Not having the time to implement that ourselves, we're stuck with LDAP as a backend as the common denominator.
This feels like it might exist so I went looking, looks like Auth0 had this[0][1]. I'm not sure there are any open source projects that actually do this ldap-in-the-front-something-else-in-the-back, but you can get very close:
- https://github.com/glauth/glauth (ldap in front, local file/s3/ldap in the back, extensible)
- https://github.com/kernel164/go389 (ldap in front, YAML file in the back)
Seems like this is quite the unsolved problem (unless you're using Auth0). Maybe it's worth using Auth0 only for this. If you're going with the F/OSS solutions then it feels like you could either add a plugin (DB, OAuth maybe?) to glauth, or hack together some sort of system that updates the YAML/S3 as accounts get added.
[EDIT] - Also looks like Joyent has put together a framework for LDAP clients and servers in JS... (http://ldapjs.org/server.html). The raw pieces are there but someone would really need to put them together to offer the facade.
[EDIT2] - Also in go: https://github.com/vjeantet/ldapserver
[EDIT3] - Original code listing for auth0's connector (https://github.com/auth0/auth0-ldap-endpoint), lib/routes/authenticate.js looks very easy to work around...
https://github.com/i-core/werther
It's a bit of a mouthfull:
> Werther is an Identity Provider for ORY Hydra over LDAP. It implements Login And Consent Flow and provides basic UI.
So basically, turn your LDAP into OAuth2, if I'm reading the features right:
> Support Active Directory;
> Mapping LDAP attributes to OpenID Connect claims;
> Mapping LDAP groups to user roles;
> OAuth 2.0 scopes;
> Caching users roles;
> UI customization.
Unfortunately this doesn't really free you from maintaining an LDAP server, it just... let's you login using OAuth instead, by bringing pieces of the ORY ecosystem along.