server: reject LDAP equality filters on list custom attributes with UnwillingToPerform error

fix: percent-decode user_id route params for users with spaces in ID (#585 )
chore: fmt and clippy
2026-06-19 20:49:36 +00:00 · 2026-05-27 00:06:55 +02:00 · 2026-05-26 23:42:08 +02:00 · 2026-05-26 23:37:26 +02:00 · 2026-05-26 12:48:32 +02:00 · 2026-05-26 00:28:34 +02:00
121 changed files with 7343 additions and 4911 deletions
--- a/.coderabbit.yml
+++ b/.coderabbit.yml
@@ -0,0 +1,46 @@
+# docs: https://docs.coderabbit.ai/reference/yaml-template for full configuration options
+tone_instructions: "Be concise"
+
+reviews:
+  profile: "chill"
+  high_level_summary: false
+  review_status: false
+  commit_status: false 
+  collapse_walkthrough: true
+  changed_files_summary: false
+  sequence_diagrams: false
+  estimate_code_review_effort: false
+  assess_linked_issues: false
+  related_issues: false
+  related_prs: false
+  suggested_labels: false
+  suggested_reviewers: false
+  poem: false
+  auto_review:
+    enabled: true
+    auto_incremental_review: true
+  finishing_touches:
+    docstrings:
+      enabled: false
+    unit_tests:
+      enabled: false
+
+  pre_merge_checks:
+    docstrings:
+      mode: "off"
+    title:
+      mode: "off"
+    description:
+      mode: "off"
+    issue_assessment:
+      mode: "off"
+
+chat:
+  art: false
+  auto_reply: false
+
+knowledge_base:
+  web_search:
+    enabled: true
+  code_guidelines:
+    enabled: false
--- a/.devcontainer/Dockerfile
+++ b/.devcontainer/Dockerfile
@@ -1,4 +1,4 @@
-FROM rust:1.85
+FROM rust:1.89

