wmantly
fe9b7c168b
All-in-one Dockerfile.openldap bundling the app + OpenLDAP + Redis in one container, plus an idempotent bare-metal install.sh, and a Jekyll docs site for GitHub Pages: - Dockerfile.openldap (node:20-alpine; openldap + pw-sha2/ppolicy/memberof/ refint; dumb-init PID 1; npm ci --omit=dev; tos.md copied to /). - docker-entrypoint.sh: generate slapd.conf (mdb + overlays + TLS + indexes + access), self-signed LDAPS cert, seed directory tree + required groups, bundled redis, export app_* config, exec node. - docker-compose.yml, .dockerignore, DEPLOYMENT.md, secrets.js.example. - install.sh: idempotent Debian/Ubuntu bare-metal installer (Node 20.x, OpenLDAP, Redis, systemd unit) with flags + --dry-run/--skip-ldap/--skip-app. - ops/ldif/: memberof/refint/tls/index/nodes/logging LDIFs. - nodejs/conf/base.js: generic defaults (dc=example,dc=com / localhost / SSO Manager) so per-deployment values move to secrets.js or app_* env. - nodejs/package.json: bump @simpleworkjs/conf to ^1.1.0 (app_* env overrides). - nodejs/routes/index.js: /health endpoint for healthchecks. - docs/: _config.yml + index/deployment/configuration/oauth/ldap pages (jekyll-theme-cayman) for GitHub Pages from /docs. Co-Authored-By: Claude <noreply@anthropic.com>
3.6 KiB
3.6 KiB
layout, title
| layout | title |
|---|---|
| default | Home |
SSO Manager
A self-hosted OpenID Connect provider with a bundled OpenLDAP directory and a web management UI — for home labs and small businesses that want their own identity provider instead of a hosted one.
Features
- OpenID Connect / OAuth 2.0 provider — issue your own access/refresh/id tokens; protect your apps with OIDC login.
- OpenLDAP directory — users, groups, POSIX accounts (
posixAccount/inetOrgPerson), SSH public keys, and sudo roles, withmemberOf+ referential-integrity overlays. - Web management UI — manage users, groups, and OAuth clients from a browser; invite/password-reset flows over email.
- LDAPS for legacy apps — apps that bind LDAP directly (Gitea, Emby, …) can use LDAPS (636) / StartTLS.
- All-in-one Docker image — app + OpenLDAP + Redis in one container, or
run each piece separately via
app_*env config.
Quick Start
Docker (all-in-one)
git clone https://github.com/theta42/sso-manager-node.git
cd sso-manager-node
cp secrets.js.example nodejs/conf/secrets.js # edit it, or use app_* env
docker compose up -d --build
The web UI comes up at http://localhost:3001. See the
Deployment Guide for the full set of app_* env vars.
Bare metal (Debian/Ubuntu)
sudo ./install.sh
Idempotent installer — installs Node.js, OpenLDAP, Redis, configures the app, and starts a systemd unit. Re-run to update.
Run it together with the proxy
The proxy (theta42/proxy) fronts this SSO under TLS and protects it with OIDC, while also binding LDAP directly. Run both with one command via theta-env:
git clone --recursive https://github.com/theta42/theta-env.git
cd theta-env && cp .env.example .env # edit, then:
./setup.sh
Documentation
- Deployment Guide — Docker + bare metal, the config layers,
the
app_*env reference, backups. - Configuration — every
app_*env var and the conf merge order. - OAuth / OIDC — the provider: discovery, client management, token lifetimes, scopes.
- LDAP — directory layout, TLS, overlays, schema, direct-bind service accounts.
Architecture
┌─────────────┐
│ Browser / │
│ OIDC apps │
└──────┬──────┘
│ HTTP/HTTPS
▼
┌────────────────────────┐ ┌─────────────┐
│ Express SSO Manager │◄────►│ Redis │
│ - OIDC provider │ │ - sessions │
│ - web UI (:3001) │ │ - models │
│ - management API │ └─────────────┘
└────────┬───────────────┘
│ ldapi/ldap (localhost)
▼
┌────────────────────────┐
│ OpenLDAP (slapd) │
│ - users / groups │
│ - LDAPS :636 │─── legacy apps bind directly
│ - StartTLS :389 │
└────────────────────────┘
Community
License
MIT License — see the repository for details.