OpenLDAP with phpLDAPadmin

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting size. Step up to Standard_D2s_v3 for larger directories or more concurrent administrators.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the phpLDAPadmin web interface. Add 443/tcp if you terminate TLS on the VM. The directory service is never exposed: slapd listens on 127.0.0.1 only, so port 389 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for OpenLDAP with phpLDAPadmin by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:openldap-phpldapadmin:default:latest
az vm create \
  --resource-group <your-rg> \
  --name openldap-phpldapadmin \
  --image sac1647283583153:openldap-phpldapadmin:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open port 80 for the web interface:

az vm open-port --resource-group <your-rg> --name openldap-phpldapadmin --port 80

Step 3 - Confirm the services are running

SSH in as azureuser and confirm that the directory backend and the web interface are both active. slapd listens only on 127.0.0.1:389, while Apache serves phpLDAPadmin on port 80.

systemctl is-active slapd apache2

ss -tlnp | grep -E ':389 |:80 ' | sed 's/ */ /g'

Step 4 - Retrieve the per-VM credentials

Every VM generates its own secrets on first boot. It writes them, along with the login account and the application URL, to a root-only credentials file. Confirm that the file is present and root-only, then read the non-secret fields:

sudo ls -l /root/phpldapadmin-credentials.txt

sudo grep -vE 'pass=' /root/phpldapadmin-credentials.txt

To read the login password itself, print just that line:

sudo grep '^phpldapadmin.login.pass=' /root/phpldapadmin-credentials.txt | cut -d= -f2-

Sign in to phpLDAPadmin with the User ID ldapadmin and that password. This account is a real directory entry (uid=ldapadmin,ou=People,dc=sac,dc=local) with full write access to the tree. The application authenticates your sign-in by binding to the OpenLDAP directory with the credentials you type.

The separate phpldapadmin.rootdn.pass value is the OpenLDAP manager (cn=admin) password, used for command-line administration on the VM. The manager is not a directory entry, so it cannot be used to sign in to the web interface.

Step 5 - Sign in

Browse to http://<vm-public-ip>/. An unauthenticated visitor is redirected straight to the sign-in form, so nothing in the directory is browsable until you authenticate.

After you sign in, the home page opens with the OpenLDAP directory tree for dc=sac,dc=local in the navigation panel and the server details alongside it.

Step 6 - Browse and edit the directory

Expand dc=sac,dc=local in the tree to reach the ou=People and ou=Groups containers. Expand ou=People to see the seeded accounts.

Select an entry to open the entry viewer. It lists every attribute on that object alongside the object classes it belongs to, so you can see exactly what the directory holds. The same view lets you edit attribute values in place and commit them to the directory.

Use the create and import options to add your own entries or load an LDIF file.

Step 7 - No known or default credentials

Nothing in this image ships with a known or blank password. The directory administrator web login password, the OpenLDAP manager (cn=admin) password and the application session encryption key are each rotated to a discarded random value at build time. Each is regenerated as a unique random secret on the first boot of every VM.

The OpenLDAP configuration backend (cn=config) is administered only by the root user, over the local ldapi:/// socket, and carries no password at all.

You can verify the credential end to end on the VM. The per-VM password binds, a wrong password is rejected, and the bundled round-trip check confirms both, plus a real web sign-in through the application's own login form.

DN="$(sudo grep '^phpldapadmin.login.dn=' /root/phpldapadmin-credentials.txt | cut -d= -f2-)" PW="$(sudo grep '^phpldapadmin.login.pass=' /root/phpldapadmin-credentials.txt | cut -d= -f2-)" sudo ldapwhoami -x -H ldap://127.0.0.1 -D "$DN" -w "$PW"

sudo ldapwhoami -x -H ldap://127.0.0.1 -D "uid=ldapadmin,ou=People,dc=sac,dc=local" -w 'definitely-the-wrong-password' || echo "wrong password correctly rejected"

sudo bash /usr/local/sbin/phpldapadmin-cred-roundtrip.sh

The application also refuses to serve anything to an anonymous visitor, and its source tree is not reachable over HTTP. Confirm both:

curl -s -o /dev/null -w 'GET / -> %{http_code} %{redirect_url}\n' http://127.0.0.1/

curl -s -o /dev/null -w 'GET /.env -> %{http_code}\n' http://127.0.0.1/.env

Step 8 - Verify the directory and where your data lives

Confirm the loopback binding and inspect the seeded directory. The whole directory (OpenLDAP mdb backend) lives on the single OS disk under /var/lib/ldap, and the application lives under /opt/phpldapadmin. The directory is never reachable from outside the instance:

curl -sI http://127.0.0.1/healthz | head -1

sudo ldapsearch -x -H ldap://127.0.0.1 -D "cn=admin,dc=sac,dc=local" -w "$(sudo grep '^phpldapadmin.rootdn.pass=' /root/phpldapadmin-credentials.txt | cut -d= -f2-)" -b "dc=sac,dc=local" -LLL dn

ss -tlnp | grep ':389 ' | sed 's/ */ /g'

