domaindir/ubuntu-symasldap-saslauth repository overview

⁠Ubuntu Symas OpenLDAP with SASL Authentication

This repository provides a production-ready, containerized OpenLDAP server. It is built upon an Ubuntu 22.04 LTS (Jammy Jellyfish) base image, utilizes the enterprise-grade Symas OpenLDAP 2.6.13 binaries, and integrates saslauthd for advanced Simple Authentication and Security Layer (SASL) pass-through authentication.

⁠🐧 Why Ubuntu 22.04 LTS Base?

While Symas provides their own minimal images, migrating to an Ubuntu 22.04 base image provides distinct administrative advantages:

• Security & Stability: Leveraging Canonical's Long Term Support (LTS) ensures predictable CVE patching for the OS layer until 2027.
• Troubleshooting: It provides a familiar, standard Linux environment (apt, systemd structures, standard glibc) making it drastically easier to debug network layers, certificate chains, and file permissions using standard Linux tooling.
• Compatibility: Native compatibility with standard monitoring, logging, and security agents that expect a standard Debian-based filesystem hierarchy.

⁠⚙️ Symas OpenLDAP Specifics

Symas OpenLDAP is a highly optimized, commercially backed build of the open-source LDAP directory server. Unlike standard Linux distribution packages (which often lag years behind), Symas provides the latest 2.6.x features, including the highly performant Memory-Mapped Database (back_mdb) and modern replication mechanisms.

⁠Symas Directory Structure

Because Symas compiles OpenLDAP independently to avoid conflicting with OS-level LDAP libraries, the paths differ significantly from standard Ubuntu /etc/ldap/ deployments.

When mounting volumes or editing configurations, you must use the following Symas-specific directories:

⁠🔐 SASL Integration (saslauthd)

This image extends the base LDAP functionality by running saslauthd alongside slapd. This allows OpenLDAP to delegate credential verification to external systems (e.g., Active Directory, PAM, or another LDAP server) using pass-through authentication.

• Configuration Files:
  • (1) Mount your own domain specific configuration into /etc/saslauthd.conf
  • (2) Mount your own domain specific configuration into /opt/symas/etc/openldap/slapd.conf
  • (3) Default value for testing purposes baked into /etc/ldap/ldap.conf
  • (4) Default value for testing purposes baked into /usr/lib/sasl2/slapd.conf
• Socket Path: The SASL mux socket is created at /var/run/saslauthd.
• Permissions: The entrypoint script automatically configures group permissions (chgrp openldap) so the slapd process can securely communicate with the saslauthd daemon without running as root.

⁠🚀 Usage

Running the Container:

docker run -d \
  --name ldap-sasl-server \
  -p 389:389 \
  -v /path/to/your/slapd.conf:/opt/symas/etc/openldap/slapd.conf:ro \
  -v /path/to/your/data:/var/symas/openldap-data \
  docker.io/domaindir/ubuntu-symasldap-saslauth:2.6.13