Read-only LDAP gateway

Read-only LDAP projection of the SQL directory.

Read-only LDAP gateway

lindir can project SQL users and groups as a read-only LDAP directory for apps that only speak LDAP (Grafana LDAP auth, some NAS/NAS-like tools, legacy clients). SQL remains the system of record; NSS on hosts still uses the Linux client / extrausers path.

Enable

"ldap": {
  "enabled": true,
  "listenHost": "127.0.0.1",
  "listenPort": 1389,
  "baseDn": "dc=lindir,dc=local",
  "allowAnonymous": false
}

Default port 1389 (non-root). Set enabled: true to start a background LDAP listener beside the HTTP API. In production, set allowAnonymous: false (OWASP Controls A02).

Tree

dc=lindir,dc=local
├── ou=people
│   └── uid=<username>   (posixAccount + inetOrgPerson)
└── ou=groups
    └── cn=<groupname>   (posixGroup, memberUid)
Entry Attributes
User uid, cn, sn, displayName, mail, uidNumber, gidNumber, homeDirectory, loginShell, gecos
Group cn, gidNumber, memberUid, description

Bind

Mode Behaviour
Anonymous Empty DN + empty password — allowed if allowAnonymous
Simple uid=<user>,ou=people,<baseDn> + lindir password (AuthService.loginUser)

SASL / StartTLS: not implemented (returns unwilling / auth method not supported).

Supports base / one-level / subtree scopes and filters with & | !, equality, present (attr=*), and simple substrings. Writes (add / modify / delete) are rejected.

Examples:

ldapsearch -H ldap://127.0.0.1:1389 -x -b 'dc=lindir,dc=local' '(uid=alice)'
ldapsearch -H ldap://127.0.0.1:1389 -x -D 'uid=alice,ou=people,dc=lindir,dc=local' -w '…' \
  -b 'ou=groups,dc=lindir,dc=local' '(objectClass=posixGroup)'

Limits

  • Bind the LDAP port to localhost, or place stunnel / a network policy in front when you need an encrypted path.
  • For production, use PostgreSQL or MySQL rather than memory://.
  • This gateway is a projection, not a full OpenLDAP replacement (no schema publishing, paged results, or referrals).