GLAuth - Lightweight LDAP Authentication Server

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Overview

GLAuth is a lightweight LDAP authentication server that gives your services a simple, self-contained LDAP directory without the operational weight of a full directory server. Where traditional solutions like OpenLDAP require multi-step schema configuration, ACL management, and a separate database backend, GLAuth replaces all of that with a single readable configuration file. Point applications such as Grafana, Gitea, Jellyfin, Nextcloud, and Keycloak at it for LDAP authentication and manage the entire directory in one place. This image delivers GLAuth fully installed and running under systemd, so an LDAP and LDAPS endpoint is answering within minutes of launch.

## Application Stack

GLAuth is a single self-contained Go binary that answers LDAP on port 389 and LDAPS with implicit TLS on port 636. It runs as a dedicated unprivileged system user and binds the standard directory ports through a narrowly scoped Linux capability. The directory is defined entirely by a single flat configuration file - there is no separate database to install, back up, or tune. systemd starts the service on boot and restarts it on failure, giving you a resilient authentication backend with minimal moving parts.

## Directory as Configuration

The directory lives in one human-readable configuration file, which makes it easy to review, version-control, and reason about. Add users and groups by editing the file and reloading the service. Downstream services bind with a service account and search the directory over plain LDAP or over LDAPS. You get a working authentication backend for your stack with a fraction of the complexity of a traditional directory server - no schema files, no replication topology, and no database migrations.

## Secure First Boot

The image ships with no usable credential and none of the well-known sample accounts found in many LDAP Docker images or default installations. On the first boot of your instance a one-shot service generates a fresh admin password unique to that instance, renders the working configuration from a template, generates a per-instance TLS certificate for LDAPS, and records the credentials in a file only the root user can read. No shared or default credentials ship in the image.

## Ready To Use

Read the generated admin password, bind to the LDAP or LDAPS endpoint from your application or with standard LDAP client tools such as ldapsearch, and query the directory. A wrong password is rejected, so authentication works end to end from the moment the instance is up. Connect your first downstream application by configuring its LDAP settings to point at the instance's private IP or DNS name.

## Getting Started

1. Launch the AMI in your VPC with a security group allowing TCP 389 and 636 from your application subnets.

2. SSH into the instance and read the generated credentials from the root-only file.

3. Test connectivity with ldapsearch using the admin bind DN and password.

4. Edit the configuration file to add your users and groups, then reload the service.

5. Point your downstream application (Grafana, Gitea, Nextcloud, etc.) at the LDAP endpoint.

For a detailed walkthrough including sample configurations for popular applications, contact cloudimg support to request the quickstart guide.

## Metered Support Model

This listing includes metered charges for cloudimg technical support services. You pay only for the support you use on top of standard AWS infrastructure costs. Contact support before or after purchase to discuss your deployment needs.

## cloudimg Support

24/7 technical support by email and chat. Our engineers help with deployment, connecting downstream applications, extending the directory, replacing the TLS certificate for production, and upgrade planning. Book a deployment walkthrough by emailing the support team to get personalized guidance for your application stack before committing.

## Use Cases

• A simple, self-hosted LDAP authentication backend for applications that support LDAP sign-in
• A lightweight alternative to OpenLDAP or FreeIPA for small teams, labs, and homelab stacks
• A single-file, version-controllable directory for consistent authentication across several services
• A quick LDAP endpoint for development and staging environments that mirrors production auth