 ARG USERNAME=lldapdev
 # We need to keep the user as 1001 to match the GitHub runner's UID.
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -1,8 +1,26 @@
 {
 	"name": "LLDAP dev",
-	"build": { "dockerfile": "Dockerfile" },
+	"build": {
+		"dockerfile": "Dockerfile"
+	},
+	"customizations": {
+		"vscode": {
+			"extensions": [
+				"rust-lang.rust-analyzer"
+			],
+			"settings": {
+				"rust-analyzer.linkedProjects": [
+					"./Cargo.toml"
+				]
+			}
+		}
+	},
+	"features": {
+		"ghcr.io/devcontainers/features/rust:1": {}
+	},
 	"forwardPorts": [
 		3890,
 		17170
-	]
+	],
+	"remoteUser": "lldapdev"
 }
--- a/.envrc
+++ b/.envrc
@@ -0,0 +1 @@
+use flake
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1 +0,0 @@
-* @nitnelave
--- a/.github/codecov.yml
+++ b/.github/codecov.yml
@@ -1,19 +1,16 @@
 codecov:
  require_ci_to_pass: yes
 comment:
-  layout: "header,diff,files"
-  require_changes: true
-  require_base: true
-  require_head: true
+  layout: "condensed_header, diff, condensed_files"
+  hide_project_coverage: true
+  require_changes: "coverage_drop"
 coverage:
+  range: "70...100"
  status:
    project:
      default:
        target: "75%"
-        threshold: "0.1%"
-        removed_code_behavior: adjust_base
-github_checks:
-  annotations: true
+        threshold: 5
 ignore:
  - "app"
  - "docs"
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -0,0 +1,159 @@
+# LLDAP - Light LDAP implementation for authentication
+
+LLDAP is a lightweight LDAP authentication server written in Rust with a WebAssembly frontend. It provides an opinionated, simplified LDAP interface for authentication and integrates with many popular services.
+
+**ALWAYS reference these instructions first and fallback to search or bash commands only when you encounter unexpected information that does not match the info here.**
+
+## Working Effectively
+
+### Bootstrap and Build the Repository
+- Install dependencies: `sudo apt-get update && sudo apt-get install -y curl gzip binaryen`
+- Install Rust if not available: `curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh` then `source ~/.cargo/env`
+- Install wasm-pack for frontend: `cargo install wasm-pack` -- takes 90 seconds. NEVER CANCEL. Set timeout to 180+ seconds.
+- Build entire workspace: `cargo build --workspace` -- takes 3-4 minutes. NEVER CANCEL. Set timeout to 300+ seconds.
+- Build release server binary: `cargo build --release -p lldap` -- takes 5-6 minutes. NEVER CANCEL. Set timeout to 420+ seconds.
+- Build frontend WASM: `./app/build.sh` -- takes 3-4 minutes including wasm-pack installation. NEVER CANCEL. Set timeout to 300+ seconds.
+
+### Testing and Validation
+- Run all tests: `cargo test --workspace` -- takes 2-3 minutes. NEVER CANCEL. Set timeout to 240+ seconds.
+- Check formatting: `cargo fmt --all --check` -- takes <5 seconds.
+- Run linting: `cargo clippy --tests --all -- -D warnings` -- takes 60-90 seconds. NEVER CANCEL. Set timeout to 120+ seconds.
+- Export GraphQL schema: `./export_schema.sh` -- takes 70-80 seconds. NEVER CANCEL. Set timeout to 120+ seconds.
+
+### Running the Application
+- **ALWAYS run the build steps first before starting the server.**
+- Start development server: `cargo run -- run --config-file <config_file>`
+- **CRITICAL**: Server requires a valid configuration file. Use `lldap_config.docker_template.toml` as reference.
+- **CRITICAL**: Avoid key conflicts by removing existing `server_key*` files when testing with `key_seed` in config.
+- Server binds to:
+  - LDAP: port 3890 (configurable)
+  - Web interface: port 17170 (configurable)
+  - LDAPS: port 6360 (optional, disabled by default)
+
+### Manual Validation Requirements
+- **ALWAYS test both LDAP and web interfaces after making changes.**
+- Test web interface: `curl -s http://localhost:17170/` should return HTML with "LLDAP Administration" title.
+- Test GraphQL API: `curl -s -X POST -H "Content-Type: application/json" -d '{"query": "query { __schema { queryType { name } } }"}' http://localhost:17170/api/graphql`
+- Run healthcheck: `cargo run -- healthcheck --config-file <config_file>` (requires running server)
+- **ALWAYS ensure server starts without errors and serves the web interface before considering changes complete.**
+
+## Validation Scenarios
+
+After making code changes, ALWAYS:
+1. **Build validation**: Run `cargo build --workspace` to ensure compilation succeeds.
+2. **Test validation**: Run `cargo test --workspace` to ensure existing functionality works.
+3. **Lint validation**: Run `cargo clippy --tests --all -- -D warnings` to catch potential issues.
+4. **Format validation**: Run `cargo fmt --all --check` to ensure code style compliance.
+5. **Frontend validation**: Run `./app/build.sh` to ensure WASM compilation succeeds.
+6. **Runtime validation**: Start the server and verify web interface accessibility.
+7. **Schema validation**: If GraphQL changes made, run `./export_schema.sh` to update schema.
+
+### Test User Scenarios
+- **Login flow**: Access web interface at `http://localhost:17170`, attempt login with admin/password (default).
+- **LDAP binding**: Test LDAP connection on port 3890 with appropriate LDAP tools if available.
+- **Configuration changes**: Test with different configuration files to validate config parsing.
+
+## Project Structure and Key Components
+
