After years of hating AD management, I finally wrote a dedicated LDAP IaC tool. Need your opinion on that
Hi r/sysadmin!
For a long period of time I wanted to manage Active Directory the way we manage everything else these days - declarative way. And it was always the same by clicking through ADUC and big pile of messy PowerShell scripts.
So I started building a tool myself. I got the basic stuff going, but between parsing a real configuration language, diffing against what's actually in AD, ordering the changes, and handling state safely, it just kept growing faster than my head could comprehend so I gave up for a considerable period of time. Then I decided it is an AI here and there so I used Claude (drop tomatoes\shit at me) to finish what I have started. I designed what I wanted and Claude helped me write, test and polish it into something that i think might be useful.
Aaaaaannndd...it works! I've tested it end on my demo AD by creating OUs, users and groups, changing them, moving them around, adopting existing objects and cleaning up again and etc.
Directory is described like this:
ou "staff" {
name = "Staff"
}
user "jdoe" {
given_name = "John"
surname = "Doe"
path = ou.staff.dn
}
group "engineering" {
name = "Engineering"
path = ou.staff.dn
members = [user.jdoe.dn]
}
Then run declarad plan to see changes, and declarad apply to apply it.
What it can do?
- OUs, containers, groups, users, computers, contacts, gMSAs, fine-grained password policies, GPO links, and AD-integrated DNS zones and records
- The full HCL language support such as variables, for_each, count, modules (local or from git), and the functions you know from the Terraform
- Ability to export your existing AD into configuration files, then take it under management with --adopt, so you don't have to start from scratch
- Shared state with locking which support local file, S3, Azure Blob Storage or HTTP (e.g. GitLab)
- Several domains from one configuration
- It never silently takes over existing objects, OUs stay protected from deletion, and attributes you don't manage are left alone
- It talks LDAP/LDAPS directly to your DCs, so it runs on Windows, Linux and macOS. No RSAT, PowerShell or WinRM needed.
- Is CI-friendly: plan --detailed-exitcode for drift detection, fmt --check, validate
And yes! I'm aware of Terraform and its Active Directory provider! I tried it and it hasn't been well maintained for a long time, it covers only a small part of what can be needed day to day, and it depends on WinRM and PowerShell on the Windows side. I didn't want another wrapper around a general purpose tool. I wanted a tool designed specifically for Active Directory from scratch.
It's free and open source: akshinmustafayev/declarad
There are ready-made binaries for Windows, Linux and macOS on the Releases page, documentation, and examples from "one user" up to a multi-site enterprise layout.
Please be gentle with it. It's a 0.x release, so try it on a lab domain or a test OU first, and always read the plan before you apply.
Every addition, change and contribution is very, very welcome! Bug reports, ideas, "this doesn't work in my environment", docs fixes, new resource types, pull requests: all of it. I'd love for this to grow into something useful for all of us who look after AD.
Thanks for reading, and I'd really love to hear what you think!
17 comments
Mentions
After years of hating AD management, I finally wrote a dedicated LDAP IaC tool. Need your opinion on that Hi r/sysadmin! For a long period of time I wanted to manage Active Directory the way we manage everything else these days - declarative way. And it was always the same by clicking through ADUC and big pile of messy PowerShell scripts. So I started building a tool myself. I got the basic stuff going, but between parsing a real configuration language, diffing against what's actually in AD, ordering the changes, and handling state safely, it just kept growing faster than my head could comprehend so I gave up for a considerable period of time. Then I decided it is an AI here and there so I used Claude (drop tomatoes\shit at me) to finish what I have started. I designed what I wanted and Claude helped me write, test and polish it into something that i think might be useful. Aaaaaannndd...it works! I've tested it end on my demo AD by creating OUs, users and groups, changing them, moving them around, adopting existing objects and cleaning up again and etc. Directory is described like this: ou "staff" { name = "Staff" } user "jdoe" { given_name = "John" surname = "Doe" path = ou.staff.dn } group "engineering" { name = "Engineering" path = ou.staff.dn members = [user.jdoe.dn] } Then run declarad plan to see changes, and declarad apply to apply it. What it can do? - OUs, containers, groups, users, computers, contacts, gMSAs, fine-grained password policies, GPO links, and AD-integrated DNS zones and records - The full HCL language support such as variables, for_each, count, modules (local or from git), and the functions you know from the Terraform - Ability to export your existing AD into configuration files, then take it under management with --adopt, so you don't have to start from scratch - Shared state with locking which support local file, S3, Azure Blob Storage or HTTP (e.g. GitLab) - Several domains from one configuration - It never silently takes over existing objects, OUs stay protected from deletion, and attributes you don't manage are left alone - It talks LDAP/LDAPS directly to your DCs, so it runs on Windows, Linux and macOS. No RSAT, PowerShell or WinRM needed. - Is CI-friendly: plan --detailed-exitcode for drift detection, fmt --check, validate And yes! I'm aware of Terraform and its Active Directory provider! I tried it and it hasn't been well maintained for a long time, it covers only a small part of what can be needed day to day, and it depends on WinRM and PowerShell on the Windows side. I didn't want another wrapper around a general purpose tool. I wanted a tool designed specifically for Active Directory from scratch. It's free and open source: akshinmustafayev/declarad There are ready-made binaries for Windows, Linux and macOS on the Releases page, documentation, and examples from "one user" up to a multi-site enterprise layout. Please be gentle with it. It's a 0.x release, so try it on a lab domain or a test OU first, and always read the plan before you apply. Every addition, change and contribution is very, very welcome! Bug reports, ideas, "this doesn't work in my environment", docs fixes, new resource types, pull requests: all of it. I'd love for this to grow into something useful for all of us who look after AD. Thanks for reading, and I'd really love to hear what you think!