caoool/wecom-ldap-sync repository overview

⁠wecom-ldap-sync

Open-source Docker service that mirrors your WeCom (企业微信) directory into OpenLDAP. It syncs departments, users, common LDAP attributes, generated emails, and default passwords on a configurable schedule. Designed for self-hosted SSO, VPN, internal tools, and unified identity management.

⁠What it does

• Pulls departments and users from WeCom via a self-built app (自建应用) with contacts read permission
• Creates a matching OU hierarchy in LDAP
• Syncs user attributes such as name, position/title, alias, department, and email
• Sets an SSHA-hashed default password for new LDAP users and existing users without a password
• Runs on a configurable schedule, defaulting to every 30 minutes
• Supports dry-run mode and optional orphan cleanup

⁠Quick start

cp .env.example .env
# Edit .env with your LDAP and WeCom settings
docker compose up -d

The sync runs once on startup, then on the configured interval. Tail logs with:

docker compose logs -f wecom-ldap-sync

⁠Links

• GitHub: https://github.com/caoool/sync-ldap⁠
• Documentation: https://caoool.github.io/sync-ldap/⁠
• Architecture notes: https://github.com/caoool/sync-ldap/blob/main/docs/architecture.md⁠
• Promotion kit: https://github.com/caoool/sync-ldap/blob/main/docs/promotion.md⁠

⁠Feedback wanted

If you use WeCom with LDAP, SSO, VPN, or self-hosted internal apps, please share which LDAP attributes and edge cases matter in your setup.