+### Backend (Rust)
+- **Server**: `/server` - Main application binary
+- **Crates**: `/crates/*` - Modularized components:
+  - `auth` - Authentication and OPAQUE protocol
+  - `domain*` - Domain models and handlers  
+  - `ldap` - LDAP protocol implementation
+  - `graphql-server` - GraphQL API server
+  - `sql-backend-handler` - Database operations
+  - `validation` - Input validation utilities
+
+### Frontend (Rust + WASM)
+- **App**: `/app` - Yew-based WebAssembly frontend
+- **Build**: `./app/build.sh` - Compiles Rust to WASM using wasm-pack
+- **Assets**: `/app/static` - Static web assets
+
+### Configuration and Deployment
+- **Config template**: `lldap_config.docker_template.toml` - Reference configuration
+- **Docker**: `Dockerfile` - Container build definition
+- **Scripts**: 
+  - `prepare-release.sh` - Cross-platform release builds
+  - `export_schema.sh` - GraphQL schema export
+  - `generate_secrets.sh` - Random secret generation
+  - `scripts/bootstrap.sh` - User/group management script
+
+## Common Development Workflows
+
+### Making Backend Changes
+1. Edit Rust code in `/server` or `/crates`
+2. Run `cargo build --workspace` to test compilation
+3. Run `cargo test --workspace` to ensure tests pass
+4. Run `cargo clippy --tests --all -- -D warnings` to check for warnings
+5. If GraphQL schema affected, run `./export_schema.sh`
+6. Test by running server and validating functionality
+
+### Making Frontend Changes  
+1. Edit code in `/app/src`
+2. Run `./app/build.sh` to rebuild WASM package
+3. Start server and test web interface functionality
+4. Verify no JavaScript errors in browser console
+
+### Adding New Dependencies
+- Backend: Add to appropriate `Cargo.toml` in `/server` or `/crates/*`
+- Frontend: Add to `/app/Cargo.toml`
+- **Always rebuild after dependency changes**
+
+## CI/CD Integration
+
+The repository uses GitHub Actions (`.github/workflows/rust.yml`):
+- **Build job**: Validates workspace compilation
+- **Test job**: Runs full test suite  
+- **Clippy job**: Linting with warnings as errors
+- **Format job**: Code formatting validation
+- **Coverage job**: Code coverage analysis
+
+**ALWAYS ensure your changes pass all CI checks by running equivalent commands locally.**
+
+## Timing Expectations and Timeouts
+
+| Command | Expected Time | Timeout Setting |
+|---------|---------------|-----------------|
+| `cargo build --workspace` | 3-4 minutes | 300+ seconds |
+| `cargo build --release -p lldap` | 5-6 minutes | 420+ seconds |
+| `cargo test --workspace` | 2-3 minutes | 240+ seconds |
+| `./app/build.sh` | 3-4 minutes | 300+ seconds |
+| `cargo clippy --tests --all -- -D warnings` | 60-90 seconds | 120+ seconds |
+| `./export_schema.sh` | 70-80 seconds | 120+ seconds |
+| `cargo install wasm-pack` | 90 seconds | 180+ seconds |
+
+**NEVER CANCEL** any of these commands. Builds may take longer on slower systems.
+
+## Troubleshooting Common Issues
+
+### Build Issues
+- **Missing wasm-pack**: Run `cargo install wasm-pack`
+- **Missing binaryen**: Run `sudo apt-get install -y binaryen` or disable wasm-opt
+- **Clippy warnings**: Fix all warnings as they are treated as errors in CI
+- **GraphQL schema mismatch**: Run `./export_schema.sh` to update schema
+
+### Runtime Issues
+- **Key conflicts**: Remove `server_key*` files when using `key_seed` in config
+- **Port conflicts**: Check if ports 3890/17170 are available
+- **Database issues**: Ensure database URL in config is valid and accessible
+- **Asset missing**: Ensure frontend is built with `./app/build.sh`
+
+### Development Environment
+- **Rust version**: Use stable Rust toolchain (2024 edition)
+- **System dependencies**: curl, gzip, build tools
+- **Database**: SQLite (default), MySQL, or PostgreSQL supported
+
+## Configuration Reference
+
+Essential configuration parameters:
+- `ldap_base_dn`: LDAP base DN (e.g., "dc=example,dc=com")
+- `ldap_user_dn`: Admin user DN 
+- `ldap_user_pass`: Admin password
+- `jwt_secret`: Secret for JWT tokens (generate with `./generate_secrets.sh`)
+- `key_seed`: Encryption key seed
+- `database_url`: Database connection string
+- `http_port`: Web interface port (default: 17170)
+- `ldap_port`: LDAP server port (default: 3890)
+
+**Always use the provided config template as starting point for new configurations.**
--- a/.github/copilot-setup-steps.yml
+++ b/.github/copilot-setup-steps.yml
@@ -0,0 +1,26 @@
+name: Copilot Setup Steps for LLDAP Development
+
+steps:
+  - name: Update package list
+    run: sudo apt-get update
+
+  - name: Install system dependencies
+    run: sudo apt-get install -y curl gzip binaryen build-essential
+
+  - name: Install Rust toolchain
+    run: |
+      curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+      source ~/.cargo/env
+      echo 'source ~/.cargo/env' >> ~/.bashrc
+
+  - name: Install wasm-pack for frontend builds
+    run: |
+      source ~/.cargo/env
+      cargo install wasm-pack
+
+  - name: Verify installations
+    run: |
+      source ~/.cargo/env
+      rustc --version
+      cargo --version
+      wasm-pack --version
--- a/.github/workflows/Dockerfile.ci.alpine-base
+++ b/.github/workflows/Dockerfile.ci.alpine-base
@@ -59,7 +59,7 @@ RUN set -x \
    && for file in $(cat /lldap/app/static/fonts/fonts.txt); do wget -P app/static/fonts "$file"; done \
    && chmod a+r -R .

