# /opt/lldap/lldap --version
lldap 0.6.3
# /opt/lldap/lldap --help
lldap is a lightweight LDAP server

Usage: lldap <COMMAND>

Commands:
  export_graphql_schema  Export the GraphQL schema to *.graphql
  run                    Run the LDAP and GraphQL server
  healthcheck            Test whether the LDAP and GraphQL server are responsive
  send_test_email        Send a test email
  create_schema          Create database schema
  help                   Print this message or the help of the given subcommand(s)

Options:
  -h, --help     Print help
  -V, --version  Print version

# useradd --system --home-dir /var/lib/lldap --shell /usr/sbin/nologin lldap
# mkdir -p /etc/lldap /var/lib/lldap
# chown -R lldap:lldap /var/lib/lldap

# chown root:lldap /etc/lldap/lldap_config.toml && chmod 640 /etc/lldap/lldap_config.toml
# ls -la /etc/lldap/
total 12
drwxr-xr-x 2 root lldap 4096 Oct 19 05:12 .
drwxr-xr-x 1 root root  4096 Oct 19 05:12 ..
-rw-r----- 1 root lldap 1146 Oct 19 05:12 lldap_config.toml

[Unit]
Description=lldap - Light LDAP implementation for authentication
Documentation=https://github.com/lldap/lldap
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
WorkingDirectory=/opt/lldap
User=lldap
Group=lldap
ExecStart=/opt/lldap/lldap run --config-file /etc/lldap/lldap_config.toml
Restart=on-failure
RestartSec=5s

[Install]
WantedBy=multi-user.target

# systemctl daemon-reload
# systemctl enable --now lldap
Synchronizing state of lldap.service with SysV service script with /usr/lib/systemd/systemd-sysv-install.
Executing /usr/lib/systemd/systemd-sysv-install enable lldap
Created symlink /etc/systemd/system/multi-user.target.wants/lldap.service → /usr/lib/systemd/system/lldap.service.
# systemctl is-active lldap
active

# systemctl restart lldap

ldap_host = "0.0.0.0"
ldap_port = 3890
http_host = "0.0.0.0"
http_port = 17170
http_url = "http://192.168.146.128:17170"

# ss -ltn | grep -E ':3890|:17170'
LISTEN 0      2048         0.0.0.0:3890       0.0.0.0:*
LISTEN 0      2048         0.0.0.0:17170      0.0.0.0:*

ldap_base_dn = "dc=example,dc=com"

# ldapsearch -x -H ldap://127.0.0.1:3890 -D "cn=admin,ou=people,dc=example,dc=com" -w q1w2e3r4 -b "dc=example,dc=com" "(objectClass=*)"
# extended LDIF
#
# LDAPv3
# base <dc=example,dc=com> with scope subtree
# filter: (objectClass=*)
# requesting: ALL
#

# admin, people, example.com
dn: uid=admin,ou=people,dc=example,dc=com
cn: Administrator
createtimestamp: 20261019051213Z
entryuuid: de0245fe-3501-3e99-9f6e-9a066308e948
mail: admin@example.com
objectclass: inetOrgPerson
objectclass: posixAccount
objectclass: mailAccount
objectclass: person
uid: admin

# jsmith, people, example.com
dn: uid=jsmith,ou=people,dc=example,dc=com
cn: John Smith
createtimestamp: 20261019051514Z
entryuuid: 86d14826-2fcb-347a-a0aa-7095d40e98e5
mail: jsmith@example.com
objectclass: inetOrgPerson
objectclass: posixAccount
objectclass: mailAccount
objectclass: person
uid: jsmith

# developers, groups, example.com
dn: cn=developers,ou=groups,dc=example,dc=com
cn: developers
entryuuid: 0944c08f-e42e-3dec-a7be-5b43ce970dd8
member: uid=jsmith,ou=people,dc=example,dc=com
objectclass: groupOfUniqueNames
objectclass: groupOfNames
uid: developers
uniquemember: uid=jsmith,ou=people,dc=example,dc=com

# lldap_admin, groups, example.com
dn: cn=lldap_admin,ou=groups,dc=example,dc=com
cn: lldap_admin
entryuuid: 13a64509-a5c6-3b4b-8343-9a1a09566633
member: uid=admin,ou=people,dc=example,dc=com
objectclass: groupOfUniqueNames
objectclass: groupOfNames
uid: lldap_admin
uniquemember: uid=admin,ou=people,dc=example,dc=com

# lldap_password_manager, groups, example.com
dn: cn=lldap_password_manager,ou=groups,dc=example,dc=com
cn: lldap_password_manager
entryuuid: c46b4c82-bf4d-3549-ad19-7869999df0ec
objectclass: groupOfUniqueNames
objectclass: groupOfNames
uid: lldap_password_manager

