intoolswetrust / ldap-server

Simple in-memory LDAP server for testing purposes - single JAR based on ApacheDS

ldap-server

Simple all-in-one LDAP server (wrapped ApacheDS).

You don't need any configuration files to get it working. Just launch the JAR and that's it.

Server data are not persisted, they just live in memory.

Download

Download latest tag from GitHub releases

Docker container

If you search a lightweight Docker container with LDAP server for your testing, you can use kwart/ldap-server.

docker pull kwart/ldap-server
docker run -it --rm kwart/ldap-server

Development

You can simply build the software yourself.

How to get the sources

You should have git installed

git clone git://github.com/kwart/ldap-server.git

or you can download current sources as a zip file

How to build it

You need to have Maven installed

mvn clean package

How to run it

java -jar ldap-server.jar [data.ldif]

Help

$ java -jar target/ldap-server.jar --help
The ldap-server is a simple LDAP server implementation based on ApacheDS. It
creates one user partition with root 'dc=ldap,dc=example'.

Usage: java -jar ldap-server.jar [options] [LDIFs to import]
  Options:
    --admin-password, -ap
       changes password for account 'uid=admin,ou=system' (default password is
       'secret')
    --allow-anonymous, -a
       allows anonymous bind to the server
       Default: false
    --bind, -b
       takes [bindAddress] as a parameter and binds the LDAP server on the
       address
       Default: 0.0.0.0
    --help, -h
       shows this help and exits
       Default: false
    --port, -p
       takes [portNumber] as a parameter and binds the LDAP server on that port
       Default: 10389
    --ssl-enabled-ciphersuite, -scs
       takes [sslCipherSuite] as argument and enables it for 'ldaps'. Can be
       used multiple times.
    --ssl-enabled-protocol, -sep
       takes [sslProtocolName] as argument and enables it for 'ldaps'. Can be
       used multiple times. If the argument is not provided following are used:
       TLSv1, TLSv1.1, TLSv1.2
    --ssl-keystore-file, -skf
       takes keystore [filePath] as argument. The keystore should contain
       privateKey to be used by LDAPs
    --ssl-keystore-password, -skp
       takes keystore [password] as argument
    --ssl-need-client-auth, -snc
       enables SSL 'needClientAuth' flag
       Default: false
    --ssl-port, -sp
       adds SSL transport layer (i.e. 'ldaps' protocol). It takes [portNumber]
       as a parameter and binds the LDAPs server on the port
    --ssl-want-client-auth, -swc
       enables SSL 'wantClientAuth' flag
       Default: false

Examples:

$ java -jar ldap-server.jar users.ldif
Starts LDAP server on port 10389 (all interfaces) and imports users.ldif

$ java -jar ldap-server.jar -sp 10636 users.ldif
Starts LDAP server on port 10389 and LDAPs on port 10636 and imports the LDIF

$ java -jar ldap-server.jar -b 127.0.0.1 -p 389
Starts LDAP server on address 127.0.0.1:389 and imports default data (one user
entry 'uid=jduke,ou=Users,dc=ldap,dc=example'

SSL/TLS

If you want to enable SSL/TLS ('ldaps') and use your own certificate, the generate (or import) the private key into a JKS keystore and provide path to it as argument.

# generate a keypair
keytool -validity 365 -genkey -alias myserver -keyalg RSA -keystore /tmp/ldaps.keystore -storepass 123456 -keypass 123456 -dname cn=myserver.mycompany.com

# use the generated keypair (-skf) with given password (-skp)
# We also enable detail SSL debug information by setting javax.net.debug system property.
java -Djavax.net.debug=all -jar target/ldap-server.jar -sp 1038389 -skf /tmp/ldaps.keystore -skp 123456

Default LDIF

version: 1

dn: dc=ldap,dc=example
dc: ldap
objectClass: top
objectClass: domain

dn: ou=Users,dc=ldap,dc=example
objectClass: organizationalUnit
objectClass: top
ou: Users

dn: uid=jduke,ou=Users,dc=ldap,dc=example
objectClass: top
objectClass: person
objectClass: inetOrgPerson
cn: Java Duke
sn: duke
uid: jduke
userPassword: theduke

dn: ou=Roles,dc=ldap,dc=example
objectclass: top
objectclass: organizationalUnit
ou: Roles

dn: cn=Admin,ou=Roles,dc=ldap,dc=example
objectClass: top
objectClass: groupOfNames
cn: Admin
member: uid=jduke,ou=Users,dc=ldap,dc=example

Deploy/Release

Deploy snapshots

mvn clean install deploy

Release

mvn -Prelease release:prepare
mvn -Prelease release:perform

Sample usage (LDAP search)

The ldapsearch Linux tool is used in the following examples:

$ # Anonymous LDAP search
$ # the 172.17.0.2 is the IP address of the kwart/ldap-server docker container
$  ldapsearch -x -b "dc=ldap,dc=example" -LL -H ldap://172.17.0.2 | head -n 13 
version: 1

dn: ou=Roles,dc=ldap,dc=example
ou: Roles
objectclass: top
objectclass: organizationalUnit

dn: cn=Admin,ou=Roles,dc=ldap,dc=example
cn: Admin
objectclass: top
objectclass: groupOfNames
member: uid=jduke,ou=Users,dc=ldap,dc=example

$ # LDAP search with a user authentication:
$ ldapsearch -x -b "dc=ldap,dc=example" -LL -H ldap://172.17.0.2 -D "uid=jduke,ou=Users,dc=ldap,dc=example" -w theduke | tail -n 10
dn: dc=ldap,dc=example
dc: ldap
objectclass: top
objectclass: domain

dn: ou=Users,dc=ldap,dc=example
ou: Users
objectclass: top
objectclass: organizationalUnit

License

• Apache License, Version 2.0

ldap-server's Issues

Change LDAP Credential

Hello thank you for develop this app. It very useful to me. I have question, how to change security credential? As i read your code, the default SECURITY_CREDENTIALS is 'secret', how to change this ldap server security credential?

Adding examples

Anonymous access:

ldapsearch -x -b "dc=jboss,dc=org"

Admin access:

ldapsearch -x -b "dc=jboss,dc=org" -D "uid=jduke,ou=Users,dc=jboss,dc=org" -W

Interesting to expose that admin is jduke, and password is theduke

Adding more users to default will be interesting too.

Anonymous bind

Hi,

thanks for your work. I want to use the ldap-server for an integration test. In our scenario the real ldap server allows an anonymous bind. Any ideas how I can tweak the ApacheDS to also allow anonymous binds?

This is what currently happens:
$ ldapsearch -v -x -H ldap://localhost:10389 ldap_initialize( ldap://localhost:10389/??base ) ldap_bind: Invalid credentials (49) additional info: INVALID_CREDENTIALS: Bind failed: ERR_229 Cannot authenticate user

Apache Directory Studio refuses connection Docker

Hi there,

first of all thanks for your work. I have a problem, when running the jar i can connect to localhost:10389 with Apache Directory Studio, but when running the docker container it says:

• ERR_04110_CANNOT_CONNECT_TO_SERVER Cannot connect to the server: Connection refused: no further information
  org.apache.directory.ldap.client.api.exception.InvalidConnectionException: ERR_04110_CANNOT_CONNECT_TO_SERVER Cannot connect to the server: Connection refused: no further information
  at org.apache.directory.ldap.client.api.LdapNetworkConnection.close(LdapNetworkConnection.java:756)
  at org.apache.directory.ldap.client.api.LdapNetworkConnection.connect(LdapNetworkConnection.java:951)
  at org.apache.directory.studio.connection.core.io.api.DirectoryApiConnectionWrapper$1.run(DirectoryApiConnectionWrapper.java:234)
  at org.apache.directory.studio.connection.core.io.api.DirectoryApiConnectionWrapper.runAndMonitor(DirectoryApiConnectionWrapper.java:1277)
  at org.apache.directory.studio.connection.core.io.api.DirectoryApiConnectionWrapper.doConnect(DirectoryApiConnectionWrapper.java:268)
  at org.apache.directory.studio.connection.core.io.api.DirectoryApiConnectionWrapper.connect(DirectoryApiConnectionWrapper.java:159)
  at org.apache.directory.studio.connection.core.jobs.OpenConnectionsRunnable.run(OpenConnectionsRunnable.java:111)
  at org.apache.directory.studio.connection.core.jobs.StudioConnectionJob.run(StudioConnectionJob.java:109)
  at org.eclipse.core.internal.jobs.Worker.run(Worker.java:63)
  Caused by: java.net.ConnectException: Connection refused: no further information
  at sun.nio.ch.SocketChannelImpl.checkConnect(Native Method)
  at sun.nio.ch.SocketChannelImpl.finishConnect(Unknown Source)
  at org.apache.mina.transport.socket.nio.NioSocketConnector.finishConnect(NioSocketConnector.java:223)
  at org.apache.mina.transport.socket.nio.NioSocketConnector.finishConnect(NioSocketConnector.java:47)
  at org.apache.mina.core.polling.AbstractPollingIoConnector$Connector.processConnections(AbstractPollingIoConnector.java:571)
  at org.apache.mina.core.polling.AbstractPollingIoConnector$Connector.run(AbstractPollingIoConnector.java:456)
  at org.apache.mina.util.NamePreservingRunnable.run(NamePreservingRunnable.java:64)
  at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
  at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
  at java.lang.Thread.run(Unknown Source)

ERR_04110_CANNOT_CONNECT_TO_SERVER Cannot connect to the server: Connection refused: no further information

Do you have suggestion how to fix it?