-FROM alpine:3.19
+FROM alpine:3.22
 WORKDIR /app
 ENV UID=1000
 ENV GID=1000
--- a/.github/workflows/Dockerfile.dev
+++ b/.github/workflows/Dockerfile.dev
@@ -1,5 +1,5 @@
 # Keep tracking base image
-FROM rust:1.85-slim-bookworm
+FROM rust:1.91-slim-bookworm

 # Set needed env path
 ENV PATH="/opt/armv7l-linux-musleabihf-cross/:/opt/armv7l-linux-musleabihf-cross/bin/:/opt/aarch64-linux-musl-cross/:/opt/aarch64-linux-musl-cross/bin/:/opt/x86_64-linux-musl-cross/:/opt/x86_64-linux-musl-cross/bin/:$PATH"
--- a/.github/workflows/docker-build-static.yml
+++ b/.github/workflows/docker-build-static.yml
@@ -24,7 +24,7 @@ on:

 env:
  CARGO_TERM_COLOR: always
-
+  MSRV: "1.91.0"

 ### CI Docs

@@ -87,8 +87,14 @@ jobs:
      image: lldap/rust-dev:latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v5.0.0
-      - uses: actions/cache@v4
+        uses: actions/checkout@v6.0.2
+      - name: Install Rust
+        id: toolchain
+        uses: dtolnay/rust-toolchain@master
+        with:
+            toolchain: "${{ env.MSRV }}"
+            targets: "wasm32-unknown-unknown"
+      - uses: actions/cache@v5
        with:
          path: |
            /usr/local/cargo/bin
@@ -99,10 +105,8 @@ jobs:
          key: lldap-ui-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            lldap-ui-
-      - name: Add wasm target (rust)
-        run: rustup target add wasm32-unknown-unknown
      - name: Install wasm-pack with cargo
-        run: cargo install wasm-pack || true
+        run: cargo install --locked wasm-pack || true
        env:
          RUSTFLAGS: ""
      - name: Build frontend
@@ -110,7 +114,7 @@ jobs:
      - name: Check build path
        run: ls -al app/
      - name: Upload ui artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: ui
          path: app/
@@ -132,8 +136,14 @@ jobs:
        CARGO_HOME: ${GITHUB_WORKSPACE}/.cargo
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v5.0.0
-      - uses: actions/cache@v4
+        uses: actions/checkout@v6.0.2
+      - name: Install Rust
+        id: toolchain
+        uses: dtolnay/rust-toolchain@master
+        with:
+            toolchain: "${{ env.MSRV }}"
+            targets: "${{ matrix.target }}"
+      - uses: actions/cache@v5
        with:
          path: |
            .cargo/bin
@@ -149,17 +159,17 @@ jobs:
      - name: Check path
        run: ls -al target/release
      - name: Upload ${{ matrix.target}} lldap artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: ${{ matrix.target}}-lldap-bin
          path: target/${{ matrix.target }}/release/lldap
      - name: Upload ${{ matrix.target }} migration tool artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: ${{ matrix.target }}-lldap_migration_tool-bin
          path: target/${{ matrix.target }}/release/lldap_migration_tool
      - name: Upload ${{ matrix.target }} password tool artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: ${{ matrix.target }}-lldap_set_password-bin
          path: target/${{ matrix.target }}/release/lldap_set_password
@@ -199,7 +209,7 @@ jobs:

    steps:
       - name: Download artifacts
-         uses: actions/download-artifact@v4
+         uses: actions/download-artifact@v8
         with:
           name: x86_64-unknown-linux-musl-lldap-bin
           path: bin/
@@ -300,18 +310,18 @@ jobs:

    steps:
       - name: Checkout scripts
-         uses: actions/checkout@v5.0.0
+         uses: actions/checkout@v6.0.2
         with:
           sparse-checkout: 'scripts'

       - name: Download LLDAP artifacts
-         uses: actions/download-artifact@v4
+         uses: actions/download-artifact@v8
         with:
           name: x86_64-unknown-linux-musl-lldap-bin
           path: bin/

       - name: Download LLDAP set password
-         uses: actions/download-artifact@v4
+         uses: actions/download-artifact@v8
         with:
           name: x86_64-unknown-linux-musl-lldap_set_password-bin
           path: bin/
@@ -496,21 +506,21 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v5.0.0
+        uses: actions/checkout@v6.0.2

      - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
        with:
          path: bin

      - name: Download llap ui artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
        with:
          name: ui
          path: web

      - name: Setup QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
      - name: Setup buildx
        uses: docker/setup-buildx-action@v3
        with:
@@ -681,7 +691,7 @@ jobs:
       contents: write
     steps:
      - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
        with:
          path: bin/
      - name: Check file
@@ -702,7 +712,7 @@ jobs:
             chmod +x bin/*-lldap_set_password

      - name: Download llap ui artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
        with:
          name: ui
          path: web
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -8,6 +8,7 @@ on:

 env:
  CARGO_TERM_COLOR: always
+  MSRV: "1.91.0"

 jobs:
  pre_job:
@@ -33,14 +34,19 @@ jobs:

    steps:
      - name: Checkout sources
-        uses: actions/checkout@v5.0.0
+        uses: actions/checkout@v6.0.2
+      - name: Install Rust
+        id: toolchain
+        uses: dtolnay/rust-toolchain@master
+        with:
+            toolchain: "${{ env.MSRV }}"
      - uses: Swatinem/rust-cache@v2
      - name: Build
-        run: cargo build --verbose --workspace
+        run: cargo +${{steps.toolchain.outputs.name}} build --verbose --workspace
      - name: Run tests
-        run: cargo test --verbose --workspace
+        run: cargo +${{steps.toolchain.outputs.name}} test --verbose --workspace
      - name: Generate GraphQL schema
-        run: cargo run -- export_graphql_schema -o generated_schema.graphql
+        run: cargo +${{steps.toolchain.outputs.name}} run -- export_graphql_schema -o generated_schema.graphql
      - name: Check schema
        run: diff schema.graphql generated_schema.graphql || (echo "The schema file is out of date. Please run `./export_schema.sh`" && false)

