entries, e.g. searching a member entry by memberUid value. Or finding relationship between DNS and DHCP entries. Etc.

Let me know if something is missing.

  1. Reverse relations: for example, (command to) show all groups user is member of.

See above.

Especially for groups there's a separate group administration UI.

  1. Connection profiles, supporting more than one server. It's annoying to enter server details when changing the server.

web2ldap displays persistent bookmarks:

  1. in the status bar
  2. when displaying search results

Check out the docs about persistent bookmarks. Those you can put in your Wiki so everybody just can click on them.

There's much more to say about features and configuration. Please consult the docs. Don't hesitate to ask if you need help.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.