# ldap-auth

ldap-auth is a reference model for authenticating users who request protected resources from servers proxied by NGINX, using a Lightweight Directory Access Protocol (LDAP) authentication server. It is open source and self-hosted, installable on Docker Hub, ZimaOS and Unraid.

Canonical page: https://ourlocalhost.com/app/559/ldap-auth

## Description

Ldap-auth is a reference model for authenticating users who request protected resources from servers proxied by NGINX, using a Lightweight Directory Access Protocol (LDAP) authentication server. It pairs a Python daemon that communicates with the directory server with a webserver daemon that issues an authentication cookie from the user's credentials, letting homelab users protect NGINX-fronted services with OpenLDAP or Microsoft Active Directory identities.

## Platform availability

Available on 2 of 9 platforms: Unraid, ZimaOS.

## Health score

27/100 (Low), based on 3 of 4 factors.
- Maintained: 0 (last commit 1329 days ago)
- Popular: 57 (708 GitHub stars)
- Easy to install: 45 (2 install platforms, install notes, Docker image)

## Links

- GitHub: https://github.com/nginxinc/nginx-ldap-auth
- Docker Hub: https://hub.docker.com/r/linuxserver/ldap-auth
- ZimaOS: https://github.com/bigbeartechworld/big-bear-casaos/tree/master/Apps/ldap-auth
- Unraid: https://ca.unraid.net/apps/ldap-auth-17rw77i0om18y2?q=ldap-auth

## Common questions

### Can I run nginx-ldap-auth in production?

No, the project is not designed or hardened for production. It is intended as a model for connector daemons.

### Do I have to use NGINX Plus?

No. The documentation says it applies to open source NGINX as well, and the required ngx_http_auth_request_module is included in prebuilt open source NGINX binaries.

### Can it authenticate against Active Directory?

Yes. By default it communicates with OpenLDAP, but it can be configured to work with Active Directory 2003 and 2012.

### How do I install the reference implementation?

Clone the repository, install NGINX Plus if it is not already running, and install and configure an LDAP authentication server. The provided configuration sets up the other components for testing on the same host.

### Can the LDAP server, backend, and NGINX all run on one host?

The provided configuration runs NGINX, the client, the ldap-auth daemon, and the back-end daemon on the same host for testing, and the LDAP server can also run there during testing. In an actual deployment, the back-end and authentication server usually run on separate hosts from NGINX.

---
Source: Our Local Host (https://ourlocalhost.com/app/559/ldap-auth), the self-hosted and open-source app directory.