Sold by: cloudimg
Deployed on AWS
Free Trial
AWS Free Tier
This product has charges associated with it for seller support. Pre-hardened LDAP identity server with web admin UI. Unique credentials per instance, TLS by default, and dedicated storage - ready to back your self-hosted SSO in minutes with 24/7 cloudimg support.
Overview
Image
Manage users in the web admin UI
Image
Edit a user account
Image
Model teams as LDAP groups
This is a repackaged open source software product wherein additional charges apply for cloudimg support services.
Overview
LLDAP (Light LDAP) is a lightweight, self-hosted authentication server that speaks LDAP and ships with a friendly web admin UI for managing users and groups. It is an opinionated, easy alternative to OpenLDAP or Active Directory for small and mid-size self-hosted deployments, acting as a single identity backbone for the many applications that already speak LDAP - Nextcloud, Gitea, Grafana, Jellyfin, Portainer and more. This AMI delivers LLDAP fully installed, hardened and running so you have a working identity backend within minutes of launch.
The upstream LLDAP project has earned over 4,000 stars on GitHub, reflecting strong community trust in its design and reliability.
Why This Image vs a Manual Install
This image eliminates the manual binary installation, systemd unit authoring, reverse-proxy and TLS setup, and credential hardening a manual install requires. LLDAP's own examples ship with well-known placeholder secrets (admin password, JWT secret and key seed); this image never keeps them. Everything that would otherwise take several steps across download, service configuration and security hardening is completed for you at image build time. Launch the instance, read your unique credential, and start creating users and groups.
Application Stack
LLDAP is a single self-contained Rust binary with an embedded SQLite datastore. It serves an LDAP endpoint for downstream services and a web admin UI for managing users and groups. The web admin UI is bound to the loopback interface only and is fronted by an nginx reverse proxy that terminates TLS on port 443; the raw web port is never exposed off-box. systemd starts LLDAP and nginx on boot and restarts them on failure. The SQLite datastore lives on a dedicated data volume, independently resizable and separate from the OS disk.
Security Hardening
This image follows a defence-in-depth approach:
- Network isolation: the web admin UI binds exclusively to the loopback interface; only the nginx TLS reverse proxy on port 443 is exposed
- TLS by default: a unique self-signed certificate is generated on each instance's first boot; the web admin UI is only served over HTTPS
- No default or shared credentials: a cryptographically random administrator password, JWT signing secret and key seed are generated on each instance's first boot and written only to a root-only file
- No anonymous LDAP: the LDAP endpoint requires bind credentials, so a network probe cannot dump the directory
- Least privilege: the server runs as an unprivileged system user with NoNewPrivileges, ProtectSystem and ProtectHome set
- Dedicated data volume: the directory database lives on its own disk, surviving OS-disk changes and resizable independently
Buyers requiring formal compliance documentation should contact cloudimg to discuss specific requirements.
Concrete Use Cases
- Single sign-on backbone for a self-hosted stack: point Nextcloud, Gitea, Grafana and Jellyfin at one LDAP directory so users have a single set of credentials across every app
- Team and group management: model teams as LDAP groups in the web UI and drive per-app authorization from group membership without editing config files
- Lightweight directory for homelabs and small businesses: run a real LDAP identity server without the operational weight of OpenLDAP or a Windows domain controller
AWS Integration
Deploy on any EC2 instance type. Back up the directory database using EBS snapshots or AWS Backup. Resize the dedicated data volume independently of the OS disk as your directory grows. The security group opens the LDAP port for downstream services within your VPC and port 443 for the web admin UI.
Getting Started
Read your credential from the root-only file, open the web admin UI over HTTPS, sign in, and start creating users and groups. Point your applications at the LDAP endpoint using the admin bind DN, or create a dedicated read-only service account in the UI. For integration planning or a guided pilot setup, contact cloudimg support at any time.
cloudimg Support
24/7 technical support by email and chat. Help with deployment, connecting downstream applications over LDAP, TLS termination with your own domain and certificate, user and group modelling, and backup planning for your directory database.
Highlights
- Ready to use in minutes with zero configuration: this image completes every install and hardening step at build time - binary installation, systemd service, nginx TLS reverse proxy, and credential generation. Launch an EC2 instance and reach a working, authenticated LDAP identity server and web admin UI immediately, with no manual setup required.
