Show HN: LDAPEnforcer, idempotent LDAP user and group management (opens in new tab)

In my homelab, I wanted LDAP users and groups, and especially changes to group membership, managed via files I checked in to Git. I didn't find anything else that could do this for my use case - 389 Directory Server, not running nixOS - so I wrote it myself.

You give it some OUs for people, service accounts, and groups, and it modifies objects in those OUs to match the config files. The OUs may contain only a subset of your accounts, so you can still permit non-managed user and group creation if you need to in your directory.

It was my first project with Claude Code and I was blown away by how fast it went. I was using it on my LDAP server after just a couple of days. I was reading a config file and talking to LDAP within the first couple of hours, without ever having written LDAP client code in Go before. Without Claude the effort probably wouldn't have been worth it, and I doubt I'd have gotten much further than a project skeleton.

Currently it assumes a 389 Directory Server laid out like mine happens to be, but it would be cool to support other LDAP servers and configurations.