License & Deployment Mix: 16 tools – 6 OSS, 1 SaaS. (OSS and SaaS counts can overlap when an open-source tool also offers a vendor-hosted edition.)
Overview
LDAP (Lightweight Directory Access Protocol) servers implement the LDAPv3 protocol for directory services – storing and retrieving hierarchical data such as user accounts, groups, organisational units, and arbitrary attributes. They are the foundation layer beneath higher- level identity platforms like FreeIPA, Active Directory, and Authentik.
Key Capabilities
- LDAPv3 compliance – bind, search, add, modify, delete, compare, extended operations
- Schema management – objectClass and attribute definitions; custom schema extensions
- Replication – multi-supplier (multi-master) or supplier-consumer topologies for HA
- Access control – ACLs/ACIs controlling who can read/write which entries and attributes
- TLS/STARTTLS – encrypted transport for LDAP connections
- Backend storage – MDB, BDB, SQL, flat-file, or in-memory backends
- Password policy – account lockout, password expiry, history, complexity enforcement
- Referrals and chaining – distributed directory across multiple servers
- Virtual directory – federate data from multiple sources behind a single LDAP interface
Evaluation Criteria
- LDAPv3 compliance – completeness of protocol implementation
- Replication – multi-master, conflict resolution, geographic distribution
- Performance – entries per second for search, bind, and modify operations
- Scalability – millions to billions of entries; horizontal scaling
- Backend flexibility – storage engine options and pluggability
- Administration – CLI tools, web UI, schema management
- SSO integration – Kerberos, SAML, OIDC pass-through or delegation
- Monitoring – SNMP, metrics endpoints, log formats for observability
- Licensing – OSS vs proprietary; cost model for commercial offerings
The information on these pages was researched by a combination of human review and large language models. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. Use this catalogue only as a starting point for your own research, and review any tool carefully against your own requirements before relying on it. Catalogue data version 2026.197.
Comparison
Deployment Model
| Tool | License | Self-Hosted | SaaS | Docker |
|---|---|---|---|---|
| OpenLDAP | OpenLDAP-2.8 | Yes | No | Yes |
| 389 DS | GPL-3.0 | Yes | No | Yes |
| ApacheDS | Apache-2.0 | Yes | No | Yes |
| OpenDJ | CDDL-1.0 | Yes | No | Yes |
| LLDAP | GPL-3.0 | Yes | No | Yes |
| GLAuth | MIT | Yes | No | Yes |
| PingDirectory | Proprietary | Yes | Yes | Yes |
| RHDS | Proprietary | Yes | No | No |
| Oracle OUD | Proprietary | Yes | No | Yes |
| IBM Verify Dir | Proprietary | Yes | No | No |
| eDirectory | Proprietary | Yes | No | No |
| Isode M-Vault | Proprietary | Yes | No | No |
| RadiantOne | Proprietary | Yes | Yes | Yes |
| JumpCloud LDAP | Proprietary | No | Yes | N/A |
| OneLogin VLDAP | Proprietary | No | Yes | N/A |
Protocol & Standards
| Tool | LDAPv3 | LDAPS | STARTTLS | DSMLv2 | REST |
|---|---|---|---|---|---|
| OpenLDAP | Full | Yes | Yes | No | No |
| 389 DS | Full | Yes | Yes | No | No |
| ApacheDS | Full | Yes | Yes | Yes | No |
| OpenDJ | Full | Yes | Yes | Yes | Yes |
| LLDAP | Partial | Yes | Yes | No | Yes |
| GLAuth | Partial | Yes | Yes | No | No |
| PingDirectory | Full | Yes | Yes | Yes | Yes |
| RHDS | Full | Yes | Yes | No | No |
| Oracle OUD | Full | Yes | Yes | Yes | Yes |
| IBM Verify Dir | Full | Yes | Yes | No | No |
| eDirectory | Full | Yes | Yes | No | No |
| Isode M-Vault | Full | Yes | Yes | No | No |
| RadiantOne | Full | Yes | Yes | No | Yes |
| JumpCloud LDAP | Partial | Yes | N/A | No | Yes |
| OneLogin VLDAP | Partial | Yes | N/A | No | Yes |
LLDAP and GLAuth implement a simplified LDAP subset optimised for authentication; they do not support the full LDAPv3 specification (e.g., limited extended operations, no referrals).
