lldap

A lightweight authentication server that provides an opinionated, simplified LDAP interface for authentication - LLDAP does not provide a full LDAP server. It comes with a frontend that makes user management easy, and allows users to edit their own details or reset their password by email.

Refer to LLDAP’s configuration file; config variables are prefixed with LLDAP_ or LLDAP_<SECTION>_ when passed as env vars.

Configuration Notes

• LLDAP — Declarative Selfhosted Lightweight Authentication · Stonegarden
• Custom OIDC claims with Argo CD and Audiobookshelf · Stonegarden

Grafana

1. Add grafana:admin and grafana:viewer groups
2. Add appropriate users to each group

NOTE: If username(s) overlap with existing Grafana usernames, they will conflict and OICD flow will fail.

View LLDAP Objects

Prerequisites: openldap (brew), ldap-utils (apt), or openldap-clients (dnf, yum, apk)

After port-forwarding the LLDAP container:

kubectl port-forward service/lldap 3890:3890 -n security

USER="admin"
DC1="home"
DC2="arpa"
ldapsearch -H ldap://localhost:3890 \
  -D "uid=${USER},ou=people,dc=${DC1},dc=${DC2}" -W \
  -b "dc=${DC1},dc=${DC2}" "(objectClass=*)"

Source: kubernetes/apps/security/lldap/README.md