phpLDAPadmin

Prerequisites

You need:

• An active Azure subscription.
• An SSH key pair.
• A VNet and subnet in the target region.
• A VM size. Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point. Step up to Standard_D2s_v3 for larger directories or more concurrent administrators.
• NSG inbound rules that allow 22/tcp from your management network and 80/tcp for the phpLDAPadmin web interface. Add 443/tcp if you terminate TLS on the VM.

The directory service is never exposed. slapd listens on 127.0.0.1 only, so port 389 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal and choose Create a resource. Search the Marketplace for phpLDAPadmin by SecureAnyCloud, and select Create.

On Basics, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80). Then choose Review + create, then Create.

Step 2 - Deploy from the Azure CLI

Accept the Marketplace terms once per subscription, then create the VM.

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:phpldapadmin-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name phpldapadmin \
  --image sac1647283583153:phpldapadmin-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open port 80.

az vm open-port --resource-group <your-rg> --name phpldapadmin --port 80

Step 3 - Confirm the services are running

SSH in as azureuser and confirm that the directory backend and the web interface are both active. slapd listens only on 127.0.0.1:389, while Apache serves phpLDAPadmin on port 80.

systemctl is-active slapd apache2

ss -tlnp | grep -E ':389 |:80 ' | sed 's/ */ /g'

Step 4 - Retrieve the per-VM credentials

Every VM generates its own secrets on first boot. It writes them, along with the login account and the application URL, to a root-only credentials file. Confirm that the file is present and root-only, then read the non-secret fields.

sudo ls -l /root/phpldapadmin-credentials.txt

sudo grep -vE 'pass=' /root/phpldapadmin-credentials.txt

To read the login password itself, print just that line.

sudo grep '^phpldapadmin.login.pass=' /root/phpldapadmin-credentials.txt | cut -d= -f2-

Sign in to phpLDAPadmin with the User ID ldapadmin and that password. The account is a real directory entry (uid=ldapadmin,ou=People,dc=sac,dc=local) with full write access to the tree. The application authenticates your sign-in by binding to the directory with the credentials you type.

The separate phpldapadmin.rootdn.pass value is the OpenLDAP manager (cn=admin) password, used for command-line administration on the VM. The manager is not a directory entry, so you cannot use it to sign in to the web interface.

Step 5 - Sign in

Browse to http://<vm-public-ip>/. An unauthenticated visitor is redirected straight to the sign-in form, so nothing in the directory is browsable until you authenticate.

After you sign in, you land on the home page. The directory tree for dc=sac,dc=local is in the navigation panel, with the server details alongside it.

Step 6 - Browse and edit the directory

Expand dc=sac,dc=local in the tree to reach the ou=People and ou=Groups containers. Select an entry to open the entry viewer. It lists every attribute on that object alongside the object classes it belongs to, so you can see exactly what the directory holds.

The same view lets you edit attribute values in place and commit them to the directory. The tree also shows the containers and groups the image seeded for you. Use the create and import options to add your own entries or load an LDIF file.

Step 7 - No known or default credentials

Nothing in this image ships with a known or blank password. The directory administrator web login password, the OpenLDAP manager password and the application session encryption key are each rotated to a discarded random value at build time. Each is regenerated as a unique random secret on the first boot of every VM.

You can prove the credential end to end on the VM. The per-VM password binds, and a wrong password is rejected. The bundled round-trip check confirms both, plus a real web sign-in through the application's own login form.

DN="$(sudo grep '^phpldapadmin.login.dn=' /root/phpldapadmin-credentials.txt | cut -d= -f2-)" PW="$(sudo grep '^phpldapadmin.login.pass=' /root/phpldapadmin-credentials.txt | cut -d= -f2-)" sudo ldapwhoami -x -H ldap://127.0.0.1 -D "$DN" -w "$PW"

sudo ldapwhoami -x -H ldap://127.0.0.1 -D "uid=ldapadmin,ou=People,dc=sac,dc=local" -w 'definitely-the-wrong-password' || echo "wrong password correctly rejected"

sudo bash /usr/local/sbin/phpldapadmin-cred-roundtrip.sh

The application also refuses to serve anything to an anonymous visitor, and its source tree is not reachable over HTTP. Confirm both.

curl -s -o /dev/null -w 'GET / -> %{http_code} %{redirect_url}\n' http://127.0.0.1/

curl -s -o /dev/null -w 'GET /.env -> %{http_code}\n' http://127.0.0.1/.env

Step 8 - Verify the directory and where your data lives

Confirm the loopback binding and inspect the seeded directory. The whole directory (OpenLDAP mdb backend) lives on the single OS disk under /var/lib/ldap, and the application lives under /opt/phpldapadmin. The directory is never reachable from outside the instance.

curl -sI http://127.0.0.1/healthz | head -1

sudo ldapsearch -x -H ldap://127.0.0.1 -D "cn=admin,dc=sac,dc=local" -w "$(sudo grep '^phpldapadmin.rootdn.pass=' /root/phpldapadmin-credentials.txt | cut -d= -f2-)" -b "dc=sac,dc=local" -LLL dn

ss -tlnp | grep ':389 ' | sed 's/ */ /g'

Server components

The image installs these components.

