pgina VS lldap

Along with pGina - http://pgina.org/

In addition to the usual protection advice (disable upnp etc) I have the main admin account setup with 2FA using google authenticator. Staff work stations are connected via LDAP Windows Auth (pGina - http://pgina.org/) and have access to their own home folder and limited shared folders depending on their requirements (so no single account has access to everything. Remote Access is done via OpenVPN that passes though a wireguard firewall. I also have my own DNS setup for the entire office running (Adguard Home - https://github.com/AdguardTeam/AdGuardHome). I'm running local backups (once weekly) and snapshops running hourly for 48 hours, daily for 14 days, weekly for 8 weeks and monthly for 4 months. I also have a third backup weekly setup to a 3rd party service (backblaze - https://www.backblaze.com/business-pricing.html)

You can use pGina to auth windows users via LDAP without samba/active directory.

For the record, though, Windows can authenticate against FreeIPA. Back when NIS was still viable, we used NISGINA; the modern incarnation is pGINA. We contemplated authenticating our Linux machines with RADIUS while using LDAP for the directory, but put it on the back-burner and I'd forgotten about it.

Setup whatever Linux LDAP/Kerberos solution you want to try and see if you can get pGina to work for your Windows clients.

I've found an old post about it here and somebody mentions this open source authentication app that seems to let you do desktop auth with RADIUS but doesn't seem to be developed anymore.

We used to replace the GINA in NT so it would authenticate to NIS. The modern equivalent of NISgina is pGina

Good to hear, I think it'll make many users happy. For me, I've migrated back to Authelia. I moved to authentik because at the time Authelia had no user management. After all of authentik's sharp edges, I've found lldap[0], and was able to implement a pilot in a few hours. I haven't looked back, since everything was converted.

[0]: https://github.com/lldap/lldap

I wrote LLDAP (https://github.com/lldap/lldap) after struggling to install and configure openLdap on my homelab.

I've recently installed and configured LLDAP (Lightweight LDAP) - More details here if you've never heard of it before: GitHub - lldap/lldap: Light LDAP implementation

I've an LLDAP instance running to make managing users easier.

I'm trying to integrate LDAP into my small homelab but I'm extreme noobie in it. So far I've tried: 1. OpenLDAP - not so resource heavy but I found it difficult go get working correctly with NextCloud, Keycloak and Jellyfin. Maybe someone could recommend an easy to follow guide? 2. LLDAP - honestly it's almost prefect. Nice clean UI, great guides how to setup with everything I need, but it's a read-only LDAP, so I cannot create or manage users with Keycloak or NC, that's about the only downside and probably bugs me more than it should. 3. 389ds - has everything I need (and probably some more), super easy to setup with this guide but the elephant in the room is that it uses 700MiB of RAM (whereas LLDAP uses only 7-8MiB). That's a big difference which really makes me question whether I want to use this particular solution.

Note that if you want to use KeyCloak for the OpenID but want to still have a LDAP source of truth, you can use LLDAP + KeyCloak together, with LLDAP as the source of truth and KeyCloak giving you the fancy features: https://github.com/lldap/lldap/blob/main/example_configs/key...

To be fair, their respective documentations (here and here) are pretty comprehensive.