@@ -52,15 +58,15 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout sources
-        uses: actions/checkout@v5.0.0
-
-      - uses: Swatinem/rust-cache@v2
-
-      - name: Run cargo clippy
-        uses: actions-rs/cargo@v1
+        uses: actions/checkout@v6.0.2
+      - name: Install Rust
+        id: toolchain
+        uses: dtolnay/rust-toolchain@master
        with:
-          command: clippy
-          args: --tests --all -- -D warnings
+            toolchain: "${{ env.MSRV }}"
+            components: clippy
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo +${{steps.toolchain.outputs.name}} clippy --tests --workspace -- -D warnings

  format:
    name: cargo fmt
@@ -69,15 +75,15 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout sources
-        uses: actions/checkout@v5.0.0
-
-      - uses: Swatinem/rust-cache@v2
-
-      - name: Run cargo fmt
-        uses: actions-rs/cargo@v1
+        uses: actions/checkout@v6.0.2
+      - name: Install Rust
+        id: toolchain
+        uses: dtolnay/rust-toolchain@master
        with:
-          command: fmt
-          args: --all -- --check
+            toolchain: "${{ env.MSRV }}"
+            components: rustfmt
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo +${{steps.toolchain.outputs.name}} fmt --check --all

  coverage:
    name: Code coverage
@@ -88,7 +94,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout sources
-        uses: actions/checkout@v5.0.0
+        uses: actions/checkout@v6.0.2

      - name: Install Rust
        run: rustup toolchain install nightly --component llvm-tools-preview && rustup component add llvm-tools-preview --toolchain stable-x86_64-unknown-linux-gnu
--- a/.gitignore
+++ b/.gitignore
@@ -29,3 +29,8 @@ recipe.json
 lldap_config.toml
 cert.pem
 key.pem
+
+# Nix
+result
+result-*
+.direnv
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,55 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

+## [0.6.3] 2026-05-01
+
+Small release, focused on LDAP compatibility, TLS maintenance, dependency upgrades and documentation/examples.
+
+### Added
+
+ - LDAP schema definitions for `memberOf`, `modifyTimestamp` and `pwdChangedTime`
+ - Support for configuring the healthcheck listen addresses
+ - Usernames are now included in password recovery emails
+
+### Changed
+
+ - JWT `exp` and `iat` claims are now serialized as NumericDate values to comply with RFC7519
+ - Migrated to `rustls` 0.23 and centralized TLS handling
+ - The login form no longer enforces a password length limit
+
+### Fixed
+
+ - `pwdChangedTime` is now emitted as LDAP GeneralizedTime instead of RFC3339
+ - LDAP base-scope searches for non-existent entries now return `NoSuchObject`
+ - `cn` equality filters are now case insensitive
+ - The server now shuts down the database connection pool gracefully
+ - The bootstrap script now handles empty globs correctly
+
+### Security
+
+ - Updated the LDAP dependency stack, including `ldap3_proto`, in response to
+   security advisory
+   [`GHSA-qcxq-75wr-5cm8`](https://github.com/kanidm/ldap3/security/advisories/GHSA-qcxq-75wr-5cm8),
+   where a specially crafted LDAP query could make the server crash
+
+### Cleanups
+
+ - Split GraphQL queries and mutations into smaller modules
+ - Refactored configuration and user update logic
+ - Upgraded the Rust toolchain and shared dependencies
+
+### New services
+
+ - Apache WebDAV
+ - Continuwuity
+ - Gerrit
+ - Gogs
+ - Open WebUI
+ - OpenCloud
+ - Pocket ID
+ - Semaphore
+ - TrueNAS
+
 ## [0.6.2] 2025-07-21

 Small release, focused on LDAP improvements and ongoing maintenance.
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -46,7 +46,9 @@ advanced guides (scripting, migrations, ...) you can contribute to.
 ### Code

 If you don't know what to start with, check out the 
-[good first issues](https://github.com/lldap/lldap/labels/good%20first%20issue). 
+[good first issues](https://github.com/lldap/lldap/labels/good%20first%20issue).
+
+For an alternative development environment setup, see [docs/nix-development.md](docs/nix-development.md). 

 Otherwise, if you want to fix a specific bug or implement a feature, make sure
 to start by creating an issue for it (if it doesn't already exist). There, we
--- a/Cargo.lock
+++ b/Cargo.lock
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -16,6 +16,7 @@ edition = "2024"
 homepage = "https://github.com/lldap/lldap"
 license = "GPL-3.0-only"
 repository = "https://github.com/lldap/lldap"
+rust-version = "1.91.0"

 [profile.release]
 lto = true
@@ -23,12 +24,122 @@ lto = true
 [profile.release.package.lldap_app]
 opt-level = 's'

