Self-host nginx-ldap-auth
release-0.0.5LDAP authentication reference for NGINX
- Stars
- 709
- Ports
- 8888 (ldap-auth daemon HTTP listener), 8081 (NGINX/NGINX Plus listener for authenticated requests), 9000 (Sample backend application)
- Requires
- OpenLDAP or Microsoft Active Directory, Python, Python-ldap
What is nginx-ldap-auth?
This NGINX, Inc. project shows how to add LDAP user authentication to applications behind NGINX or NGINX Plus. It supplies a Python daemon that sits between NGINX's auth_request module and an LDAP directory (OpenLDAP or Active Directory), a test backend, and a ready-to-use NGINX config. The code is a reference model, not production-ready, but demonstrates cookie and basic auth, STARTTLS, result caching, and flexible LDAP search filters. Default ports are 8888 for the daemon, 8081 for NGINX, and 9000 for the sample backend. You can run it via Docker, directly with Python 2 or 3, or with the included control script.
Should you self-host nginx-ldap-auth?
nginx-ldap-auth scores 43/100 on selfhost.directory (how scoring works) and ranks #31 of 40 in Authentication. It has 709 GitHub stars.
There was no stable release in the past 12 months, so check the repository's recent activity before you rely on it.
Setup is advanced: plan for several services and some ongoing maintenance. It is BSD-2-Clause-licensed and written mostly in Python.
Its closest alternative on selfhost.directory is keycloak (86/100, 37 577 stars). It scores higher overall, so compare the two before you pick. See nginx-ldap-auth vs keycloak side by side.
Features
- Authentication Caching
- Cookie-based Authentication
- Customizable LDAP Search Filters
- HTTP Basic Authentication
- LDAP AuthenticationReference implementation, not production-hardened
- LDAP STARTTLS Support
nginx-ldap-auth README
More in Identity & Auth
OAuth2 ProxyOpen-source, self-hosted auth proxy that puts OAuth2/OIDC sign-in in front of web apps, with email/domain/group checks and Redis sessions.
openamSelf-hosted open-source access management: SSO, SAML, OAuth 2.0 and OIDC federation, adaptive authentication, centralized policy; ships as a Docker image or WAR.
oryOpen-source, self-hosted identity server for login, registration, recovery and MFA, with passkeys, TOTP and social sign-in served through headless HTTP APIs.
permifyAn open-source authorization as a service inspired by Google Zanzibar, designed to build and manage fine-grained and scalable authorization systems for any application. — Permify is now part of FusionAuth 🎉
phpLDAPadminphpLDAPadmin (PLA) is a self-hosted, open-source web app for browsing, searching, and modifying LDAP directory data — a user-friendly alternative to CLI LDAP tools.
Pocket IDSelf-hosted, open-source OpenID Connect Certified provider for homelabs and small teams that find Keycloak or Authentik too heavy; passkey sign-in only.
PomeriumOpen-source self-hosted identity-aware reverse proxy that gates private web apps, SSH and TCP services through OIDC sign-in and per-request access policy.
pwmPWM is a self-hosted, open-source password self-service app for LDAP directories. Users reset passwords, unlock accounts, and manage credentials via web UI.
qauthQAuth is a self-hosted, open-source OAuth 2.1/OIDC 1.0 server for AI agents with on-behalf-of delegation, audience-bound tokens, and post-quantum ready crypto.
rauthyOpen-source, self-hosted Rust identity provider: single sign-on for apps and Linux hosts via OIDC, OAuth 2 and PAM, with passkey-first MFA, HA mode and an admin UI.- SambaSamba is an open-source implementation of the SMB/CIFS protocol for Linux and Unix systems, providing secure, stable, and fast file and print services.
supertokensSelf-hosted, open-source authentication service replacing Auth0, Firebase Auth or AWS Cognito, with passwordless, social, email-password login and session management.
0 comments