LLDAP Hosting

How LLDAP works

LLDAP provides an opinionated directory for authentication. Administrators create users, set passwords, organise groups, and define custom attributes through the web interface. Compatible services connect over LDAP and use the directory as a source of users or group membership, while the GraphQL API can support scripted lifecycle tasks.

The catalogue starts LLDAP with the admin account, a generated password and JWT secret, the base DN dc=example,dc=com, and persistent storage under /data. Applications that connect to it need the correct bind DN, password, base DN, user and group locations, filters, and network path. The hosted web endpoint alone does not automatically join another service to the directory.

Key LLDAP features

LLDAP deliberately implements a simplified LDAP surface. Its upstream documentation recommends other components such as an OIDC provider or authentication proxy when applications need SSO, OAuth, or protection for services without native LDAP support. Some LDAP features, browsing tools, password-hash access, and particular integrations are unsupported or require custom attributes.

Users can request password-reset links only when an SMTP client is configured upstream. Application email is disabled across the hosted platform, so the deployment should not promise email-based reset or invitations. Administrators need another verified recovery process, should use restricted bind accounts for applications, and should avoid sharing the full directory administrator credential.

Who uses LLDAP

Home-lab operators can share accounts across several LDAP-capable services, small organisations can maintain a modest internal user directory, and administrators can pair LLDAP with a separate OIDC or proxy layer. Custom attributes can help applications that expect additional directory fields.

LLDAP is not a full Active Directory domain, general-purpose OpenLDAP replacement, endpoint-management suite, certificate authority, or complete SSO product. Before adoption, test every intended client, password flow, group filter, custom attribute, and recovery procedure against the exact application version in use.

Self-hosting LLDAP: requirements and cost

LLDAP resource use depends on directory size, group memberships, password operations, LDAP queries, web sessions, GraphQL calls, and connected services. PostgreSQL and MariaDB are Not required by this catalogue template because the configured deployment uses its local persistent data path. The software has no separate application charge, and integration correctness is usually more important than capacity for a small directory.

On AvaHost, LLDAP uses Plan 1 at €2. The hosted LLDAP package includes one-click deployment, a custom domain with automated HTTPS, automatic application updates, and scheduled backups. Change or deliberately retain the catalogue base DN before integrating clients, protect the generated administrator password, and create restricted service accounts where possible. The package does not configure LDAP clients, expose a complete directory protocol, add OIDC or proxy services, provide application email, or test compatibility with every consuming application.