LDAP Self Service Solution

Please read our disclaimer


  • Head to the Community Applications store in Unraid

  • Search for and click to install 'PWM' from Sycotix's Repository

  • The template does does not need any modifications past the port you want to reach it on, if the default of 8282 is already in use on your system.

  • Click done and wait for the container to pull down and start.

  • Ensure you have MariaDB installed and operational. We recommend using Adminer to manage your MariaDB. Click here to see how.

  • Open your MariaDB in Adminer (or use CLI if you prefer) and create a database called 'pwm'.

  • Create a user and password for the new database called 'pwm' - and grant it all privileges.

  • In your FreeIPA server, ensure you have a test user account. It does not require any special privileges and should be a normal user. Tip: Default behaviour in FreeIPA means that when an admin user sets or resets a users password, it will automatically expire immediately. Sign in to FreeIPA as that user to ensure the proper password is in place. Check the expiration date of the password to be sure it's valid.

  • Download the MySQL/Java connector package from the Useful Links section above.

  • With all the above done we are now prepared for configuration.



  • Left-click the PWM container and open the WebUI Tip: if you receive constant redirects, in the address bar, remove everything past the port so it looks like this: http://SERVERIP:8282 (where SERVERIP is your server which PWM is running on)

  • Once you see the WebUI, click Next to begin the Configuration

  • Select the 'Manual Configuration' option

  • Set a Configuration Password. This will be required any time you wish to edit the config of PWM.

  • Now, you can configure all the below settings.



Default Settings ⇨ LDAP Vendor Default Settings

Default Settings ⇨ Storage Default Settings

LDAP ⇨ LDAP Directories ⇨ default ⇨ Connection ⇨ LDAP Contextless Login Roots

LDAP ⇨ LDAP Directories ⇨ default ⇨ Connection ⇨ LDAP Proxy Password** (your FreeIPA admin password)

LDAP ⇨ LDAP Directories ⇨ default ⇨ Connection ⇨ LDAP Proxy User

LDAP ⇨ LDAP Directories ⇨ default ⇨ Connection ⇨ LDAP Test User

LDAP ⇨ LDAP Directories ⇨ default ⇨ Connection ⇨ LDAP URLs (your FreeIPA server IP and non-SSL port, default 389)

LDAP ⇨ LDAP Directories ⇨ default ⇨ Login Setup ⇨ User Name Search Filter

LDAP ⇨ LDAP Directories ⇨ default ⇨ User Attributes ⇨ Attribute to use for User Name

LDAP ⇨ LDAP Directories ⇨ default ⇨ User Attributes ⇨ LDAP GUID Attribute

LDAP ⇨ LDAP Directories ⇨ default ⇨ User Attributes ⇨ LDAP Naming Attribute

LDAP ⇨ LDAP Settings ⇨ Global ⇨ User Object Class

Modules ⇨ Authenticated ⇨ Administration ⇨ Administrator Permission
UserPermission-ldapGroup: [Profile:default Base:cn=admins,cn=groups,cn=accounts,dc=domain,dc=com]

Modules ⇨ Authenticated ⇨ Change Password ⇨ Profiles ⇨ default ⇨ Require Current Password During Change

Modules ⇨ Authenticated ⇨ Guest Registration ⇨ Creation Context

Setting ⇨ Settings ⇨ Application ⇨ Application ⇨ Home URL

Setting ⇨ Settings ⇨ Application ⇨ Application ⇨ Idle Timeout Seconds

Setting ⇨ Settings ⇨ Application ⇨ Application ⇨ Logout URL

Setting ⇨ Settings ⇨ Application ⇨ Application ⇨ Site URL

Setting ⇨ Settings ⇨ Database (Remote) ⇨ Connection ⇨ Database Class

Setting ⇨ Settings ⇨ Database (Remote) ⇨ Connection ⇨ Database Connection String (your MariaDB IP and Port)

Setting ⇨ Settings ⇨ Database (Remote) ⇨ Connection ⇨ Database Driver
LOAD THE MYSQL JAVA package you downloaded in the Configuration steps.

Setting ⇨ Settings ⇨ Database (Remote) ⇨ Connection ⇨ Database Password

Setting ⇨ Settings ⇨ Database (Remote) ⇨ Connection ⇨ Database User Name

Setting ⇨ Settings ⇨ Database (Remote) ⇨ Connection ⇨ Database Vendor
  • With all the above configured, you have the minimum required to connect to your FreeIPA LDAP and use it for authentication.

  • Select Save in the very top-right of the Configuration Editor.

  • Once it sends you back to the login screen, select Configuration Manager.

  • Check that everything looks okay, it should look like this:

  • If it all looks clear, head to your home page and try to sign in with your FreeIPA admin account. This will allow you to check that authentication is working.

  • Once you sign in using an authenticated account successfully, you must now take PWM out of Configuration Mode.

  • Head to the Configuration Manager and select Restrict Configuration.

  • Profit.

Additional Recommendations

Now that you have the basics set up, you can successfully use PWM to authenticate users and process user management. However, some addition config is recommended at your own discretion in the Configuration Editor.

  • Set up your SMTP setting to allow emails to work

  • Set up your reverse proxy and DNS entries to allow the address to work externally

  • Set up your password policies

  • There's plenty more PWM can do (over 400 settings). So take your time and enjoy the process.

Final Words

We hope you enjoyed this guide. It was conceptualized, written, and implemented by our Admin Sycotix.

Support Us

Our work sometimes takes months to research and develop. If you want to help support us please consider:

Thank you for being part of our community!

Last updated