OpenLDAP Directory Server - Managed Support

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## A Standards-Based LDAP Directory, Ready on First Boot

OpenLDAP is the widely deployed open source implementation of the Lightweight Directory Access Protocol. Its standalone daemon, slapd, stores users, groups and organisational data in a hierarchical directory and answers standard LDAP queries, so your applications, operating systems and network services can share one authoritative identity source instead of a separate account store for each. This image delivers OpenLDAP 2.6 fully installed from the distribution package repository, with the fast memory-mapped mdb backend, LDAPS enabled, a seeded demonstration directory and a systemd service that starts on boot, so you can run your first LDAP query within minutes of launch rather than working through a manual install and TLS configuration.

## Why This Image Instead of the Alternatives

Unlike AWS Managed Microsoft AD or a hosted identity provider, you get full schema flexibility, VPC-local latency and no per-user fees, with the directory entirely inside your own infrastructure. Unlike a bare open source install, the TLS configuration, credential bootstrapping and storage layout are already done. And unlike Marketplace images that ship a shared default password, every instance generates its own administrator credential and TLS certificate.

## Who This Is For

Platform and identity teams who need a self-hosted, standards-based LDAP directory inside their own VPC to back application authentication, without depending on a hosted identity provider. Application developers who need a real LDAP endpoint to develop and test directory integrations against, instead of mocking one. Infrastructure teams consolidating service-account and group data into one queryable directory.

## What Is Installed

• OpenLDAP 2.6 (slapd) from the distribution package repository, with the mdb backend
• ldap-utils, so ldapsearch, ldapadd and ldapmodify are available on the instance
• A base directory dc=example,dc=com with the administrator DN cn=admin,dc=example,dc=com
• A seeded demonstration directory containing ou=people, ou=groups and a sample user, so directory queries return data immediately
• LDAPS on port 636 with a self-signed certificate, plus StartTLS on port 389

## Secure By Default

The image ships with no usable directory administrator credential:

• A one-shot first-boot service generates a unique administrator password of at least 24 characters on every instance and applies it to the slapd rootdn
• The TLS certificate is regenerated per instance, so no shared private key is ever reused
• Credentials are written to a root-only file at /root/openldap-credentials.txt
• No two instances launched from this image share a directory password or a TLS key. This is asserted by automated checks against the published image: the generated password binds, and a wrong password is rejected with LDAP result 49

## Network Model

slapd listens on port 389 (LDAP with StartTLS) and port 636 (LDAPS). These ports are opened in the security group so downstream services can bind out of the box, but an LDAP endpoint reachable from the internet is a serious exposure. Restrict the 389 and 636 rules to your own VPC CIDR rather than 0.0.0.0/0, prefer LDAPS on 636 for any bind that carries credentials, and never expose a plaintext bind over an untrusted network.

## Storage Layout

The directory database (the mdb data files under /var/lib/ldap) lives on a dedicated 20 GiB EBS volume, separate from the OS disk, independently resizable, and preserved on every instance launched from this image.

## Getting Started

1. Launch on an m5.large or larger, with port 22 open to your management network and 389/636 restricted to your VPC

2. Connect over SSH as the default login user for your variant, then read the generated password with sudo cat /root/openldap-credentials.txt

3. Bind as cn=admin,dc=example,dc=com and search dc=example,dc=com to see the seeded entries, and confirm an LDAPS bind on port 636 succeeds

4. Replace the demonstration entries with your own organisational units and import your directory data

## 24/7 cloudimg Support

Every deployment is backed by cloudimg engineers available around the clock by email and live chat, covering deployment, schema and DIT design, LDIF import, TLS and access control configuration, replication, backup and restore, and OpenLDAP upgrades. Critical issues receive a one-hour average response time. This image uses standard AWS pay-as-you-go infrastructure billing; launch an instance to evaluate against your own schema and terminate at any time.

OpenLDAP is a registered trademark of the OpenLDAP Foundation. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.