New "PWM on OpenLDAP" appliance

[JedMeister]

This issue has been repursposed to suggest a new "PWM with OpenLDAP" appliance.

---

This was initially suggested ages ago on the forums but a recent bump bought it to my attention.

PWM is:

an open source password self service application for LDAP directories. PWM is an ideal candidate for organizations that wish to “roll their own” password self service solution, but do not wish to start from scratch.

My instinct on this would be to pre-install it, but have it disabled by default. Enable it via a firstboot question (with a preseed option, which defaults to "no" if not set) and/or a Confconsole plugin.

[JedMeister]

Looking at this a bit closer, I'm not 100% sure about including this by default in OpenLDAP.

Having said that, it does seem cool. Perhaps it should be an appliance of it's own? I'll repurpose this issue as a request for that...

[vondrt4]

I've got some experience with PWM. It works quite well, runs in a small Tomcat Java server and can send password reset e-mails.
I'm not sure how much its setup is automatable, though. It needs a lot of clicking, setting up passwords, and everyone will use different features.
However, there are some steps that need to be run on the LDAP server, like adding a service user and modifying the schema of the user object i-don't-remember-for-what. Those can be automated.

[JedMeister]

Thanks for the input @vondrt4