Setup 


https://www.openldap.org/doc/admin26/quickstart.html
https://www.openldap.org/doc/admin26/slapdconfig.html
https://www.port389.org/docs/389ds/howto/quickstart.html
https://www.freeipa.org/page/Quick_Start_Guide
https://www.freeipa.org/page/Deployment_Recommendations
https://www.samba.org/samba/docs/current/man-html/samba-tool.8.html

1. Linux VM With systemd#

OpenLDAP#

OpenLDAP 适合轻量、通用、标准 LDAP 目录。生产上要认真设计 schema、ACL、TLS、backup 和 replication。

Ubuntu packages:

sudo apt-get update
sudo apt-get install -y slapd ldap-utils
sudo systemctl enable --now slapd
sudo systemctl status slapd

Configure interactively if needed:

sudo dpkg-reconfigure slapd

Verify RootDSE:

ldapsearch -H ldap://127.0.0.1:389 \
  -x \
  -b "" \
  -s base \
  namingContexts supportedLDAPVersion

Example base LDIF:

dn: ou=people,dc=example,dc=com
objectClass: organizationalUnit
ou: people

dn: ou=groups,dc=example,dc=com
objectClass: organizationalUnit
ou: groups

dn: ou=service-accounts,dc=example,dc=com
objectClass: organizationalUnit
ou: service-accounts

Apply:

ldapadd -H ldapi:/// \
  -Y EXTERNAL \
  -f base.ldif

Useful logs:

journalctl -u slapd -f

389 Directory Server#

389 Directory Server is a mature LDAP server with better admin tooling than raw OpenLDAP for many enterprise teams.

Typical package flow:

sudo dnf install -y 389-ds-base
sudo dscreate interactive
sudo dsctl <instance_name> status

Useful commands:

sudo dsctl <instance_name> status
sudo dsctl <instance_name> restart
sudo dsconf <instance_name> backend suffix list
sudo dsconf <instance_name> monitor server

FreeIPA#

FreeIPA is not just LDAP. It combines LDAP, Kerberos, CA, DNS options, SSSD integration, sudo/HBAC policy, and host/service identity for Linux environments.

Typical package flow:

sudo dnf install -y freeipa-server freeipa-server-dns
sudo ipa-server-install
sudo systemctl status ipa

Client enrollment:

sudo dnf install -y freeipa-client
sudo ipa-client-install --mkhomedir

Use FreeIPA when the goal is Linux identity platform, not only a simple LDAP address book.

2. Docker#

Docker is useful for local tests. Do not treat random LDAP container images as production-grade without checking persistence, TLS, backup, upgrade, and security posture.

Lab-only principles:

use:
    dev schema tests
    app LDAP integration tests
    Keycloak User Federation tests

do not use for production unless:
    image is vetted
    version is pinned
    persistent volume is backed up
    TLS and secrets are managed
    upgrade path is tested

Example test workflow:

1. start LDAP container
2. import test users/groups from LDIF
3. run ldapsearch and ldapwhoami checks
4. connect Keycloak dev realm
5. destroy environment after test

Example LDIF for tests:

dn: uid=alice,ou=people,dc=example,dc=com
objectClass: inetOrgPerson
uid: alice
cn: Alice Chen
sn: Chen
mail: alice@example.com

dn: cn=developers,ou=groups,dc=example,dc=com
objectClass: groupOfNames
cn: developers
member: uid=alice,ou=people,dc=example,dc=com

3. K8S With Helm#

LDAP can run on Kubernetes, but it is often not the best first choice for production identity infrastructure. Directory services are stateful, security-sensitive, and operationally unforgiving.

Kubernetes fit:

good:
    dev/test LDAP
    ephemeral integration tests
    small internal directory with clear ownership

risky:
    enterprise source of truth without experienced operators
    unclear backup/restore
    unclear persistent volume recovery
    unclear replication behavior during node failure

If using Kubernetes:

required:
    StatefulSet
    persistent volume
    PodDisruptionBudget
    anti-affinity
    NetworkPolicy
    TLS Secret
    backup CronJob or external backup
    restore runbook
    liveness/readiness probes based on ldapsearch

Readiness probe idea:

ldapsearch -H ldaps://127.0.0.1:636 \
  -x \
  -b "" \
  -s base \
  namingContexts

Production note:

prefer:
    Microsoft AD DS for Windows enterprise domain
    managed directory service when acceptable
    FreeIPA / 389 DS / OpenLDAP on VMs when the team owns LDAP operations

use Helm only when:
    chart source is trusted
    values are reviewed
    backups and upgrades are tested

4. High Availability#

LDAP HA is product-specific. Do not assume putting one LDAP pod behind a load balancer is HA.

HA design:
    at least two directory servers
    replication configured and monitored
    clients have multiple LDAP URLs or use a load balancer
    write path understood
    conflict handling understood
    backup is separate from replication

Product notes:

Product HA Pattern Notes
AD DS multiple domain controllers DNS and site design matter
FreeIPA multiple replicas CA/DNS/Kerberos roles must be planned
389 DS multi-supplier replication monitor replication status
OpenLDAP replication with syncrepl / delta-syncrepl operational expertise required

Backup is not HA:

replication:
    handles node loss and read availability

backup:
    handles accidental deletion, corruption, bad schema change, disaster recovery

5. Operations#

common checks#

ldapsearch -H ldaps://ldap.example.com:636 \
  -x \
  -b "" \
  -s base \
  namingContexts supportedLDAPVersion
ldapwhoami -H ldaps://ldap.example.com:636 \
  -x \
  -D "uid=svc-keycloak,ou=service-accounts,dc=example,dc=com" \
  -W

backup checklist#

backup:
    directory database
    schema
    config
    TLS certificates
    service account list
    replication agreement config

restore test:
    restore to isolated network
    verify admin bind
    verify service bind
    verify user search
    verify group membership
    verify Keycloak sync in test realm

change checklist#

before schema/ACL change:
    export config
    test in staging
    notify app owners
    verify rollback path

after change:
    run ldapsearch for sample users
    run group lookup
    run Keycloak sync
    watch bind/search errors

incident commands#

OpenLDAP:

systemctl status slapd
journalctl -u slapd -n 200
ldapsearch -H ldapi:/// -Y EXTERNAL -b cn=config dn

389 Directory Server:

dsctl <instance_name> status
dsconf <instance_name> monitor server
dsconf <instance_name> backend suffix list

FreeIPA:

ipactl status
ipa user-find alice
ipa group-show developers
TLS Forward