How to log LDAP request query details?

Hi, this project has been very handy in cases where I need a quick LDAP for testing, but I've been trying to enable request query details.

I tried doing it by messing around with the logging configuration without luck:

LOG_LEVEL=DEBUG
java -Dorg.slf4j.simpleLogger.log.org.apache.directory.server.ldap.handlers.SearchHandler=$LOG_LEVEL -Dorg.slf4j.simpleLogger.log.org.apache.directory.server.ldap.handlers.AddHandler=$LOG_LEVEL -Dorg.slf4j.simpleLogger.log.org.apache.directory.server.ldap.handlers.DeleteHandler=$LOG_LEVEL -Dorg.slf4j.simpleLogger.log.org.apache.directory.server.ldap.handlers.ModifyHandler=$LOG_LEVEL -Dorg.slf4j.simpleLogger.log.org.apache.directory.server.ldap.handlers.ModifyDnHandler=$LOG_LEVEL -jar ldap-server.jar users.ldif --port 386

I can make changes to the code, but if there's a way to use your great work as is via configuration, it would be much better. Thanks.

TransportContext.java:352|Fatal (HANDSHAKE_FAILURE): no cipher suites in common ( "throwable"

Tried to run ldaps on Ubuntu but it does not work, ldap - ok.

Environment:
oc: Ubuntu 22.04.1
OS name: "linux", version: "6.5.0-28-generic", arch: "amd64", family: "unix"
ldap-server version: v.1.0.0
openjdk 11.0.22
Apache Maven 3.6.3

Steps:

1. Create key store:
   keytool -validity 365 -genkey -alias lda-example -keyalg RSA -keystore ../ldap-ad-it/keystore/ldap.example.keystore -storepass 1Q2w3e4r -keypass 1Q2w3e4r -dname cn=ldap.example
2. Run server:
   java -Djavax.net.debug=all -jar target/ldap-server.jar -sp 10636 -skf ../ldap-ad-it/keystore/ldap.example.keystore -skp 1Q2w3e4r
3. Run client
   LDAPTLS_REQCERT=never ldapsearch -H ldaps://ldap.example:10636 -x -b "ou=users,dc=ldap,dc=example" -D "uid=admin,ou=system" -w secret

Expected result:
some data from ldap request

Actual Result:
ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

Attached you can find ldap server log:

HANDSHAKE_FAILURE.txt

Attribute types are in lowercase within searchResEntry

Attribute types in search response have all letters in lowercase. Expecting "memberOf" but got "memberof". Also expecting user defined type "userAthorizationScope" but got "userauthorizationscope". Attribute values have the expected letter cases.

Can SearchResultEntryHandler be used to intercept and change results?

Hi, congratulations for this project!

In the ServerLdap class I've added several handlers, after the .start(), line ~113:
-> ldapServer.start();
-> ldapServer.setAddHandlers(new UCAddRequestHandler(), new AddResponseHandler()); <- NEW
-> ldapServer.setSearchHandlers(new UCSearchRequestHandler(), new UCSearchResultEntryHandler(), new SearchResultReferenceHandler(), new SearchResultDoneHandler()); <- NEW

The add request work fine, I can change the request before adding to the "DB"! Same for the search request.
public class UCAddRequestHandler extends AddRequestHandler {
@OverRide
public void handle(LdapSession session, AddRequest req) {
Entry entry = req.getEntry();
entry.setDn(UCUtils.replaceDn(entry.getDn())); //some change in the Dn
super.handle(session, req);
}
}

But the I was no able to change the result from the search before sending it to the application:
public class UCSearchResultEntryHandler extends SearchResultEntryHandler {
@OverRide
public void handle(LdapSession session, SearchResultEntry result) throws Exception {
Entry entry = result.getEntry();
entry.setDn(UCUtils.revertDn(entry.getDn())); //for example, reverting the change made in the AddRequest.
super.handle(session, result);
}
}
The application receives allways the data that is stored in the DB, the "revert" is ignored.
Could you help?

Best Regards,
Nuno Ferreira.

How can I make the data persistent on the disk?

Hello,
Thanks for this ldap server,

I'm working on an ldap server than can be used as plugin based on your ldap server, I would like to know how can I store the data on disk permanently (not in-memory)?

Start TLS - Unrecognized extended operation

Hi,

I cannot get StartTLS working. I get errorMessage: Unrecognized extended operation EXTENSION OUT: 1.3.6.1.4.1.1466.20037.