Replication & Scalability
| Tool | Multi-Master | Entries | Language | Backend |
|---|---|---|---|---|
| OpenLDAP | Yes (N-way) | Millions | C | MDB/BDB |
| 389 DS | Yes (N-way) | Millions | C | LMDB |
| ApacheDS | No | Thousands | Java | JDBM/Mavibot |
| OpenDJ | Yes (N-way) | Millions | Java | JE/PDB |
| LLDAP | No | Thousands | Rust | SQLite/PG |
| GLAuth | No | Thousands | Go | Config/SQL |
| PingDirectory | Yes (N-way) | Billions | Java | JE |
| RHDS | Yes (N-way) | Millions | C | LMDB |
| Oracle OUD | Yes (N-way) | Billions | Java | JE |
| IBM Verify Dir | Yes | Millions | C | DB2 |
| eDirectory | Yes | Billions | C | FLAIM |
| Isode M-Vault | Yes | Millions | C | Custom |
| RadiantOne | Yes | Virtual | Java | Virtual |
| JumpCloud | Managed | Managed | N/A | Managed |
| OneLogin | Managed | Managed | N/A | Managed |
Best scalability: PingDirectory and Oracle OUD (billions of entries); OpenText eDirectory (tested to billions); OpenLDAP and 389 DS (millions, most common OSS choice).
Password Hashing
| Tool | Default | Supported Hashes |
|---|---|---|
| OpenLDAP | SSHA | SSHA-256/512, PBKDF2, Argon2 (contrib), SHA, MD5, CRYPT |
| 389 DS | PBKDF2-SHA256 | PBKDF2-SHA512, Argon2, SSHA-256/512, SSHA, CRYPT |
| ApacheDS | SSHA | SHA, MD5, CRYPT, PKCS5S2 (PBKDF2) |
| OpenDJ | PBKDF2 | SSHA-256/512, bcrypt, CRYPT, AES (reversible) |
| LLDAP | Argon2id | bcrypt |
| GLAuth | SHA-256 | bcrypt |
| PingDirectory | PBKDF2 | SSHA-256/512, bcrypt, scrypt, AES (reversible) |
| RHDS | PBKDF2-SHA256 | Same as 389 DS; FIPS mode restricts |
| Oracle OUD | SSHA-256 | SSHA-512, PBKDF2, SHA, CRYPT, AES (reversible) |
| IBM Verify Dir | SSHA | SSHA-256/512, SHA, CRYPT, AES256 (reversible) |
| eDirectory | SSHA-512 | SSHA-256, PBKDF2, Universal Password (reversible) |
| Isode M-Vault | SSHA-256 | SSHA-512, PBKDF2. FIPS restricts |
| RadiantOne | Pass-through | Delegates to backends; cache: SSHA/PBKDF2 |
| JumpCloud | Managed | bcrypt (internal, not configurable) |
| OneLogin | Managed | Delegates to OneLogin cloud |
Strongest defaults: 389 DS and RHDS (PBKDF2-SHA256), LLDAP (Argon2id), OpenDJ and PingDirectory (PBKDF2).
Auto-migration: 389 DS, RHDS, and OpenDJ support automatic password hash upgrade on next successful bind – users are transparently migrated to stronger hashes.
Administration & Tooling
| Tool | Web UI | CLI Tools | Schema Editor | Backup |
|---|---|---|---|---|
| OpenLDAP | No (3rd party) | Yes | ldapmodify | Yes |
| 389 DS | Cockpit plugin | dsconf/dsctl | Yes | Yes |
| ApacheDS | Directory Studio | Yes | Yes | Yes |
| OpenDJ | ForgeRock UI | dsconfig | Yes | Yes |
| LLDAP | Built-in | No | Fixed | SQLite |
| GLAuth | No | Config file | No | File |
| PingDirectory | Yes | dsconfig | Yes | Yes |
| RHDS | Cockpit plugin | dsconf | Yes | Yes |
| Oracle OUD | ODSM | dsconfig | Yes | Yes |
| IBM Verify Dir | IDSLDAP tools | idsldapsearch | Yes | Yes |
| eDirectory | iManager | ndsmanage | Yes | Yes |
| Isode M-Vault | Sodium | isode tools | Yes | Yes |
| RadiantOne | Control Panel | vdsconfig | Yes | Yes |
| JumpCloud | Web console | API | N/A | N/A |
| OneLogin | Web console | API | N/A | N/A |
Best admin experience: 389 DS (Cockpit plugin
- dsconf CLI), LLDAP (built-in web UI for simple setups), PingDirectory (full web console).
