Quick start

Stand up a disposable 389 DS lab, sign in, and make one change you can see over REST, LDAP, and MCP.

What you need

• Docker Engine 24+ and Compose v2.24+
• A clone of the repository
• Ports 8443, 3389, and 3636 free on loopback

Go and Node are only required if you build from source. make compose-up builds the images.

Start the lab

git clone https://github.com/hilather/go-lab-ldap-mcp.git
cd go-lab-ldap-mcp
make compose-up

That builds local images, mints gitignored secrets, generates a lab CA, starts 389 DS on tmpfs, runs bootstrap, and brings the control plane up. First run is image-build heavy.

Persistent data: make compose-up-persistent.

Confirm it is up

curl -sk https://127.0.0.1:8443/health
curl -sk https://127.0.0.1:8443/health/ready

Ready waits for a working runtime bind and a matching directory revision. If it never comes, check docker compose logs bootstrap.

Open the UI

Browse to https://127.0.0.1:8443/. The cert is a lab cert — continue past the warning, or trust secrets/tls/instance-ca.crt.

Sign in with the contents of secrets/token-admin. The example scenario seeds user alice in group staff under dc=example,dc=test. That seed is YAML — Scenario YAML.

Call the API

TOKEN=$(tr -d '\n' < secrets/token-admin)
curl -sk -H "Authorization: Bearer $TOKEN" \
  https://127.0.0.1:8443/api/v1/users

Bind over LDAP

LDAP / StartTLS is ldap://127.0.0.1:3389. LDAPS is ldaps://127.0.0.1:3636. Bind as a directory user, not Directory Manager. A wrong CA fails closed.

Attach MCP

labldap mcp-stdio --config deploy/compose/scenario.yaml \
  --token-file secrets/token-admin

Or POST /mcp with the same bearer. Read tools are on. Mutations stay off until the scenario sets registerMutations.

Stop and reset

make compose-down
make compose-reset

Soft reset (keep the volume, restore the baseline) is the Reset page in the UI.

The same text lives in the repo as docs/guides/quickstart.md.