Self-host 389-ds-base
389-ds-base-1.4.3.41Enterprise-grade open-source LDAP directory server
- Stars
- 300
- RAM
- 256 MB minimum, 256 MB to 1 GB recommended for production
- Storage
- 300 MB minimal, 2 GB+ for production
- Requires
- Berkeley DB, Cyrus SASL, ICU, Mozilla NSS, NSPR / DBM / NSS / SVRCORE / LDAPSDK / PerLDAP
What is 389-ds-base?
389 Directory Server (389-ds-base) is an enterprise-class open-source LDAP server for Linux, hardened by real-world use in some of the largest directory deployments. It provides multi-supplier replication for high availability, online zero-downtime configuration and management, powerful access control (ACIs), TLS and SASL authentication including Kerberos/GSSAPI, attribute encryption, password policies with account lockout, and Microsoft Windows Active Directory synchronization. The server uses Berkeley DB as its data store and Mozilla NSS for cryptography. It is administered via command-line tools (dsctl, dsconf, dsidm) and an optional Cockpit web UI plugin. Installation is available through native packages on Fedora, CentOS/RHEL, and OpenSUSE, or by building from source. Red Hat maintains the project with community contributors.
Should you self-host 389-ds-base?
389-ds-base scores 57/100 on selfhost.directory (how scoring works) and ranks #18 of 40 in Authentication. It has 300 GitHub stars.
It shipped 18 stable releases in the past year. The latest, 389-ds-base-2.2.11, came out on 7 September 2026.
Setup is advanced: plan for several services and some ongoing maintenance. It is Other-licensed and written mostly in C.
Its closest alternative on selfhost.directory is keycloak (86/100, 37 573 stars). It scores higher overall, so compare the two before you pick. See 389-ds-base vs keycloak side by side.
Features
- Access control (ACIs)
- Attribute encryption
- Chaining and referrals
- DSML Gateway
- Multi-supplier Replication
- Online configuration and management
- Password policy and account lockout
- Plugin interface
- Roles and Class of Service
- SASL Authentication
- Server-side sorting and virtual list view
- Task invocation via LDAP
- TLS/SSL Encryption
- Virtual views
- Windows Active Directory synchronization
389-ds-base README
FAQ
Who maintains this project?
The project is maintained by Red Hat along with community contributors.
Can I build plugins under any license?
Yes, through the GPL exception, plugins can be built under any license as long as they stay within the exception limits.
What crypto engine does 389 use?
389 uses Mozilla Network Security Services (NSS) as its crypto engine. It does not support OpenSSL or GnuTLS.
What database does 389 use?
389 Directory Server uses Berkeley DB (from Oracle, formerly Sleepycat) as its data store.
Does 389 support multi-supplier replication?
Yes, 389 supports asynchronous multi-supplier replication with automatic conflict resolution, allowing writes to multiple suppliers simultaneously.
What license does 389 Directory Server use?
The core directory server uses a GPLv3 license with a custom exception allowing proprietary plugins. Admin components use GPL, Apache modules use Apache 2.0, and Mozilla components use MPL/LGPL/GPL tri-license.
What are the system requirements?
Minimum 256 MB RAM, recommended 256 MB to 1 GB for production. Approximately 300 MB disk for minimal installation, 2 GB+ for production systems.
More in User Management
authgearSelf-hosted open-source CIAM and identity provider, an Auth0/Clerk alternative with passkeys, MFA, SAML SSO and RBAC, deployed via Helm.
brightonumBrightonUM is a self-hosted, open-source auth service with REST API, JWT tokens, invite registration, email verification, and password recovery using MongoDB.
FreeIPAOpen-source, self-hosted identity management for Linux/UNIX networks: LDAP, MIT Kerberos SSO, certificate authority, DNS and AD trusts, with CLI, Web UI and API.
FusionAuthFusionAuth is a self-hosted CIAM platform for auth, authorization, and user management with SSO, MFA, passkeys, and social login. Free Community edition available.
fusiondirectoryFusionDirectory is a self-hosted, open-source IAM solution for LDAP directories with role-based ACLs, workflow automation, and delegation for enterprises and education.
hankoOpen-source self-hosted authentication and user management platform with passkeys, MFA, OAuth SSO and SAML, an API-first alternative to Auth0 or Clerk.
jfa-goSelf-hosted, open-source user management for Jellyfin and Emby with invite-based accounts, password resets, and Ombi/Jellyseerr integration.
lamA self-hosted, open-source web frontend for managing users and groups in LDAP directories such as OpenLDAP and Active Directory.
LLDAPlldap is a self-hosted, open-source lightweight LDAP server with web UI, supporting SQLite/MySQL/PostgreSQL, simpler than OpenLDAP.
oryOpen-source, self-hosted identity server for login, registration, recovery and MFA, with passkeys, TOTP and social sign-in served through headless HTTP APIs.
Pocket IDSelf-hosted, open-source OpenID Connect Certified provider for homelabs and small teams that find Keycloak or Authentik too heavy; passkey sign-in only.
supertokensSelf-hosted, open-source authentication service replacing Auth0, Firebase Auth or AWS Cognito, with passwordless, social, email-password login and session management.
0 comments