Support for LDAP/LDAPS

[ap0int3d]

Hello,
For more local setup such as labs where access to an OIDC provider is not available, it would be nice to be able to use a simple LDAP server for user authentication.

[bifrost0x]

Thanks for the suggestion. I agree that LDAP/LDAPS support could be very useful, especially for local and lab environments. I need to think through the implementation carefully before committing to a concrete approach, because this touches the security boundary of WebSSH rather than being just another login adapter. LDAPS or StartTLS with proper certificate validation, safe handling of bind credentials, correctly escaped LDAP filters, clear and fail-closed group-to-role mapping, and the handling of active sessions when a directory account is disabled or removed all need to be defined from the start. We also need a sensible decision on just-in-time provisioning versus synchronization and a controlled local break-glass administrator. I would rather design authentication, provisioning, and authorization together than ship a partial integration. The idea remains open while I work through that design.

[bifrost0x]

Implemented and merged in #106. LDAP and LDAPS authentication is now available as an optional feature.

How it is designed:

• LDAP stays disabled by default. Existing installations keep the normal login flow and do not get LDAP routes, background work, secret mounts, or helper services.
• Activation uses the separate docker-compose.ldap.yml overlay. No separate image and no .env file are required.
• A dedicated, network-isolated ldap-tools profile manages the bind password and CA certificate in a separate secret volume. WebSSH mounts that volume read-only.
• ldap:// always uses mandatory StartTLS before any bind. ldaps:// starts TLS immediately. Certificate verification is mandatory for both.
• WebSSH never auto-provisions directory users or grants admin rights through LDAP. An administrator explicitly links a stable LDAP identity to an existing non-admin WebSSH account.
• Linked accounts are LDAP-managed and do not silently fall back to old local passwords. Browser, remember-cookie, Socket.IO, SSH, transfer, and pooled access is invalidated when the authentication boundary changes.
• The local break-glass administrator remains independent from LDAP.

Short path to enable it:

1. Fill the required directory values in docker-compose.ldap.yml.
2. Store the bind password and CA certificate:

docker compose -f docker-compose.yml -f docker-compose.ldap.yml --profile ldap-tools run --rm ldap-tools set-password
docker compose -f docker-compose.yml -f docker-compose.ldap.yml --profile ldap-tools run --rm -T ldap-tools install-ca --stdin < company-ca.pem

3. Start WebSSH with the overlay:

docker compose -f docker-compose.yml -f docker-compose.ldap.yml up -d

4. Sign in with the local administrator, open Admin -> Settings -> LDAP directory, and run Check connection.
5. Create or select a non-admin WebSSH account, choose Link LDAP, then test Sign in with LDAP before migrating more users.

I am currently building out the project wiki. The complete operator guide, including Active Directory and OpenLDAP examples, filters, certificates, rollback, and troubleshooting, will be available there. Until then, the README and docs/ldap-authentication.md contain the full setup details.

[bifrost0x]

Please find the manual here: https://github.com/bifrost0x/webssh/wiki/LDAP-and-Active-Directory