• phpLDAPadmin 2.3.11, in /opt/phpldapadmin.
• OpenLDAP (slapd), the Ubuntu 24.04 package, with data in /var/lib/ldap and configuration in cn=config.
• Apache HTTP Server, the Ubuntu 24.04 package, configured in /etc/apache2/sites-available/sac-phpldapadmin.conf.
• PHP 8.4, in /etc/php/8.4.

Filesystem layout

These paths matter for administration.

• /opt/phpldapadmin is the application root. Apache serves only the public subdirectory.
• /opt/phpldapadmin/.env holds the application configuration, readable only by root and the web user.
• /var/lib/ldap holds the OpenLDAP mdb directory database.
• /var/lib/sac holds the first-boot sentinel.
• /root/phpldapadmin-credentials.txt holds the per-VM credentials, mode 0600.
• /var/log/apache2 holds the web server access and error logs.

Managing the services

Use systemd to check and restart the directory backend and the web server.

systemctl status slapd --no-pager

sudo systemctl restart apache2

Adding your own domain and TLS

phpLDAPadmin serves plain HTTP on port 80. To add TLS, point a DNS record at your VM and obtain a certificate with Let's Encrypt.

sudo apt-get install -y certbot python3-certbot-apache
sudo certbot --apache -d <your-domain>

After the certificate is issued, update the application's own base URL so generated links use your domain. Then rebuild its configuration cache.

sudo sed -i 's|^APP_URL=.*|APP_URL="https://<your-domain>"|' /opt/phpldapadmin/.env
sudo /usr/bin/php8.4 /opt/phpldapadmin/artisan config:cache
sudo systemctl reload apache2

Backing up

Your directory data is the OpenLDAP database plus its configuration. Export both to LDIF with slapcat.

sudo slapcat -n 0 -l /tmp/phpldapadmin-config-backup.ldif
sudo slapcat -n 1 -l /tmp/phpldapadmin-directory-backup.ldif

Copy both files off the VM on your usual schedule, together with /opt/phpldapadmin/.env.

To restore onto a fresh instance, stop slapd, reload the LDIF with slapadd, and restore the configuration file.

Troubleshooting

The sign-in form rejects the password. Confirm that you are using the ldapadmin User ID and the phpldapadmin.login.pass value, not the phpldapadmin.rootdn.pass value. The OpenLDAP manager (cn=admin) is not a directory entry, so by design it cannot sign in to the web interface. Verify that the credential binds directly with the ldapwhoami command in Step 7.

The web interface returns a 500 error. Check the application log and the Apache error log, then rebuild the configuration cache.

sudo tail -20 /var/log/apache2/phpldapadmin-error.log

First boot has not completed. If the credentials file still shows its initial text instead of real values, the first-boot service has not finished. Check its status.

systemctl status phpldapadmin-firstboot.service --no-pager

Security notes

• phpLDAPadmin serves plain HTTP on port 80 out of the box. For anything beyond a trusted network, add your own domain and TLS as described above, or front the VM with Azure Application Gateway.
• OpenLDAP listens on 127.0.0.1 only and is never reachable from the network. The application talks to it locally. Administer the directory through the web interface or over SSH.
• Every secret is unique per VM, and no known or blank credential authenticates. Keep /root/phpldapadmin-credentials.txt protected.
• The image stores no LDAP bind credential of its own. The application holds no directory password in its configuration and binds with the credentials you type at sign-in.
• The two sample accounts (jsmith, agarcia) and the demoteam group exist only to populate the interface, and they carry discarded random passwords. Delete them once you have added your own entries.
• Apply operating system updates regularly with sudo apt update && sudo apt upgrade. Unattended security updates are enabled by default.

Support

For assistance, contact SecureAnyCloud support.

• Email: sales@secureanycloud.com
• Response time: 24/7, with a one-hour average response for critical issues
• Website: https://secureanycloud.com

Deploy on Azure

Launch phpLDAPadmin on Ubuntu 24.04 LTS on Azure, with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com