Apache Directory Server LDAP - Managed Support

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## An LDAP Directory Service, Ready on First Boot

Apache Directory Server (ApacheDS) is the Apache Software Foundation's extensible, embeddable directory server. It is certified LDAP v3 compatible and also speaks Kerberos, making it a practical foundation for centralised identity, authentication and application directory data. This image delivers ApacheDS fully installed on OpenJDK 17 with a dedicated service account, a systemd unit, and a seeded demonstration partition, so you can run your first LDAP query within minutes of launch rather than working through a manual install.

## Who This Is For

Platform and identity teams who need a self-hosted LDAP directory inside their own VPC to back application authentication, without operating a heavyweight identity suite. Application developers who need a real, standards-compliant LDAP endpoint to develop and test directory integrations against, instead of mocking one. Infrastructure teams consolidating service-account and group data into a queryable directory.

## What Is Installed

• Apache Directory Server 2.0.0.AM27, the official Apache binary distribution
• OpenJDK 17 (headless) from the distribution archive as the runtime
• ldap-utils, so ldapsearch, ldapadd and ldapmodify are available on the instance
• A dedicated unprivileged apacheds service account and a systemd unit that starts the directory on boot
• A seeded demonstration partition dc=cloudimg,dc=local containing organizational units, sample user entries and a group, so directory queries return data immediately

## Secure By Default

ApacheDS bootstraps with a well-known upstream administrator password. This image does not leave it that way:

• A one-shot first-boot service generates a unique administrator password of at least 24 characters on every instance
• The new password is applied over LDAP and then verified before the instance is marked ready
• Credentials are written to a root-only file at /root/apacheds-credentials.txt
• The upstream default password is rejected on any launched instance. This is asserted by an automated check, in both directions, against the published image

## Network Model

The LDAP listener on port 10389 and the LDAPS listener on port 10636 are bound to the loopback interface only and are not exposed to the network. This is a deliberate default: an unauthenticated directory reachable from the internet is a serious exposure. Reach the directory from your workstation with an SSH tunnel, or rebind it to a private interface behind your own security group and TLS termination when you are ready. The user guide covers both.

## Storage Layout

The ApacheDS instance, meaning its DIT partitions, configuration, working directory and logs, lives on a dedicated 30 GiB EBS volume mounted at /var/lib/apacheds, separate from the operating system disk. The volume is independently resizable, and the layout is preserved on every instance launched from this image.

## Getting Started

1. Launch the image on an m5.large instance or larger, with port 22 open to your management network

2. Connect over SSH as the default login user for your variant (the user guide lists it)

3. Retrieve the generated administrator password with sudo cat /root/apacheds-credentials.txt

4. Run an anonymous rootDSE query to confirm the directory is answering

5. Bind as uid=admin,ou=system and search dc=cloudimg,dc=local to see the seeded entries

6. Open an SSH tunnel to reach the directory from an LDAP browser on your workstation

7. Replace the demonstration partition with your own suffix and import your directory data

## 24/7 cloudimg Support

Every deployment is backed by cloudimg engineers available around the clock by email and live chat. Support covers deployment and sizing guidance, directory schema and partition design, LDIF import, rebinding the listeners to a private interface, LDAPS and TLS certificate configuration, access control (ACI) configuration and administrator credential management, backup and restore of the directory partitions, and ApacheDS upgrades, JVM tuning and troubleshooting. Critical issues receive a one-hour average response time.

## Evaluation

This image uses standard AWS pay-as-you-go infrastructure billing. Launch an instance to evaluate the directory against your own schema and data, and terminate at any time.

Apache, Apache Directory, Apache Directory Server and ApacheDS are trademarks of The Apache Software Foundation. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.