-[patch.crates-io.lber]
-git = 'https://github.com/inejge/ldap3/'
+[workspace.dependencies.anyhow]
+version = "1"
+
+[workspace.dependencies.async-trait]
+version = "0.1"
+
+[workspace.dependencies.base64]
+version = "0.22"
+
+[workspace.dependencies.bincode]
+version = "1"
+
+[workspace.dependencies.chrono]
+version = "0.4"
+features = ["serde", "wasmbind"]
+
+[workspace.dependencies.clap]
+version = "4"
+features = ["std", "color", "suggestions", "derive", "env"]
+
+[workspace.dependencies.derive_more]
+version = "2"
+default-features = false
+features = ["debug", "display", "from", "from_str"]
+
+[workspace.dependencies.graphql_client]
+version = "0.11"
+default-features = false
+features = ["graphql_query_derive"]
+
+[workspace.dependencies.image]
+version = "0.25"
+default-features = false
+features = ["jpeg"]
+
+[workspace.dependencies.itertools]
+version = "0.14"
+
+[workspace.dependencies.juniper]
+version = "0.17"
+default-features = false
+features = ["chrono", "schema-language", "url", "uuid"]
+
+[workspace.dependencies.ldap3]
+version = "0"
+default-features = false
+features = ["sync", "tls-rustls-ring"]
+
+[workspace.dependencies.ldap3_proto]
+version = "0.7"
+
+[workspace.dependencies.jwt]
+version = "0.16"
+
+[workspace.dependencies.log]
+version = "0"
+
+[workspace.dependencies.mockall]
+version = "0.14"
+
+[workspace.dependencies.opaque-ke]
+version = "0.7"
+
+[workspace.dependencies.orion]
+version = "0.17"
+
+[workspace.dependencies.pretty_assertions]
+version = "1"
+
+[workspace.dependencies.rand]
+version = "0.8"
+features = ["small_rng", "getrandom"]
+
+[workspace.dependencies.reqwest]
+version = "0.11"
+default-features = false

 [workspace.dependencies.sea-orm]
 version = "1.1.8"
 default-features = false
+features = ["macros", "with-chrono", "with-uuid", "sqlx-all", "runtime-actix-rustls"]
+
+[workspace.dependencies.secstr]
+version = "0"
+features = ["serde"]

 [workspace.dependencies.serde]
 version = "1"
+
+[workspace.dependencies.serde_bytes]
+version = "0.11"
+
+[workspace.dependencies.serde_json]
+version = "1"
+
+[workspace.dependencies.strum]
+version = "0.28"
+features = ["derive"]
+
+[workspace.dependencies.thiserror]
+version = "2"
+
+[workspace.dependencies.tokio]
+version = "1"
+features = ["full"]
+
+[workspace.dependencies.tracing]
+version = "0"
+
+[workspace.dependencies.tracing-subscriber]
+version = "0.3"
+features = ["env-filter", "tracing-log"]
+
+[workspace.dependencies.urlencoding]
+version = "2"
+
+[workspace.dependencies.uuid]
+version = "1.18.1"
+features = ["js", "serde", "v1", "v3", "v4"]
--- a/README.md
+++ b/README.md
@@ -83,7 +83,7 @@ MySQL/MariaDB or PostgreSQL.

 ## Installation

-It's possible to install lldap from OCI images ([docker](docs/install.md#with-docker)/[podman](docs/install.md#with-podman)), from [Kubernetes](docs/install.md#with-kubernetes), or from [a regular distribution package manager](docs/install.md/#from-a-package-repository) (Archlinux, Debian, CentOS, Fedora, OpenSuse, Ubuntu, FreeBSD).
+It's possible to install lldap from OCI images ([docker](docs/install.md#with-docker)/[podman](docs/install.md#with-podman)), from [Kubernetes](docs/install.md#with-kubernetes), [TrueNAS](docs/install.md#truenas-scale), or from [a regular distribution package manager](docs/install.md/#from-a-package-repository) (Archlinux, Debian, CentOS, Fedora, OpenSuse, Ubuntu, FreeBSD).

 Building [from source](docs/install.md#from-source) and [cross-compiling](docs/install.md#cross-compilation) to a different hardware architecture is also supported.

@@ -145,7 +145,7 @@ the relevant details (logs of the service, LLDAP logs with `verbose=true` in
 the config).

 Some specific clients have been tested to work and come with sample
-configuration files, or guides. See the [`example_configs`](example_configs)
+configuration files, or guides. See the [`example_configs`](example_configs/README.md)
 folder for example configs for integration with specific services.

 Integration with Linux accounts is possible, through PAM and nslcd. See [PAM
--- a/app/Cargo.toml
+++ b/app/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "lldap_app"
-version = "0.6.2"
+version = "0.6.3"
 description = "Frontend for LLDAP"
 edition.workspace = true
 include = ["src/**/*", "queries/**/*", "Cargo.toml", "../schema.graphql"]
@@ -8,29 +8,37 @@ authors.workspace = true
 homepage.workspace = true
 license.workspace = true
 repository.workspace = true
+rust-version.workspace = true

 [dependencies]
-anyhow = "1"
-base64 = "0.13"
-gloo-console = "0.2.3"
-gloo-file = "0.2.3"
-gloo-net = "*"
-graphql_client = "0.10"
-http = "0.2"
-jwt = "0.13"
-rand = "0.8"
-serde_json = "1"
+anyhow = { workspace = true }
+chrono = { workspace = true }
+derive_more = { workspace = true }
+gloo-console = "0.4"
+gloo-file = "0.4"
+gloo-net = "0.7"
+graphql_client = { workspace = true }
+image = { workspace = true }
+jwt = { workspace = true }
+rand = { workspace = true }
+serde = { workspace = true }
+serde_json = { workspace = true }
+strum = { workspace = true }
+percent-encoding = "2"
 url-escape = "0.1.1"
 validator = "0.14"
 validator_derive = "0.14"
 wasm-bindgen = "0.2.100"
-wasm-bindgen-futures = "*"
+wasm-bindgen-futures = "0"
 yew = "0.19.3"
 yew-router = "0.16"

 # Needed because of https://github.com/tkaitchuck/aHash/issues/95
 indexmap = "=1.6.2"

+base64 = { workspace = true }
+
+
 [dependencies.web-sys]
 version = "0.3"
 features = [
@@ -49,17 +57,6 @@ features = [
  "console",
 ]

-[dependencies.chrono]
-version = "*"
-features = [
-  "wasmbind"
-]
-
-[dependencies.derive_more]
-features = ["debug", "display", "from", "from_str"]
-default-features = false
-version = "1"
-
 [dependencies.lldap_auth]
 path = "../crates/auth"
 features = [ "opaque_client" ]
@@ -70,18 +67,6 @@ path = "../crates/frontend-options"
 [dependencies.lldap_validation]
 path = "../crates/validation"

-[dependencies.image]
-features = ["jpeg"]
-default-features = false
-version = "0.24"
-
-[dependencies.serde]
-workspace = true
-
-[dependencies.strum]
-features = ["derive"]
-version = "0.25"
-
 [dependencies.yew_form]
 git = "https://github.com/jfbilodeau/yew_form"
 rev = "4b9fabffb63393ec7626a4477fd36de12a07fac9"
--- a/app/src/components/app.rs
+++ b/app/src/components/app.rs
@@ -183,6 +183,16 @@ impl App {
        }
    }

+    /// Percent-decode a URL path segment into a user ID string.
+    /// Returns `None` if the decoded bytes are not valid UTF-8, so the caller
+    /// can redirect to a safe page rather than silently mangling the ID.
+    fn decode_user_id(raw: &str) -> Option<String> {
+        percent_encoding::percent_decode_str(raw)
+            .decode_utf8()
+            .ok()
+            .map(|s| s.into_owned())
+    }
+
    fn dispatch_route(
        switch: &AppRoute,
        link: &Scope<Self>,
@@ -197,17 +207,19 @@ impl App {
                <CreateUserForm/>
            },
            AppRoute::Index | AppRoute::ListUsers => {
-                let user_button = html! {
-                  <Link classes="btn btn-primary" to={AppRoute::CreateUser}>
-                    <i class="bi-person-plus me-2"></i>
-                    {"Create a user"}
-                  </Link>
+                let user_button = |key| {
+                    html! {
+                      <Link classes="btn btn-primary" key={key} to={AppRoute::CreateUser}>
+                        <i class="bi-person-plus me-2"></i>
+                        {"Create a user"}
+                      </Link>
+                    }
                };
                html! {
                  <div>
-                    { user_button.clone() }
+                    { user_button("top-create-user") }
                    <UserTable />
-                    { user_button }
+                    { user_button("bottom-create-user") }
                  </div>
                }
            }
@@ -221,19 +233,19 @@ impl App {
                <CreateGroupAttributeForm/>
            },
            AppRoute::ListGroups => {
-                let group_button = html! {
-                  <Link classes="btn btn-primary" to={AppRoute::CreateGroup}>
-                    <i class="bi-plus-circle me-2"></i>
-                    {"Create a group"}
-                  </Link>
+                let group_button = |key| {
+                    html! {
+                      <Link classes="btn btn-primary" key={key} to={AppRoute::CreateGroup}>
+                        <i class="bi-plus-circle me-2"></i>
+                        {"Create a group"}
+                      </Link>
+                    }
                };
-                // Note: There's a weird bug when switching from the users page to the groups page
-                // where the two groups buttons are at the bottom. I don't know why.
                html! {
                  <div>
-                    { group_button.clone() }
+                    { group_button("top-create-group") }
                    <GroupTable />
-                    { group_button }
+                    { group_button("bottom-create-group") }
                  </div>
                }
            }
@@ -246,11 +258,17 @@ impl App {
            AppRoute::GroupDetails { group_id } => html! {
                <GroupDetails group_id={*group_id} is_admin={is_admin} />
            },
-            AppRoute::UserDetails { user_id } => html! {
-                <UserDetails username={user_id.clone()} is_admin={is_admin} />
+            AppRoute::UserDetails { user_id } => match Self::decode_user_id(user_id) {
+                Some(decoded_id) => html! {
+                    <UserDetails username={decoded_id} is_admin={is_admin} />
+                },
+                None => html! { <Redirect to={AppRoute::Login} /> },
            },
-            AppRoute::ChangePassword { user_id } => html! {
-                <ChangePasswordForm username={user_id.clone()} is_admin={is_admin} />
+            AppRoute::ChangePassword { user_id } => match Self::decode_user_id(user_id) {
+                Some(decoded_id) => html! {
+                    <ChangePasswordForm username={decoded_id} is_admin={is_admin} />
+                },
+                None => html! { <Redirect to={AppRoute::Login} /> },
            },
            AppRoute::StartResetPassword => match password_reset_enabled {
                Some(true) => html! { <ResetPasswordStep1Form /> },
--- a/app/src/components/create_group.rs
+++ b/app/src/components/create_group.rs
@@ -112,7 +112,7 @@ impl CommonComponent<CreateGroupForm> for CreateGroupForm {
                let model = self.form.model();
                let req = create_group::Variables {
                    group: create_group::CreateGroupInput {
-                        displayName: model.groupname,
+                        display_name: model.groupname,
                        attributes,
                    },
                };
--- a/app/src/components/create_user.rs
+++ b/app/src/components/create_user.rs
@@ -143,9 +143,9 @@ impl CommonComponent<CreateUserForm> for CreateUserForm {
                    user: create_user::CreateUserInput {
                        id: model.username,
                        email: None,
-                        displayName: None,
-                        firstName: None,
-                        lastName: None,
+                        display_name: None,
+                        first_name: None,
+                        last_name: None,
                        avatar: None,
                        attributes,
                    },
@@ -304,11 +304,14 @@ impl Component for CreateUserForm {
 }

