LDAP & SSH Key Sync
OmniWeb's access control can extend beyond the portal to the hosts that run the network. By synchronising users and their SSH public keys into an LDAP directory, OmniWeb becomes the single place to manage who can SSH where — and, combined with audit logging, who actually did.
This integration is optional. If the LDAP settings are not configured, OmniWeb runs normally and simply does not sync.
← Authentication & Access Control · ← Operations Guide
What It Does
When LDAP sync is enabled, every user created or updated in OmniWeb — including any change to their SSH public key — is written to the LDAP directory automatically. Service hosts configured to read from that directory then authorise SSH logins and public-key lookups against it. Add a key in OmniWeb, and the user can SSH to every enrolled host; remove it, and that access is gone everywhere at once.
Configuration
LDAP sync is controlled by four backend settings:
| Variable | Default | Description |
|---|---|---|
LDAP_URI | ldap://localhost:389 | OpenLDAP server URI. |
LDAP_BASE_DN | dc=omniweb,dc=local | Base distinguished name of the directory. |
LDAP_ADMIN_DN | cn=admin,dc=omniweb,dc=local | Bind DN OmniWeb uses to write entries. |
LDAP_ADMIN_PASSWORD | omniweb-admin | Bind password. Change this — the default must never be used in production. |
With these set, OmniWeb writes user entries (with their sshPublicKey attribute) into LDAP under the users branch of the base DN.
What Gets Synced
| OmniWeb data | LDAP representation |
|---|---|
| Username | uid of the user entry |
| SSH public key(s) | sshPublicKey attribute (via the ldapPublicKey object class) |
| User identity | Standard POSIX account attributes so hosts can resolve the user |
Storing SSH keys in LDAP relies on the openssh-lpk schema (the sshPublicKey attribute and ldapPublicKey object class) being present in the directory.
Settings → Users — each user's details including whether an SSH public key is configured. Adding or changing a key here is what syncs to LDAP and, from there, to every enrolled host.
How Hosts Consume It
Each service host is configured to use LDAP as a name service and for SSH key lookup:
On the host side this means:
- Name resolution (
passwd/group/shadow) is backed by LDAP, so OmniWeb-managed users exist on the host. - SSH key authorisation is served from LDAP, so the keys OmniWeb stores are the keys that grant access — there are no per-host
authorized_keysfiles to maintain.
Why This Matters
Centralising host access in OmniWeb gives you:
- One place to grant/revoke SSH access across the whole fleet.
- No scattered key files drifting out of sync on individual hosts.
- A single identity that ties a person's portal access, their SSH access, and — through audit logging — their recorded activity together.
Related
- Audit Logging — record SSH logins and every command run on the hosts.
- RBAC — control what the same users can do inside OmniWeb.