Best Regards,
Nikola

Avoid initial error

[main] WARN org.apache.directory.server.core.DefaultDirectoryService - You didn't change the admin password of directory service instance 'ds'.  Please update the admin password as soon as possible to prevent a possible security breach.

Use a file:

dn: uid=admin,ou=system
changetype: modify
replace: userPassword
userPassword: new-password

ldapmodify -D "uid=admin,ou=system" -W -f password-modify 

current password is secret

Ldaps?

Is there a way to set this test server with ldaps (ssl) connection with some command line options?

Ldap server on Db

Sorry for writing this request as an issue but I don't know were to write it.

I would want to have the same ldap server but not an in memory one but with the default db (which I think is BerkleyDB)

Thank you
Arvit

groupOfUniqueMembers does not exist

Hi, first thanks for the util, it is very helpfull.

When I try to supply a ldif with groupOfUniqueMembers objetcClass it give me this exception:

dn: ou=System, ou=Groups, ou=cpt, dc=ccc, dc=net, dc=br
ou: System
objectclass: organizationalUnit
objectclass: top
objectclass: groupOfMembers

Exception in thread "main" org.apache.directory.api.ldap.model.exception.LdapException: ERR_04269 OBJECT_CLASS for OID g
roupofmembers does not exist!

Went to ApacheDS project page and it is supported, what am I missing?

Best regards.

The project cannot support the test of LDAP injection.

The project cannot support the test of LDAP injection.

Error E04269

Hi,
thanks for your work. I've installed this project as jar on Win7 and run (with JDK 1.7 64 bit) as
java -jar ldap-server.jar -b 0.0.0.0 -p 389 conf.ldif
and It works perfectly: the Ldap server start in a few second

I've installed same jar on Centos 6.5 64 bit and run it with JDK 1.7 using the same command, but Ldap Server not start and the output is:

[main] WARN org.apache.directory.api.ldap.model.entry.DefaultEntry - The attribute 'samaaccountname' cannot be stored
Exception in thread "main" org.apache.directory.api.ldap.model.exception.LdapNoSuchAttributeException: ERR_04269 ATTRIBUTE_TYPE for OID samaaccountname does not exist!
        at org.apache.directory.api.ldap.model.schema.registries.DefaultAttributeTypeRegistry.lookup(DefaultAttributeTypeRegistry.java:293)
        at org.apache.directory.api.ldap.model.schema.registries.DefaultAttributeTypeRegistry.lookup(DefaultAttributeTypeRegistry.java:47)
        at org.apache.directory.api.ldap.schema.manager.impl.DefaultSchemaManager.lookupAttributeTypeRegistry(DefaultSchemaManager.java:1604)
        at org.apache.directory.api.ldap.model.entry.DefaultEntry.<init>(DefaultEntry.java:311)
        at org.jboss.test.ldap.LdapServer.importLdif(LdapServer.java:142)
        at org.jboss.test.ldap.LdapServer.importLdif(LdapServer.java:132)
        at org.jboss.test.ldap.LdapServer.<init>(LdapServer.java:88)
        at org.jboss.test.ldap.LdapServer.main(LdapServer.java:69)
Caused by: org.apache.directory.api.ldap.model.exception.LdapException: ERR_04269 ATTRIBUTE_TYPE for OID samaaccountname does not exist!
        at org.apache.directory.api.ldap.model.schema.registries.DefaultSchemaObjectRegistry.lookup(DefaultSchemaObjectRegistry.java:176)
        at org.apache.directory.api.ldap.model.schema.registries.DefaultAttributeTypeRegistry.lookup(DefaultAttributeTypeRegistry.java:289)
        ... 7 more

The jar and conf.ldif are the same on Win7 and Centos 6.5, so I don't know why the jar do not work on Linux.
I don't know if I've forgotten some configuration/requirements needed for installation on Linux.

Thanks in advance for help.

Docker README has inaccurate instructions for how to load a custom LDIF on startup

Hey there, thanks for making this available 🙏 Very useful for unit testing 👍

I wanted to load my custom LDIF, and followed the instructions from the Docker README:

docker run -it --rm \
    -p 10389:10389 \
    -v `pwd`:/mnt \
    kwart/ldap-server \
    java -jar ldap-server.jar /mnt/custom.ldif

However, this does seem to re-use the command when running it from source, but inside the container the java -jar ldap-server.jar is already happening, so to load a custom LDIF you do:

docker run -it --rm \
    -p 10389:10389 \
    -v `pwd`:/mnt \
    kwart/ldap-server \
    /mnt/custom.ldif

Not the end of the world obviously, but a small docs improvement, and perhaps this issue can help others who face a similar problem.

Thanks again.