// the take
A compiled-in nginx module that adds HTTP Basic Auth against one or more LDAP servers, with group-based authorization and AD-style referral handling. It's for ops teams fronting internal tools or legacy apps with nginx who want LDAP/AD gatekeeping without standing up a separate auth proxy.
Supports multiple LDAP servers per location with satisfy any/all semantics, so you can chain primary/fallback directories or require membership across more than one source. Group authorization via group_attribute (including DN-based group membership) covers the common AD/OpenLDAP use case without extra scripting. max_down_retries and a connection pool (connections directive) show someone actually hit the 'LDAP server dropped the keepalive' problem and built a retry path for it. ssl_check_cert plus ssl_ca_file/ssl_ca_dir gives you real cert validation for ldaps:// instead of just trusting whatever's presented.
It's a static nginx module, not dynamic (no load_module support evident) — adopting it means recompiling nginx from source and re-doing that on every nginx upgrade, which is a real tax compared to auth_request-based alternatives that run as a separate process. binddn_passwd is plaintext in nginx.conf with no vault/secret-file option, so your LDAP bind credentials end up wherever your nginx config lives, including backups and config-management repos. It's a single C module handling network I/O and credential parsing in a privileged nginx worker — a parsing bug here is a worker-process compromise, and there's no mention of fuzzing, CVE history, or a security audit anywhere in the docs. Last push was mid-2024 with no CI badge or test suite visible in the tree, so you're trusting 760 stars' worth of production use rather than any visible maintenance cadence.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →