5

I have an OpenLDAP server¹ keeping track of user accounts for a small but growing collection of users. I'm about tired of resetting people's passwords by hand myself and would like to open up some services to user signups. To do this, I need to stop hand managing the user database and allow users to edit their own accounts.

The most important bit is allowing users to reset their own passwords using an email address based reset code. To make this feasible, in addition to the posixAccount schema I already use I would like to require a verified email address at all times.

I am looking for a single purpose web app that is relatively easy to setup on a *nix server that will:

  • authenticate against the LDAP directory,
  • allow users to change their name, email address and other contact details but only see their own account,
  • allow users to reset their password with a decent set of password strength requirements (this can be enforced by the LDAP server but the user needs to be shown the rules),
  • handle the process of verifying email addresses on change

Additionally, it would be nice if it would:

  • handle additional LDAP value fields such as SSH public keys,
  • could optionally require two-factor authentication or some secondary approval so that password resets were not 100% dependent on the security of a users email account.

Anything beyond this I can handle myself including adding group information to users to authenticate them on various services. Is there anything out there that fits the bill?

¹ The LDAP database is used as an authentication backend by a collection of different services. The only authentication scheme all these services support in common is LDAP, so I can't really substitute anything else.

2
  • Not tried it myself, but maybe phpLDAPAdmin could fit? See here for an installation tutorial.
    – Izzy
    Jan 4, 2016 at 22:12
  • @Izzy Not even close. I have that running already and use it to admin the database, but its unwieldy even for that and doesn't meet hardly any of the requirements above. It can't handle signups or field validation or password resets.
    – Caleb
    Jan 5, 2016 at 6:08

2 Answers 2

1

Here are three open source web applications, and while none of them fully meet your needs you can combine two or more to do what you need.

I am using LdapCherry to allow users to edit their LDAP account information and change their passwords. It is a Python application which utilizes the cherrypy web framework, and IMHO, fairly easy to implement. It does not support e-mail verification or e-mail based password reset tokens. I am using it in combination with the LDAP Toolbox Project's Self Service Password system to allow my users to reset forgotten / expired passwords. It is a PHP based application that is somewhat more difficult to deploy and configure. According to their Github page it can also allow users to set LDAP attributes for SSH keys, but I have not tried that.

I have implemented PWM (can't post link. Search github) for a corporate environment in the past. It supports password reset via e-mail token and account creation. It is a JAVA web application and requires a Java servlet container, such as Apache Tomcat. It in combination with LdapCherry may provide you with all the features you require.

Good Luck!

1
  • Note that nowadays LdapCherry seems to be unmaintained and Python 2 only. (Correct me if I'm wrong, but that's how it seems at the moment.) That means that you most likely don't want to use it, considering Python 2 is end of life for some time now.
    – dreua
    Dec 19, 2022 at 18:57
0
+100

You could try using the LDAP Tool Box Self Service PHP Application. But this is mainly designed to let users do a self service password reset.

I have a feeling that LDAP Account Manager is probably closer to what you are looking for. It works with Nginx and Apache web servers, and comes in both a Free and Pro version. You will probably need the Pro version for the self service portion of the the system.

enter image description here enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.