- Secure by default with unique-per-instance credentials: every deployment generates its own cryptographically random admin password, JWT secret, key seed and self-signed TLS certificate on first boot. The web admin UI binds exclusively to loopback behind the nginx TLS proxy on port 443. The LDAP endpoint refuses anonymous binds, preventing unauthorized directory enumeration.
- One identity backend for your entire self-hosted stack: manage users and groups from a friendly web UI and point LDAP-aware apps like Nextcloud, Gitea, Grafana, Jellyfin and Portainer at a single directory. The SQLite datastore lives on a dedicated, independently resizable EBS data volume. Backed by 24/7 cloudimg technical support via email and chat.
Details
Sold by
Categories
Delivery method
Delivery option
64-bit (x86) Amazon Machine Image (AMI)
Latest version
Operating system
Ubuntu 24.04
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Free trial
Try this product free for 7 days according to the free trial terms set by the vendor. Usage-based pricing is in effect for usage beyond the free trial terms. Your free trial gets automatically converted to a paid subscription when the trial ends, but may be canceled any time before that.
Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time. Alternatively, you can pay upfront for a contract, which typically covers your anticipated usage for the contract duration. Any usage beyond contract will incur additional usage-based costs.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
If you are an AWS Free Tier customer with a free plan, you are eligible to subscribe to this offer. You can use free credits to cover the cost of eligible AWS infrastructure. See AWS Free Tier for more details. If you created an AWS account before July 15th, 2025, and qualify for the Legacy AWS Free Tier, Amazon EC2 charges for Micro instances are free for up to 750 hours per month. See Legacy AWS Free Tier for more details.
Dimension | Description | Cost/hour |
|---|---|---|
m5.large Recommended | m5.large | $0.08 |
t2.micro | t2.micro instance type | $0.04 |
t3.micro | t3.micro instance type | $0.04 |
c5a.12xlarge | c5a.12xlarge instance type | $0.24 |
c5a.16xlarge | c5a.16xlarge instance type | $0.24 |
c5a.24xlarge | c5a.24xlarge instance type | $0.24 |
c5a.2xlarge | c5a.2xlarge instance type | $0.24 |
c5a.4xlarge | c5a.4xlarge instance type | $0.24 |
c5a.8xlarge | c5a.8xlarge instance type | $0.24 |
c5a.large | c5a.large instance type | $0.08 |
Vendor refund policy
Refunds available on request.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
Initial release of LLDAP as a ready-to-use self-hosted LDAP identity server, running as a single hardened Rust service with its web admin UI served behind an nginx TLS reverse proxy, secured with unique admin credentials and a self-signed certificate generated on each instance's first boot, and a dedicated data volume for the directory database.
Additional details
Usage instructions
Connect via SSH on port 22 as the default login user for your operating system variant (for the Ubuntu 24.04 variant the user is ubuntu). Read the per-instance admin credential with: sudo cat /root/lldap-credentials.txt. Open the web admin UI in a browser at https://<instance-public-ip>/ (the certificate is self-signed, so accept the browser warning) and sign in with the admin username and password from that file. Downstream services bind to the LDAP endpoint at ldap://<instance-public-ip>:3890 using the admin bind DN cn=admin,ou=people,dc=example,dc=com, or create a dedicated read-only service account in the web UI. The directory database lives under /var/lib/lldap on the dedicated data volume. The instance security group opens ports 22, 443 and 3890. The services run under systemd: systemctl status lldap nginx.
Resources
Vendor resources
Support
Vendor support
cloudimg Support
cloudimg provides 24/7 technical support for this product by email and live chat.
Contact: support@cloudimg.co.uk
What we help with:
- Deployment and initial configuration
- Connecting downstream applications (Nextcloud, Gitea, Grafana, Jellyfin and more) over LDAP
- TLS termination with your own domain and certificate
- User and group modelling and authorization design
- Backup planning for your directory database using EBS snapshots or AWS Backup
- Performance tuning and troubleshooting
- Updates and security patching guidance
- Instance sizing recommendations based on your directory scale
Getting help: Email support@cloudimg.co.uk or reach us via live chat. Include your EC2 instance ID and a description of the issue for fastest resolution.
Refunds: For refund requests, contact support@cloudimg.co.uk with your AWS account ID and subscription details.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
This product has charges associated with it for deployment, configuration, and ongoing support. LLDAP - Lightweight LDAP Server. Self-hosted on AWS EC2 with Docker.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.