SSO and identity

OpenLDAP is the directory

Users live in OpenLDAP (slapd). Mail (Postfix/Dovecot), portal login, and many apps bind against that directory (with nslcd for NSS where needed).

Operational consequence: a directory outage looks like “everything forgot passwords,” not just one app.

SSOwat sits in Nginx

SSOwat is a Lua access layer:

access_by_lua_file /usr/share/ssowat/access.lua;

It decides whether a request may reach an app before the app’s own auth runs. Some apps are SSO-protected; some (e.g. certain APIs or Vaultwarden flows) use their own auth on purpose.

Admin surfaces

• Web admin / portal APIs: yunohost-api, yunohost-portal-api
• CLI: yunohost user *, yunohost app *, yunohost domain *

Prefer CLI for automation and auditable changes; UI for exploratory work.

Practical guidance

• Create humans with yunohost user create — do not hand-edit LDAP unless you know the schema.
• App-specific service users may still exist as Debian users — do not delete “mystery” accounts without yunohost app info.
• Vaultwarden is the password manager URL on this host (exchange.neuralmeadow.xyz); treat it as high-value and back it up deliberately.