Open source LDAP servers: five options and how to choose

An LDAP server is a directory that applications query for users, groups and other objects. It is not a single sign-on system and not a password manager: the application usually receives a username and password, binds to the directory to check them, and then keeps its own session.

Short answer: OpenLDAP is the smallest, most portable option. 389 Directory Server is the enterprise-grade Red Hat directory with a management console. FreeIPA bundles a directory with Kerberos, DNS and a CA for Linux estates. Samba AD gives you AD-compatible directory services on Linux. Casdoor serves LDAP for legacy applications while also providing OIDC, SAML and a modern login experience.

What an LDAP server does

LDAP stores entries in a tree. A user entry has a distinguished name such as uid=alice,ou=people,dc=example,dc=com and attributes such as mail, displayName and memberOf. Clients:

• Bind with a DN and password to authenticate.
• Search a subtree with a filter to find users and groups.
• Read attributes for authorization decisions.

LDAP runs on port 389, or 636 for LDAPS. StartTLS upgrades a plain connection to TLS on port 389.

The five options

OpenLDAP

OpenLDAP is the reference open-source implementation. It is small, stable and available in every Linux distribution. Configuration lives in slapd.conf or the cn=config tree; data is loaded with LDIF files.

It has no built-in web interface. Most teams use Apache Directory Studio as a desktop browser, phpLDAPadmin for a web view, or LDAP Account Manager for user administration.

Choose OpenLDAP when you need a directory, not a platform. It is the right answer for an application that only needs to bind and search, and for appliances that expect a plain LDAP endpoint.

389 Directory Server

389 Directory Server is the directory server that powers FreeIPA and much of Red Hat's identity stack. It supports multi-master replication, large directories and a management console, and it is available in RHEL, Fedora and Debian-based distributions.

Choose it when you need replication and a supported enterprise directory without the rest of FreeIPA. It is more complex to operate than OpenLDAP, but it scales further and has better tooling.

FreeIPA

FreeIPA is not just a directory: it combines 389 Directory Server with MIT Kerberos, DNS, a certificate authority and SSSD, and adds a web UI and CLI for managing users, groups, hosts and access rules.

Choose FreeIPA when most of your machines are Linux and you want Kerberos-based logon, DNS and a directory in one system. It is not AD-compatible: Windows clients cannot join it as a domain, and it does not do Group Policy.

Samba AD DC

Samba can run as an Active Directory domain controller, providing Kerberos, LDAP, DNS and Group Policy. It is the only open-source option that lets Windows machines join a domain.

Choose it when you need AD compatibility, Windows domain join and Group Policy without Windows Server licences. Advanced Microsoft features and some management tools are not covered.

Casdoor

Casdoor is an identity provider first and an LDAP server second. It exposes an LDAP endpoint so legacy applications and network devices can bind and search, while modern applications use OpenID Connect, SAML or CAS. Users, groups and passwords live in Casdoor's own store or are synced from AD, LDAP or another identity provider.

Choose it when you want one user directory serving both old LDAP clients and new SSO applications, with MFA, passkeys and a self-service login page. It is not a replacement for AD's domain services or for a replicated enterprise directory at very large scale.

Running one in Docker

OpenLDAP and 389 DS both have community container images. The common pattern is:

1. Mount the configuration and data directories as volumes.
2. Set the base DN, admin password and organization at first start.
3. Publish 389 and 636 only to the network that needs them.
4. Put TLS in front of LDAP before production.

For a quick test, a container is fine. For production, treat the directory as a stateful service: persistent volumes, backups, replication and a tested restore.

Which one should you pick?

• One application needs a bind endpoint: OpenLDAP.
• Large directory with replication: 389 Directory Server.
• Linux fleet with Kerberos, DNS and sudo rules: FreeIPA.
• Windows domain compatibility: Samba AD.
• LDAP plus modern SSO and MFA: Casdoor.

If the real requirement is "users sign in once to many applications", LDAP alone is the wrong tool. LDAP authenticates an application's bind; it does not issue tokens or create sessions across apps. That is what SAML, OIDC and an identity provider do.

Casdoor can serve both: LDAP for the applications that cannot do anything else, and OIDC or SAML for everything modern. Self-host it for free, or run a dedicated instance on Casdoor Cloud from $6.67/month billed yearly. Related reading: LDAP authentication, LDAP vs Active Directory and Active Directory alternatives.

FAQ

What is the best open-source LDAP server? OpenLDAP for a small, portable directory; 389 Directory Server for replication and enterprise scale; FreeIPA when you also need Kerberos and DNS.

Does OpenLDAP have a GUI? Not built in. Apache Directory Studio, phpLDAPadmin and LDAP Account Manager are common front ends.

Can I run OpenLDAP in Docker? Yes, and it is a common way to test. For production, use persistent volumes, TLS and backups; do not rely on an ephemeral container filesystem.

Is LDAP the same as Active Directory? No. Active Directory includes an LDAP interface, but it also provides Kerberos, DNS, Group Policy and Windows domain services.

Is LDAP single sign-on? No. LDAP verifies a username and password for an application. SSO requires an identity provider that issues tokens or assertions, such as SAML or OpenID Connect.