I have an OpenLDAP server¹ keeping track of user accounts for a small but growing collection of users. I'm about tired of resetting people's passwords by hand myself and would like to open up some services to user signups. To do this, I need to stop hand managing the user database and allow users to edit their own accounts.
The most important bit is allowing users to reset their own passwords using an email address based reset code. To make this feasible, in addition to the posixAccount schema I already use I would like to require a verified email address at all times.
I am looking for a single purpose web app that is relatively easy to setup on a *nix server that will:
- authenticate against the LDAP directory,
- allow users to change their name, email address and other contact details but only see their own account,
- allow users to reset their password with a decent set of password strength requirements (this can be enforced by the LDAP server but the user needs to be shown the rules),
- handle the process of verifying email addresses on change
Additionally, it would be nice if it would:
- handle additional LDAP value fields such as SSH public keys,
- could optionally require two-factor authentication or some secondary approval so that password resets were not 100% dependent on the security of a users email account.
Anything beyond this I can handle myself including adding group information to users to authenticate them on various services. Is there anything out there that fits the bill?
¹ The LDAP database is used as an authentication backend by a collection of different services. The only authentication scheme all these services support in common is LDAP, so I can't really substitute anything else.