LTB Self Service Password

LTB Self Service Password gives LDAP users a web-based way to change or recover their passwords. It suits organizations able to run and maintain PHP services connected to a directory. Its appeal is focused, configurable self-service without a software charge; its trade-off is the infrastructure and administration that self-hosting requires.

Overview

The application works with standard LDAPv3 directories and Active Directory, making it a practical fit for teams whose main goal is to reduce the need for manual password resets. It is not a broader directory-management product: it has no delegated administration, AD auditing, lifecycle automation, or reporting. Choose it for password self-service, not for centralized oversight of directory operations.

Key features

• Configurable password checks: Local policy can check length, character classes, forbidden characters and words, reuse, and entropy. A Have I been pwned API check can flag breached-password status. This gives administrators several ways to enforce password standards, though teams should decide which checks fit their own policy.
• Several reset routes: Users can verify a reset with security questions, an emailed token, or SMS via an external Email 2 SMS service or SMS API. Multiple options can accommodate different setups, but SMS depends on a separate service.
• Directory-related tools: Samba and Active Directory modes, CAPTCHA, password-change email notifications, and scripts that run before or after a password change extend the basic reset workflow. Users can also update their SSH key, email address, or phone number in LDAP.
• REST API: An API is available for teams that need programmatic access alongside the web application.
• Deployment choices, with prerequisites: Installation paths include tarball, Debian or Ubuntu packages, CentOS or Red Hat packages, Docker, and Git for developers. The software requires PHP 7.4 or later, PHP extensions, Smarty 3 or later, configured mail and sessions, and LDAP connectivity. These requirements make it a better fit for teams with PHP and directory operations experience than for those seeking a managed service.

Pricing

The Self Service Password plan costs nothing and is GPL-3.0 licensed, self-hosted software. There is no free trial because the software is free. The price removes a software license charge, not the work of hosting and maintaining PHP, mail, sessions, and LDAP connectivity. The repository identifies the license as GPL-3.0; software questions go to the project mailing lists, bug reports to GitHub issues, and professional services or support are directed to companies on the project's professional services page.

Platforms

LTB Self Service Password is listed for API, Linux, self-hosted, and web use. Its deployment options give administrators several ways to install it, but the PHP and LDAP requirements remain central to operating it.

Who it's for

This is a strong candidate for organizations running LDAP or Active Directory that want users to handle password changes and resets themselves, and that can maintain a self-hosted PHP application. Teams needing delegated directory administration, auditing, lifecycle automation, or reporting should choose a broader tool instead.

Pros and cons

Pros

• No software fee: The GPL-3.0 software costs nothing, which suits teams willing to manage their own hosting.
• Useful policy breadth: Checks include reuse, entropy, and breached-password status as well as character rules, supporting more than basic complexity enforcement.
• Flexible verification and deployment: Users have several reset methods, and administrators can choose among package, Docker, tarball, or developer-oriented installation routes.

Cons

• Self-hosting is an operational commitment: PHP, extensions, Smarty, mail, sessions, and LDAP connectivity all need to be in place.
• Some reset choices rely on external services: SMS requires an Email 2 SMS service or SMS API.
• Its scope is narrow: It does not provide delegated administration, AD auditing, lifecycle automation, or reporting.

Alternatives

• Blazam is another free, open-source option, with an MIT license for personal and commercial use and support for API, Linux, self-hosted, web, and Windows platforms.
• PWM is a free, open-source password self-service application for LDAP directories; consider it as another focused LDAP option.
• ManageEngine ADSelfService Plus offers a no-expiration Free Edition for 50 users, unlimited domains, and 10 Endpoint MFA users, as well as paid plans. Choose it if those stated user and MFA allowances suit your needs.
• Softerra Adaxes has a 30-day free evaluation with full functionality and technical support, but is a paid product with no free plan.
• ManageEngine ADAudit Plus is an auditing alternative with a free edition for 25 workstations and a 30-day trial. Choose it when auditing, rather than password self-service, is the priority.
• Netwrix Password Secure offers self-service pricing starting at $60 a year per enabled account, with a minimum one-year purchase commitment.
• Specops uReset is a paid alternative with annual, volume-based subscriptions and a free trial.
• Cayosoft Administrator is a freemium alternative with no free plan and a free trial.

For a wider comparison of directory tools, see Active Directory Management Software.

Verdict

Choose LTB Self Service Password if your organization needs focused LDAP or Active Directory password self-service and can operate the PHP and directory-connected infrastructure itself. Its free, open-source licensing and varied policy checks are compelling for that use. Look elsewhere if you need delegated administration, auditing, lifecycle automation, reporting, or a managed deployment.