# lldap_strict_readonly, groups, example.com
dn: cn=lldap_strict_readonly,ou=groups,dc=example,dc=com
cn: lldap_strict_readonly
entryuuid: 6da91b3b-eae7-3280-b4f3-79b23c788d43
objectclass: groupOfUniqueNames
objectclass: groupOfNames
uid: lldap_strict_readonly

# search result
search: 2
result: 0 Success
control: 1.2.840.113556.1.4.319 false MAUCAQYEAA==
pagedresults: estimate=6 cookie=

# numResponses: 7
# numEntries: 6

jwt_secret = "18e5f12c62f8b6754584cb1a3005bdd98149f5672f81ef63fd0661379aee9403"

# openssl rand -hex 32
18e5f12c62f8b6754584cb1a3005bdd98149f5672f81ef63fd0661379aee9403

# /opt/lldap/lldap run --config-file /tmp/test_nojwt.toml
2026-10-19T05:36:16.199118087+00:00  INFO     ┝━ ｉ [info]: Starting LLDAP version 0.6.3
2026-10-19T05:36:16.199831860+00:00  INFO     ┝━ ｉ [info]: Starting the LDAP server on port 13890
2026-10-19T05:36:16.199848466+00:00  INFO     ┕━ ｉ [info]: Starting the API/web server on port 17171
2026-10-19T05:36:16.220421028+00:00  ERROR    ┝━ ｅ [error]: Configuration error: A secret is missing. Please reserve a JWT secret by setting the `JWT_SECRET` environment variable or the `jwt_secret` value in the config file.

key_seed = "gg93PDzoFn2qyMk8dvg7y2Xk"

# sqlite3 /var/lib/lldap/users.db ".tables"
group_attribute_schema   memberships              user_attribute_schema
group_attributes         user_attributes          users
group_object_classes     user_object_classes
groups                   jwt_refresh_storage
jwt_storage              metadata
# sqlite3 /var/lib/lldap/users.db "SELECT user_id, length(password_hash), hex(substr(password_hash,1,24)) FROM users;"
admin|192|74A57054742B5384B625BDB82446EA139B464D349F3276A4
jsmith|192|8AE87296E54C0DFB7BE47054E52BAFE33F24D5B1D43B62A9

database_url = "sqlite:///var/lib/lldap/users.db?mode=rwc"

[smtp_options]
#enable_password_reset=true
#server="smtp.example.com"
#port=587
#smtp_encryption = "STARTTLS"
#user="sender@example.com"
#password="password"
#from="LLDAP Admin <sender@example.com>"
#reply_to="Do not reply <noreply@example.com>"

# curl -s -w "\nHTTP:%{http_code}\n" -X POST "http://127.0.0.1:17170/auth/reset/step1/jsmith@example.com"
Internal server error: `Could not send email: error response to `AUTH` command: 535 5.7.8 Error: authentication failed: No compatible authentication mechanism was found (os error 335)`
HTTP:500

# curl -s -w "HTTP:%{http_code}\n" -X POST "http://127.0.0.1:17170/auth/reset/step1/jsmith@example.com"
HTTP:200

==== 收件器回显 ====
From: LLDAP Admin <noreply@example.com>
To: jsmith@example.com
Subject: [LLDAP] Password reset requested

Hello John Smith,

This message is a reply to a password reset request made from the LLDAP admin interface.

To change your password, please visit http://192.168.146.128:17170/reset-password/step2/h9SWZwdPcA...

DEBUG ┝━ ｉ [info]: Sending email to 'jsmith@example.com' as 'LLDAP Admin <noreply@example.com>' via 'noreply@example.com'@'127.0.0.1':'2525'
INFO  ┕━ ｉ [info]: Password reset email sent

# /opt/lldap/lldap healthcheck --config-file /etc/lldap/lldap_config.toml
2026-10-19T05:35:19.231040080+00:00  INFO     ┝━ ｉ [info]: Testing LDAP
2026-10-19T05:35:19.231691204+00:00  INFO     ┕━ ｉ [info]: Testing GraphQL

# TOKEN=$(curl -s -X POST http://127.0.0.1:17170/auth/simple/login -H "Content-Type: application/json" -d '{"username":"admin","password":"q1w2e3r4"}' | python3 -c "import json,sys;print(json.load(sys.stdin)['token'])")
# curl -s -X POST http://127.0.0.1:17170/api/graphql -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d '{"query":"mutation { createGroup(name: \"developers\") { id displayName } }"}'
{"data":{"createGroup":{"id":4,"displayName":"developers"}}}

# curl -s -X POST http://127.0.0.1:17170/api/graphql -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d '{"query":"mutation { createUser(user: {id: \"jsmith\", email: \"jsmith@example.com\", displayName: \"John Smith\"}) { id email displayName } }"}'
{"data":{"createUser":{"id":"jsmith","email":"jsmith@example.com","displayName":"John Smith"}}}