Monitoring & Observability
| Tool | SNMP | Metrics | Access Log | Audit Log |
|---|---|---|---|---|
| OpenLDAP | Yes | cn=Monitor | Yes | Yes |
| 389 DS | Yes | cn=Monitor | Yes | Yes |
| ApacheDS | No | JMX | Yes | No |
| OpenDJ | Yes | cn=Monitor | Yes | Yes |
| LLDAP | No | Prometheus | Yes | No |
| GLAuth | No | No | Yes | No |
| PingDirectory | Yes | StatsD/OIDC | Yes | Yes |
| RHDS | Yes | cn=Monitor | Yes | Yes |
| Oracle OUD | Yes | JMX/SNMP | Yes | Yes |
| IBM Verify Dir | Yes | cn=Monitor | Yes | Yes |
| eDirectory | Yes | iMonitor | Yes | Yes |
| Isode M-Vault | Yes | SNMP | Yes | Yes |
| RadiantOne | Yes | JMX | Yes | Yes |
| JumpCloud | N/A | API | Yes | Yes |
| OneLogin | N/A | API | Yes | Yes |
Monitoring integration: A Telegraf LDAP input plugin reads cn=Monitor for OpenLDAP, 389 DS, RHDS, and OpenDJ. LLDAP exposes native Prometheus metrics. PingDirectory supports StatsD. All access logs can be collected by Fluent Bit.
SSO / OIDC Detail
| Tool | SAML | OIDC | Kerberos | SCIM |
|---|---|---|---|---|
| OpenLDAP | No | No | SASL/GSSAPI | No |
| 389 DS | No | No | SASL/GSSAPI | No |
| ApacheDS | No | No | Built-in KDC | No |
| OpenDJ | No | No | SASL/GSSAPI | No |
| LLDAP | No | No | No | No |
| GLAuth | No | No | No | No |
| PingDirectory | No | Yes | SASL/GSSAPI | Yes |
| RHDS | No | No | SASL/GSSAPI | No |
| Oracle OUD | No | No | SASL/GSSAPI | No |
| IBM Verify Dir | No | No | SASL/GSSAPI | No |
| eDirectory | No | No | SASL/GSSAPI | No |
| Isode M-Vault | No | OAuth 2.0 | SASL/GSSAPI | No |
| RadiantOne | No | No | SASL/GSSAPI | No |
| JumpCloud | Yes | Yes | No | Yes |
| OneLogin | Yes | Yes | No | Yes |
LDAP servers are typically backend stores consumed by identity platforms (Authentik, FreeIPA, AD) that handle SSO protocols. Direct SAML/OIDC support is rare except on cloud directory services.
Pricing
| Tool | Model | Free Tier | Starting Price |
|---|---|---|---|
| OpenLDAP | Self-hosted | Yes | Free |
| 389 DS | Self-hosted | Yes | Free |
| ApacheDS | Self-hosted | Yes | Free |
| OpenDJ | Self-hosted | Yes | Free |
| LLDAP | Self-hosted | Yes | Free |
| GLAuth | Self-hosted | Yes | Free |
| PingDirectory | Enterprise | No | Custom |
| RHDS | Subscription | No | RHEL sub |
| Oracle OUD | Enterprise | No | Custom |
| IBM Verify Dir | Enterprise | No | Custom |
| eDirectory | Per-user | No | Custom |
| Isode M-Vault | Enterprise | No | Custom |
| RadiantOne | Enterprise | No | Custom |
| JumpCloud | Per user | Yes (10 users) | $9/user/mo |
| OneLogin | Per user | No | Custom |
Best value: OpenLDAP (most deployed, zero cost), 389 DS (enterprise-class, GPL), LLDAP (modern Rust, Docker-friendly, zero cost).
