Axia LDAP & AD Web Console Files

The first public release.

Directories

• Users: search, read, create, edit and delete; every raw attribute on demand, with credential attributes (passwords, LAPS, BitLocker) withheld; bulk create and update, synchronous or queued; a generator for account names from masks or pasted text, with Cyrillic and Kazakh transliteration and a check for names already taken.
• Groups, organizational units and computer accounts: create, edit, move and delete.
• Active Directory and OpenLDAP alike, several directories in one instance. A session stays bound to the directory it signed in to.
• LDAPS by default, with the certificate and host name verified; StartTLS, or plain LDAP when chosen explicitly.
• Passwords written the directory's own way: unicodePwd in Active Directory, the Password Modify operation elsewhere.

Access control

• Sign-in with a directory account. Permissions are resolved on every request from the account's groups, mapped to roles by group DN, globally or per directory.
• Seventeen permissions across five roles, and an editor for what each role other than Admin may do.
• Nobody can change an account or group that confers more than they hold. Accounts and groups the directory marks as privileged take every permission to change, and the bind account cannot be changed through the application at all.

Operations

• An audit log of every sign-in and every attempted change, permitted or refused.
• Rate limits per client address, retunable without a restart.
• Structured logs with secrets redacted, to the console, a file, Loki or an HTTP endpoint.
• A REST API described by OpenAPI, and a console in nine languages, Arabic and Hebrew mirrored.
• A Docker quick start: the API, the console and an OpenLDAP with demo accounts, over LDAPS with generated keys.

Known limitations

Read before deploying: SECURITY.md (github.com) and Not in scope yet. Above all, a session cannot be ended before its token expires, and directory certificates are not checked for revocation.