LDAP (Lightweight Directory Access Protocol) is a protocol used to query and update directories—hierarchical databases optimized for frequent lookups with infrequent changes. Directories store information such as user accounts, groups, computers, and contact details. When an application needs to check if a user exists, retrieve their email address, determine which groups they belong to, or verify passwords, it typically uses LDAP.
What is LDAP?
LDAP operates on port 389 for unencrypted connections and port 636 for secure (TLS) connections. It's often compared to a phone book because it allows you to look up information quickly and efficiently. For example, if an application needs to verify whether a user named Garrett exists or retrieve his email address, LDAP can provide this information.
Real-World Examples
One of the most well-known implementations of LDAP is Microsoft Active Directory, which is used in many corporate environments for domain-based authentication. Behind the scenes, every "log into the domain" action involves LDAP and Kerberos for security. In open-source options, you have OpenLDAP (a more complex setup), 389 Directory Server, or LLDAP (a modern, user-friendly option) and Authentik/Keycloak, which bundle a directory with Single Sign-On (SSO) capabilities.
The Data Model
In LDAP, data is organized in a tree structure. For example, an entry might be located at dc=example,dc=lan → ou=people → uid=garrett. Each entry has attributes such as uid, mail, and memberOf. The full path to an entry is known as its distinguished name (DN).
A "bind" in LDAP refers to authenticating to the directory. When an application needs to verify a password, it attempts to bind to the directory using the user's credentials.
Why Run an LDAP Server in a Homelab?
For small setups with one or two users, running an LDAP server might be overkill. However, as your homelab grows and you start managing multiple services (such as Jellyfin, Grafana, Nextcloud, Proxmox, and Wi-Fi), having a centralized user database can simplify management.
LDAP serves as the foundation of the identity stack. It stores information about who exists in the network, while RADIUS can use it for network logins, and SSO/OIDC can leverage it for web logins. For a homelab, starting with LLDAP (a modern, user-friendly option) is recommended to avoid dealing with more complex configurations.
Scope Guidance
If you're managing just one or two users, LDAP might be too much overhead. However, as the number of services and users increases—especially when it reaches around five or more—you start seeing significant benefits from a centralized identity management system. If your primary goal is to learn about enterprise identity management for work purposes, running an LDAP server can be very educational.
For beginners, starting with LLDAP or Authentik/Keycloak is recommended due to their simpler setup and user-friendly interfaces. When using LDAP over the internet (beyond localhost), it's crucial to use port 636 for secure connections.
By understanding and implementing LDAP in your homelab, you can streamline user management across multiple services and applications.