Server components

Component Version Location

OpenLDAP (slapd) 2.6.10 /var/lib/ldap, config in cn=config

phpLDAPadmin 2.3.11 /opt/phpldapadmin

Apache HTTP Server Ubuntu 24.04 package /etc/apache2/sites-available/sac-phpldapadmin.conf

PHP 8.4 /etc/php/8.4

Filesystem layout

Path Description

/var/lib/ldap OpenLDAP mdb directory database

/opt/phpldapadmin Application root; Apache serves only the public subdirectory

/opt/phpldapadmin/.env Application configuration, root only readable by the web user

/var/lib/sac First-boot sentinel

/root/phpldapadmin-credentials.txt Per-VM credentials, mode 0600

/var/log/apache2 Web server access and error logs

Managing the services

systemctl status slapd --no-pager

sudo systemctl restart apache2

Adding your own domain and TLS

phpLDAPadmin serves plain HTTP on port 80. For production, point a DNS record at your VM and obtain a certificate from Let's Encrypt:

sudo apt-get install -y certbot python3-certbot-apache
sudo certbot --apache -d <your-domain>

After the certificate is issued, update the application's base URL so that generated links use your domain, then rebuild its configuration cache:

sudo sed -i 's|^APP_URL=.*|APP_URL="https://<your-domain>"|' /opt/phpldapadmin/.env
sudo /usr/bin/php8.4 /opt/phpldapadmin/artisan config:cache
sudo systemctl reload apache2

Backing up

Your directory data is the OpenLDAP database plus its configuration. Export both to LDIF with slapcat:

sudo slapcat -n 0 -l /tmp/openldap-config-backup.ldif
sudo slapcat -n 1 -l /tmp/openldap-directory-backup.ldif

Copy both files off the VM on your usual schedule, together with /opt/phpldapadmin/.env. To restore onto a fresh instance, stop slapd, reload the LDIF with slapadd and restore the configuration file.

Troubleshooting

The sign-in form rejects the password. Confirm that you are using the ldapadmin User ID and the phpldapadmin.login.pass value, not the phpldapadmin.rootdn.pass value. The OpenLDAP manager (cn=admin) is not a directory entry, so by design it cannot sign in to the web interface. To verify that the credential binds directly, use the ldapwhoami command in Step 7.

The web interface returns a 500 error. Check the application log and the Apache error log, then rebuild the configuration cache:

sudo tail -20 /var/log/apache2/phpldapadmin-error.log

First boot has not completed. If the credentials file does not yet contain your generated values, the first-boot service has not finished. Check its status with:

systemctl status phpldapadmin-firstboot.service --no-pager

Security notes

• Encrypt web traffic. phpLDAPadmin serves plain HTTP on port 80 out of the box. For anything beyond a trusted network, add your own domain and TLS as described above, or front the VM with Azure Application Gateway.
• Keep OpenLDAP private. It listens on 127.0.0.1 only and is never reachable from the network. The application talks to it locally. Administer the directory through the web interface or over SSH.
• Protect the per-VM secrets. Every secret is unique per VM, and no known or blank credential authenticates. Keep /root/phpldapadmin-credentials.txt protected.
• No stored bind credential. The image stores no LDAP bind credential of its own. The application holds no directory password in its configuration and binds with the credentials you type at sign-in.
• Remove the sample accounts. The two sample accounts (jsmith, agarcia) and the demoteam group exist only to populate the interface and carry discarded random passwords. Delete them once you have added your own entries.
• Keep the VM patched. Apply operating system updates regularly with sudo apt update && sudo apt upgrade. Unattended security updates are enabled by default.

Support

For assistance, contact SecureAnyCloud support:

• Email: sales@secureanycloud.com
• Response time: 24/7, with a one-hour average response for critical issues
• Website: https://secureanycloud.com

Deploy on Azure

Launch OpenLDAP with phpLDAPadmin on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com