LDAP Account Manager

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting size. Step up to Standard_D2s_v3 for larger directories or more concurrent administrators.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the LAM web interface. Add 443/tcp if you terminate TLS on the VM. The directory service is never exposed: slapd listens on 127.0.0.1 only, so port 389 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for LDAP Account Manager by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:ldap-account-manager-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name lam \
  --image sac1647283583153:ldap-account-manager-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open port 80:

az vm open-port --resource-group <your-rg> --name lam --port 80

Step 3 - Confirm the services are running

SSH in as azureuser and confirm that the directory backend and the web interface are both active. slapd listens only on 127.0.0.1:389, while Apache serves LAM on port 80.

systemctl is-active slapd apache2

ss -tlnp | grep -E ':389 |:80 ' | sed 's/ */ /g'

Step 4 - Retrieve the per-VM credentials

Each VM generates its own secrets on first boot. It writes them, along with the login DN and the application URL, to a root-only credentials file. Read it with sudo:

sudo cat /root/ldap-account-manager-credentials.txt

To sign in to LAM, choose the cn=admin,dc=sac,dc=local entry and enter lam.login.pass from this file. That value is the OpenLDAP directory manager password, and LAM authenticates your login by binding to the directory with it.

The lam.master.pass and lam.profile.pass values guard LAM's own configuration editors. You do not need them for day-to-day account management.

Step 5 - Sign in

Browse to http://<vm-public-ip>/. The LAM sign-in page opens, with the directory manager DN in a dropdown and a password field.

After you sign in, LAM opens the account list. The Users tab lists the accounts under ou=People, pre-populated with the two sample accounts so you can see the layout straight away.

Step 6 - Manage users and groups

Click a user to open the account editor. Each tab (Personal, Unix and others, depending on the active modules) exposes the attributes for that account. Use New user to create accounts and the account profiles to create consistent new accounts. Use New group under the Groups tab to manage ou=Groups. Every change is written straight into the directory.

The Groups tab lists the groups under ou=Groups, pre-populated with the sample demoteam group. LAM keeps group membership in step with your users. The Tools menu also offers a raw tree view for inspecting objects and attributes that the typed editors do not show.

Step 7 - No known or default credentials

No known or blank password ships in this image. The directory manager (cn=admin) password, the LAM master configuration password and the LAM server profile password are each rotated to a discarded random value at build time. Each is regenerated as a unique random secret on the first boot of every VM.

You can prove the directory manager credential end to end on the VM. The per-VM password binds, a wrong password is rejected, and the bundled round-trip check confirms both in one step:

DN="$(sudo grep '^lam.login.dn=' /root/ldap-account-manager-credentials.txt | cut -d= -f2-)" PW="$(sudo grep '^lam.login.pass=' /root/ldap-account-manager-credentials.txt | cut -d= -f2-)" sudo ldapwhoami -x -H ldap://127.0.0.1 -D "$DN" -w "$PW"

sudo ldapwhoami -x -H ldap://127.0.0.1 -D "cn=admin,dc=sac,dc=local" -w 'definitely-the-wrong-password' || echo "wrong password correctly rejected"

sudo bash /usr/local/sbin/lam-cred-roundtrip.sh

Step 8 - Verify the directory and where your data lives

Confirm the loopback binding and inspect the seeded directory. The whole directory (OpenLDAP mdb backend) lives on the single OS disk under /var/lib/ldap. LAM's configuration lives under /etc/ldap-account-manager and /var/lib/ldap-account-manager. The directory is never reachable from outside the instance.

curl -sI http://127.0.0.1/healthz | head -1

sudo ldapsearch -x -H ldap://127.0.0.1 -D "cn=admin,dc=sac,dc=local" -w "$(sudo grep '^lam.login.pass=' /root/ldap-account-manager-credentials.txt | cut -d= -f2-)" -b "dc=sac,dc=local" -LLL dn

ss -tlnp | grep ':389 ' | sed 's/ */ /g'

Adding your own domain and TLS

LAM serves plain HTTP on port 80. For production, point a DNS record at your VM and obtain a certificate with Let's Encrypt:

sudo apt-get install -y certbot python3-certbot-apache
sudo certbot --apache -d <your-domain>

LAM derives its base URL from the request Host header. Once you reach the VM on your domain over HTTPS, the pages render correctly with no further change.

Backing up

Your directory data is the OpenLDAP database plus its configuration. Export both to LDIF with slapcat, then archive LAM's configuration:

sudo slapcat -n 0 -l /tmp/lam-config-backup.ldif
sudo slapcat -n 1 -l /tmp/lam-directory-backup.ldif

Copy both files off the VM on your usual schedule, together with /etc/ldap-account-manager and /var/lib/ldap-account-manager/config.

To restore onto a fresh instance, stop slapd, reload the LDIF with slapadd and restore the LAM configuration directories.

Security notes

• Encrypt web traffic. LAM serves plain HTTP on port 80 out of the box. For anything beyond a trusted network, add your own domain and TLS as above, or front the VM with Azure Application Gateway.
• Keep OpenLDAP private. It listens on 127.0.0.1 only and is never reachable from the network. LAM talks to it locally. Administer the directory through LAM or over SSH.
• Protect the secrets. Every secret is unique per VM, and no known or blank credential authenticates. Keep /root/ldap-account-manager-credentials.txt protected. To rotate the directory manager password from the VM, generate a new hash and apply it to the directory configuration:

NEWHASH="$(slappasswd -h '{SSHA}' -s '<new-password>')"
sudo ldapmodify -Y EXTERNAL -H ldapi:/// <<EOF dn: olcDatabase={1}mdb,cn=config changetype: modify replace: olcRootPW olcRootPW: $NEWHASH EOF

• Remove the sample accounts. The two sample accounts (jsmith, agarcia) and the demoteam group exist only to populate the interface, and they carry discarded random passwords. Delete them from LAM once you have added your own accounts.
• Keep the VM patched. Apply operating system updates regularly with sudo apt update && sudo apt upgrade. Unattended security updates are enabled by default.

Deploy on Azure

Launch LDAP Account Manager on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com