Recommendation Summary
| Segment | Recommended | Rationale |
|---|---|---|
| Enterprise Linux | 389 DS | FreeIPA upstream, Cockpit UI |
| General purpose | OpenLDAP | Most deployed, MDB backend |
| Lightweight / homelab | LLDAP | Rust, web UI, Docker |
| Dev / testing | GLAuth | Go, config-file backend |
| Java ecosystem | OpenDJ | REST gateway, Java native |
| Enterprise commercial | PingDirectory | Billions of entries |
| Oracle shop | Oracle OUD | IAM suite integration |
| Red Hat shop | RHDS | Supported 389 DS |
| Cloud / no infra | JumpCloud | LDAP-as-a-Service |
| Virtual / federated | RadiantOne | Multi-source LDAP |
Tools
15 tools.
389 Directory Server
389 Directory Server is an enterprise-class LDAPv3 server for Linux. It is the upstream project for Red Hat Directory Server and the LDAP engine inside FreeIPA / Red Hat Identity Management.
License: GPL-3.0-or-later (OSS) · Kind: web · Deploy: native · SSO: none
ApacheDS
ApacheDS is an open-source, Java-based LDAPv3 directory server from the Apache Software Foundation, featuring a built-in Kerberos KDC, stored procedures, triggers, and DSMLv2 XML directory access.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native · SSO: none
GLAuth
GLAuth is a lightweight LDAP proxy/server written in Go. It provides a minimal LDAPv3-compatible interface designed primarily for read-only authentication and service account lookups.
License: MIT (OSS) · Kind: web · Deploy: native, docker · SSO: none
IBM Security Verify Directory
IBM Security Verify Directory (formerly IBM Security Directory Server, formerly Tivoli Directory Server) is an enterprise LDAP directory server with mainframe heritage.
License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none
Isode M-Vault
Isode M-Vault is a high-assurance directory server designed for military, government, and defence environments.
License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none
JumpCloud LDAP-as-a-Service
JumpCloud LDAP-as-a-Service is a cloud-hosted LDAP endpoint provided as part of JumpCloud’s Open Directory Platform.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC
LLDAP (Light LDAP)
LLDAP is a lightweight LDAP authentication server written in Rust. It provides a simplified, opinionated LDAP interface with a built-in web UI for user and group management.
License: GPL-3.0-only (OSS) · Kind: web · Deploy: native, docker · SSO: none
OneLogin Virtual LDAP
OneLogin Virtual LDAP (VLDAP) is a cloud-hosted LDAP interface that proxies requests to OneLogin’s cloud directory.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC
OpenDJ (Community Edition)
OpenDJ is a Java-based LDAPv3 directory server originally developed by Sun Microsystems, then ForgeRock. After ForgeRock closed the source in 2016, the Open Identity Platform community maintains the open-source edition.
License: CDDL-1.0 (OSS) · Kind: web · Deploy: native · SSO: none
OpenLDAP
OpenLDAP is the most widely deployed open-source LDAPv3 directory server. Written in C, it provides a full LDAPv3 implementation with extensive backend and overlay support.
License: OLDAP-2.8 (OSS) · Kind: web · Deploy: native · SSO: none
OpenText eDirectory
OpenText eDirectory (formerly Novell eDirectory, later NetIQ eDirectory) is an X.500-derived directory server with deep roots in enterprise networking.
License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none
Oracle Unified Directory
Oracle Unified Directory (OUD) is a proprietary Java-based LDAPv3 directory server and proxy, derived from OpenDS, offering multi-master replication and integration with Oracle’s identity stack.
License: Proprietary (proprietary) · Kind: web · Deploy: native, docker · SSO: none
PingDirectory
PingDirectory is an enterprise LDAP directory server from Ping Identity built for high availability, with multi-master replication, REST/SCIM APIs, and data governance features like consent management and masking.
License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none
RadiantOne
RadiantOne (by Radiant Logic) is not a traditional LDAP directory server but rather an identity data platform that federates multiple identity sources behind a unified LDAP and SCIM interface.
License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none
Red Hat Directory Server
Red Hat Directory Server (RHDS) is the commercially supported downstream build of 389 Directory Server. It is included with Red Hat Enterprise Linux and Red Hat Identity Management (IdM) subscriptions.
License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none
