Is there an simple webapp that enables LDAP users to manage their own accounts?

Question

I have an OpenLDAP server¹ keeping track of user accounts for a small but growing collection of users. I'm about tired of resetting people's passwords by hand myself and would like to open up some services to user signups. To do this, I need to stop hand managing the user database and allow users to edit their own accounts.

The most important bit is allowing users to reset their own passwords using an email address based reset code. To make this feasible, in addition to the posixAccount schema I already use I would like to require a verified email address at all times.

I am looking for a single purpose web app that is relatively easy to setup on a *nix server that will:

• authenticate against the LDAP directory,
• allow users to change their name, email address and other contact details but only see their own account,
• allow users to reset their password with a decent set of password strength requirements (this can be enforced by the LDAP server but the user needs to be shown the rules),
• handle the process of verifying email addresses on change

Additionally, it would be nice if it would:

• handle additional LDAP value fields such as SSH public keys,
• could optionally require two-factor authentication or some secondary approval so that password resets were not 100% dependent on the security of a users email account.

Anything beyond this I can handle myself including adding group information to users to authenticate them on various services. Is there anything out there that fits the bill?

¹ _{The LDAP database is used as an authentication backend by a collection of different services. The only authentication scheme all these services support in common is LDAP, so I can't really substitute anything else.}

Answer 1

Here are three open source web applications, and while none of them fully meet your needs you can combine two or more to do what you need.

I am using LdapCherry to allow users to edit their LDAP account information and change their passwords. It is a Python application which utilizes the cherrypy web framework, and IMHO, fairly easy to implement. It does not support e-mail verification or e-mail based password reset tokens. I am using it in combination with the LDAP Toolbox Project's Self Service Password system to allow my users to reset forgotten / expired passwords. It is a PHP based application that is somewhat more difficult to deploy and configure. According to their Github page it can also allow users to set LDAP attributes for SSH keys, but I have not tried that.

I have implemented PWM (can't post link. Search github) for a corporate environment in the past. It supports password reset via e-mail token and account creation. It is a JAVA web application and requires a Java servlet container, such as Apache Tomcat. It in combination with LdapCherry may provide you with all the features you require.

Good Luck!

Answer 2

You could try using the LDAP Tool Box Self Service PHP Application. But this is mainly designed to let users do a self service password reset.

I have a feeling that LDAP Account Manager is probably closer to what you are looking for. It works with Nginx and Apache web servers, and comes in both a Free and Pro version. You will probably need the Pro version for the self service portion of the the system.