6,528 stars · GPL-3.0, read from /blob/main/LICENSE on 2026-09-28; the complete unmodified GPLv3 text, no added restriction and no enterprise carve-out · v0.6.3 (2026-04-30), read from /releases/latest and confirmed by ungh; the release's own changelog heading says 2026-05-01, one day ahead of the tag · Track this in Scout
A deliberately simplified LDAP authentication server with a web page for users and groups, so several self-hosted programs can share one account list.
▶Repo detailsthe review · specs · pros & cons · install
What it is
A deliberately simplified authentication server that speaks LDAP, the old protocol most self-hosted software understands for external logins. It stores users and groups in SQLite by default, and it ships a web page for managing them so there is no configuration file to hand-edit.
What it is good for. Anyone running several self-hosted services who has one password list per service. The usual answer is OpenLDAP, which is powerful and famously unpleasant to configure. This covers the narrow job — be the list of people that other programs check — and does nothing else. Its repository ships example settings for a range of programs, which is the part that usually costs an afternoon.
- Genuinely tiny. The project's own documentation quotes both "under 10 MB of memory including the database" and "about 15 MiB on startup", against a full OpenLDAP install.
- A web page for users and groups, so no LDIF files and no
slapdconfiguration. - GPL-3.0, read from the LICENSE file and completely unmodified. No paid edition, no feature held back.
- It is not a full LDAP server, and the project says so first. Browsing tools are generally unsupported, some programs need attributes it does not implement, and it will never hand out password hashes, because its password scheme is built not to have them. The project names one program as definitely incompatible: Synology.
- Releases are rare. Roughly one every eight to twelve months, and v0.6.3 from 30 April 2026 contained a fix for a crash that a specially crafted query could trigger. Anyone running it exposed waits a long time between tagged builds, even though the code itself is active.
- Still before 1.0 after five and a half years, with 97 open issues and 33 open pull requests. And the real ongoing work is not this program — it is writing LDAP settings into each program that uses it, one at a time.
- glauth/glauth
2,852 stars, code on 27 September 2026; a small LDAP server in Go that its own README scopes at development, home use and CI, and it has no first-class web page for managing users.
Track this in Scout - goauthentik/authentik
25,733 stars, code on 26 September 2026; a complete identity provider with SAML, OIDC, login flows and multi-factor, which can also serve LDAP, so far more capable and far heavier.
Track this in Scout - osixia/container-openldap
4,230 stars, code on 31 July 2026, renamed from osixia/docker-openldap; real OpenLDAP packaged as an image, so the full feature set and the full configuration burden, with no user-management page included.
Track this in Scout
It ships as a container image for Docker or Podman, and also as packages for Arch, Debian, CentOS, Fedora, openSUSE, Ubuntu and FreeBSD, plus a Kubernetes chart and a TrueNAS SCALE app.
