LTB Self Service Password

LTB Self Service Password is an open-source web app for password changes and resets in LDAP directories. It is best for organizations with the capacity to run PHP and maintain LDAP-connected services. Its focused self-service tools are useful, but it does not cover delegated administration, auditing, or lifecycle automation.

Overview

The app lets users manage password tasks and selected directory attributes through a web application, while the organization hosts and operates it. It supports standard LDAPv3 directories and Active Directory. That scope suits teams seeking password self-service rather than a broad directory-management system; deployment requires PHP, LDAP connectivity, configured mail, and configured sessions.

Key features

• Password policy: Local checks can cover length, character classes, forbidden characters and words, reuse, and entropy. A Have I been pwned API check can flag breached-password status, giving administrators several ways to apply password rules.
• Reset verification: Users can reset through security questions, an emailed token, or SMS via an external Email 2 SMS service or SMS API. The options accommodate different workflows, though SMS requires an outside service.
• Directory and workflow tools: Users can update SSH keys, email addresses, and phone numbers in LDAP. Samba and Active Directory modes, CAPTCHA, password-change email notifications, and scripts that run before or after a change add configuration options around the core password flow.
• API and deployment: A REST API is available. Installation paths include a tarball, Debian or Ubuntu packages, CentOS or Red Hat packages, Docker, and Git for developers. The repository identifies PHP 7.4 or later, required PHP extensions, Smarty 3 or later, mail, and sessions as prerequisites.

Pricing

The Self Service Password plan costs nothing. It is GPL-3.0 licensed and self-hosted, with PHP and LDAP connectivity required. There is no paid tier described; the trade-off is that the organization supplies and operates the required infrastructure. The project points software questions to mailing lists, bug reports to GitHub issues, and customers seeking professional services or support to companies on its professional services page.

Platforms

The app is listed for API, Linux, self-hosted, and web environments. Its PHP and LDAP prerequisites make it a fit for teams able to manage a server-side deployment rather than buyers looking for a hosted password service.

Who it's for

Choose it if users need password changes or resets against LDAP or Active Directory and your team can maintain the PHP application and its connections to directory and mail services. It is a poor fit if the requirement is delegated directory administration, AD auditing, lifecycle automation, or reporting: those capabilities are not part of its stated scope.

Pros and cons

• Pro: Multiple reset methods and extensive password checks give administrators options for verification and policy enforcement.
• Pro: Self-hosted deployment options and LDAP attribute updates make it useful for organizations that want to keep the service tied to their own directory environment.
• Con: PHP, mail, sessions, and LDAP connectivity must be configured and maintained, adding operational work.
• Con: Its remit is password self-service; it does not provide delegated administration, AD auditing, lifecycle automation, or reporting.

Alternatives

ManageEngine ADSelfService Plus is worth considering if you want a freemium option spanning Android, iOS, Linux, macOS, web, and Windows; its free edition covers 50 users, unlimited domains, and 10 Endpoint MFA users, while Standard costs $595 a year.

Softerra Adaxes may suit teams considering paid software with a 30-day full-functionality evaluation and full technical support, rather than a free, self-hosted LDAP password tool.

Blazam is another free and open-source option, with API, Linux, self-hosted, web, and Windows platforms and an MIT license for personal and commercial use.

ManageEngine ADAudit Plus is an alternative to consider when evaluating auditing software; its free edition covers 25 workstations and its trial lasts 30 days.

PWM is another free, open-source password self-service application for LDAP directories.

Specops uReset is a paid alternative with annual, volume-based subscriptions priced by the number of users in scope.

ManageEngine ADManager Plus is another option to compare for broader Active Directory management; its Governance, Risk and Compliance add-on costs $495 a year for Professional Edition users under an annual license.

INGOS Active Directory Manager is a Windows option with pricing on request.

For more products in the category, browse Active Directory Management Software.

Verdict

Choose LTB Self Service Password when you want no-cost, self-hosted password self-service for LDAP or Active Directory and can manage the PHP, mail, session, and directory setup. Its strongest reason to choose it is a flexible set of reset and password-policy controls without a license charge. Look elsewhere if you need broader directory administration, auditing, or lifecycle automation.