tpt-warden
RustA memory-safe, distributed replacement for OpenLDAP, written in Rust. LDAPv3-compatible directory server with Raft-based replication for strict ACID consistency across nodes, built for Kubernetes-native deployments. Dual-licensed MIT/Apache-2.0.
Languages
TPT Warden
The OpenLDAP Successor — a distributed, memory-safe LDAPv3 directory server.
TPT Warden is a from-scratch, Rust implementation of an LDAPv3 directory service
built for horizontal scale and operational safety. It replaces OpenLDAP's
pointer-chasing C backend and fragile syncrepl multi-master replication with:
- A safe, modern embedded B-Tree store (
redb) - Raft consensus for strict ACID replication across nodes
- An async runtime (
tokio) and structured observability viatracing
Workspace layout
| Crate | Purpose |
|---|---|
warden-proto | BER/ASN.1 LDAPv3 message encode/decode (RFC 4511) |
warden-storage | redb-backed entry store, indexing, and transactions |
warden-ldif | RFC 2849 LDIF import/export parser and writer |
warden-raft | Raft log entry format and consensus primitives |
warden-server | Directory server binary |
warden-cli | Administrative CLI (LDIF import/export, backup/restore) |
Status
Phases 0–1 are complete: the workspace builds, the BER/ASN.1 protocol layer
implements the core LDAPv3 operations (Bind, Search, Add, Modify, Delete,
ModifyDN, Compare), StartTLS/TLS, SASL (PLAIN/EXTERNAL), paged-results and
other controls, and the schema subsystem (core/cosine/inetorgperson/nis).
Phase 2 (storage engine) is implemented and benchmarked: a redb-backed
entry store with equality/substring/presence indexing, an RwLock<Database>
concurrency model matching the single-writer-per-node Raft design, and atomic
batch WAL boundaries. Phases 4 (overlays) and 5 (migration) are wired into the
server and CLI: memberOf, refint, unique, ppolicy, and accesslog
overlays are active; OpenLDAP schema and olcAccess ACL translators are exposed
via warden-cli. Phase 6 (testing) has per-crate unit tests, an end-to-end
client bind/search/modify/delete test, and CLI integration tests — cargo test
is green. Phase 9 (observability) serves /healthz, /readyz, /metrics, and
/audit. See todo.md for the phased roadmap and current progress,
and docs/ for architecture, administration, and compatibility notes.
License
Licensed under either of
- Apache License, Version 2.0 (LICENSE-APACHE)
- MIT license (LICENSE-MIT)
at your option.
Contribution
Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.
Copyright © TPT Solutions.