Self-host directory-server
2.0.0.AM27LDAPv3 directory server with Kerberos and replication
- Stars
- 188
- Port
- 10389 (LDAP)
- Requires
- Java Runtime (JDK 11 or 17)
What is directory-server?
Apache Directory Server (ApacheDS) is an extensible, embeddable directory server written in Java. The Open Group has certified it as LDAPv3 compatible. Beyond standard LDAP, it includes a built-in Kerberos 5 server providing KDC, TGS, and AS roles, supports the Change Password Protocol, and extends the LDAP model with additional constructs. Key capabilities include multi-master replication via RFC 4533, password policy enforcement per the LDAP Password Policy draft, LDIF-based configuration stored in the DIT, and X.500-style access control using subentries. The server runs on Linux, macOS, and Windows with native installers (.deb, .rpm, .bin, .exe, .zip, .tar.gz) and can also be embedded directly into Java applications. The current release is 2.0.0.AM27 (a milestone toward 2.0 GA), which supports Java 11 and 17, TLS 1.3, and SASL mechanisms including GSSAPI for Kerberos integration. Note: the project documents that it is not yet considered production ready due to known data corruption issues; a repair command exists as a workaround.
Should you self-host directory-server?
directory-server scores 46/100 on selfhost.directory (how scoring works) and ranks #26 of 40 in Authentication. It has 188 GitHub stars.
There was no stable release in the past 12 months, so check the repository's recent activity before you rely on it.
Setup is advanced: plan for several services and some ongoing maintenance. It is Apache-2.0-licensed and written mostly in Java.
Its closest alternative on selfhost.directory is keycloak (86/100, 37 568 stars). It scores higher overall, so compare the two before you pick. See directory-server vs keycloak side by side.
Features
- Backup and Restore
- Change Password Protocol
- DHCP Server
- DNS Server
- Embeddable in Java Applications
- Kerberos 5 Server
- LDAPv3 Compliance
- LDIF-Based Configuration
- Multi-master replication
- Password policy
- SASL Authentication
- TLS 1.3 Support
- Triggers and Stored Procedures
- X.500 Access Control
directory-server README
More in Identity & Auth
docker-sso-serverLightweight self-hosted SSO server with OAuth2 and OTP, runs in a tiny container (<1% CPU, ~15 MiB RAM) and works as Traefik Forward Auth backend.
DockFlareOpen-source, self-hosted control plane turning Docker labels into Cloudflare Tunnel routes, DNS entries and Zero Trust policies, with an optional sovereign email suite.
EnteSelf-hosted, open-source Ente is an end-to-end encrypted cloud for photos, 2FA codes and documents, with on-device face detection and natural-language search.
facial-access-controlSelf-hosted facial recognition access control managing biometrics, integrating with kerberos.io cameras, and providing plugin-based access on your infrastructure.
FirezoneZero-trust remote access built on WireGuard for teams: gateways run in your network, while policies, device trust and audit logs are managed from a hosted portal.
FreeIPAOpen-source, self-hosted identity management for Linux/UNIX networks: LDAP, MIT Kerberos SSO, certificate authority, DNS and AD trusts, with CLI, Web UI and API.
FusionAuthFusionAuth is a self-hosted CIAM platform for auth, authorization, and user management with SSO, MFA, passkeys, and social login. Free Community edition available.
fusiondirectoryFusionDirectory is a self-hosted, open-source IAM solution for LDAP directories with role-based ACLs, workflow automation, and delegation for enterprises and education.
GateKeySelf-hosted zero-trust VPN wrapping OpenVPN and WireGuard with SSO login, short-lived certs, and per-user firewall rules for least-privilege access.
GLAuthOpen-source, MIT-licensed LDAP server for developers and homelabs, with config-file, S3, ownCloud, database or LDAP-proxy backends, 2FA and a REST stats API.
InfisicalInfisical is the open-source platform for securing secrets, certificates, access, and AI Agents.
jumpserverSelf-hosted, open-source PAM platform (GPL-3.0) giving IT teams browser access to SSH, RDP, Kubernetes and databases with session recording, RBAC and MFA.
0 comments