# curl -s -X POST http://127.0.0.1:17170/api/graphql -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d '{"query":"mutation { addUserToGroup(user: \"jsmith\", group: 4) { ok } }"}'
{"errors":[{"message":"Expected value of type \"String!\", found 4.","locations":[{"line":1,"column":36}]}]}
{"errors":[{"message":"Unknown argument \"group\" on field \"Mutation.addUserToGroup\".","locations":[{"line":1,"column":45}]}],"data":null}

# curl -s -X POST http://127.0.0.1:17170/api/graphql -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d '{"query":"mutation { addUserToGroup(userId: \"jsmith\", groupId: 4) { ok } }"}'
{"data":{"addUserToGroup":{"ok":true}}}

# /opt/lldap/lldap_set_password --help 2>&1 | head -14
CLI tool to reset the password of a user in the LDAP server

Usage: lldap_set_password [OPTIONS]

Options:
      --base-url <BASE_URL>
          Base url of the LDAP server [default: http://localhost:17170]
      --admin-username <ADMIN_USERNAME>
          Admin username
      --admin-password <ADMIN_PASSWORD>
          Admin password
      --username <USERNAME>
          User name of the user to update
      --password <PASSWORD>
          New password
      --token <TOKEN>
          Admin API token
  -h, --help  Print help
  -V, --version  Print version
# /opt/lldap/lldap_set_password --base-url http://127.0.0.1:17170 --admin-username admin --admin-password q1w2e3r4 --username jsmith --password q1w2e3r4

# ldapsearch -x -H ldap://127.0.0.1:3890 -D "cn=admin,ou=people,dc=example,dc=com" -w q1w2e3r4 -b "dc=example,dc=com" "(uid=jsmith)" memberOf dn
# extended LDIF
#
# LDAPv3
# base <dc=example,dc=com> with scope subtree
# filter: (uid=jsmith)
# requesting: memberOf dn
#

# jsmith, people, example.com
dn: uid=jsmith,ou=people,dc=example,dc=com
memberOf: cn=developers,ou=groups,dc=example,dc=com

# search result
search: 2
result: 0 Success
control: 1.2.840.113556.1.4.319 false MAUCAQEEAA==
pagedresults: estimate=1 cookie=

# numResponses: 2
# numEntries: 1

# ldapwhoami -x -H ldap://127.0.0.1:3890 -D "uid=jsmith,ou=people,dc=example,dc=com" -w q1w2e3r4
Result: Success (0)
Additional info: dn:uid=jsmith,ou=people,dc=example,dc=com
# curl -s -X POST http://127.0.0.1:17170/auth/simple/login -H "Content-Type: application/json" -d '{"username":"jsmith","password":"q1w2e3r4"}' | head -c 230
{"token":"eyJhbGciOiJIUzUxMiJ9.eyJleHAiOjE3OTIzODMwMzcsImlhdCI6MTc5MjM3OTQzN30...
"refreshToken":"...","status":"Success"}

# curl -s -X POST http://127.0.0.1:17170/api/graphql -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d '{"query":"{ user(userId: \"jsmith\") { id email displayName groups { displayName } } }"}'
{"data":{"user":{"id":"jsmith","email":"jsmith@example.com","displayName":"John Smith","groups":[{"displayName":"developers"}]}}}
# curl -s -X POST http://127.0.0.1:17170/api/graphql -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d '{"query":"{ groups { id displayName } }"}'
{"data":{"groups":[{"id":1,"displayName":"lldap_admin"},{"id":2,"displayName":"lldap_password_manager"},{"id":3,"displayName":"lldap_str_readonly"},{"id":4,"displayName":"developers"}]}}

# /opt/lldap/lldap export_graphql_schema --output /tmp/schema.graphql

# /etc/lldap/lldap_config.toml - lldap 主配置（实测环境）
verbose = false
ldap_host = "0.0.0.0"
ldap_port = 3890
http_host = "0.0.0.0"
http_port = 17170
http_url = "http://192.168.146.128:17170"
jwt_secret = "18e5f12c62f8b6754584cb1a3005bdd98149f5672f81ef63fd0661379aee9403"
ldap_base_dn = "dc=example,dc=com"
ldap_user_dn = "admin"
ldap_user_email = "admin@example.com"
ldap_user_pass = "q1w2e3r4"
database_url = "sqlite:///var/lib/lldap/users.db?mode=rwc"
key_seed = "gg93PDzoFn2qyMk8dvg7y2Xk"

[smtp_options]
#enable_password_reset=true
#server="smtp.example.com"
#port=587
#smtp_encryption = "STARTTLS"
#user="sender@example.com"
#password="password"
#from="LLDAP Admin <sender@example.com>"
#reply_to="Do not reply <noreply@example.com>"

[ldaps_options]
#enabled=true
#port=6360
#cert_file="/var/lib/lldap/cert.pem"
#key_file="/var/lib/lldap/key.pem"

[healthcheck_options]
#http_host = "localhost"
#ldap_host = "localhost"