 fn get_custom_attribute_input(attribute_schema: &Attribute) -> Html {
+    let mail_is_required = attribute_schema.name.as_str() == "mail";
+
    if attribute_schema.is_list {
        html! {
            <ListAttributeInput
                name={attribute_schema.name.clone()}
                attribute_type={attribute_schema.attribute_type}
+                required={mail_is_required}
            />
        }
    } else {
@@ -316,6 +319,7 @@ fn get_custom_attribute_input(attribute_schema: &Attribute) -> Html {
            <SingleAttributeInput
                name={attribute_schema.name.clone()}
                attribute_type={attribute_schema.attribute_type}
+                required={mail_is_required}
            />
        }
    }
--- a/app/src/components/form/attribute_input.rs
+++ b/app/src/components/form/attribute_input.rs
@@ -45,6 +45,8 @@ fn attribute_input(props: &AttributeInputProps) -> Html {
 #[derive(Properties, PartialEq)]
 struct AttributeLabelProps {
    pub name: String,
+    #[prop_or(false)]
+    pub required: bool,
 }
 #[function_component(AttributeLabel)]
 fn attribute_label(props: &AttributeLabelProps) -> Html {
@@ -66,7 +68,9 @@ fn attribute_label(props: &AttributeLabelProps) -> Html {
        <label for={props.name.clone()}
            class="form-label col-4 col-form-label"
            >
-            {props.name[0..1].to_uppercase() + &props.name[1..].replace('_', " ")}{":"}
+            {props.name[0..1].to_uppercase() + &props.name[1..].replace('_', " ")}
+            {if props.required { html!{<span class="text-danger">{"*"}</span>} } else { html!{} }}
+            {":"}
            <button
                class="btn btn-sm btn-link"
                type="button"
@@ -85,13 +89,15 @@ pub struct SingleAttributeInputProps {
    pub(crate) attribute_type: AttributeType,
    #[prop_or(None)]
    pub value: Option<String>,
+    #[prop_or(false)]
+    pub required: bool,
 }

 #[function_component(SingleAttributeInput)]
 pub fn single_attribute_input(props: &SingleAttributeInputProps) -> Html {
    html! {
        <div class="row mb-3">
-            <AttributeLabel name={props.name.clone()} />
+            <AttributeLabel name={props.name.clone()} required={props.required} />
            <div class="col-8">
            <AttributeInput
                attribute_type={props.attribute_type}
@@ -108,6 +114,8 @@ pub struct ListAttributeInputProps {
    pub(crate) attribute_type: AttributeType,
    #[prop_or(vec!())]
    pub values: Vec<String>,
+    #[prop_or(false)]
+    pub required: bool,
 }

 pub enum ListAttributeInputMsg {
@@ -160,7 +168,7 @@ impl Component for ListAttributeInput {
        let link = &ctx.link();
        html! {
            <div class="row mb-3">
-                <AttributeLabel name={props.name.clone()} />
+                <AttributeLabel name={props.name.clone()} required={props.required} />
                <div class="col-8">
                {self.indices.iter().map(|&i| html! {
                    <div class="input-group mb-2" key={i}>
--- a/app/src/components/form/file_input.rs
+++ b/app/src/components/form/file_input.rs
@@ -1,6 +1,7 @@
 use std::{fmt::Display, str::FromStr};

 use anyhow::{Error, Ok, Result, bail};
+use base64::Engine;
 use gloo_file::{
    File,
    callbacks::{FileReader, read_as_bytes},
@@ -54,12 +55,12 @@ fn to_base64(file: &JsFile) -> Result<String> {
            if !is_valid_jpeg(data.as_slice()) {
                bail!("Chosen image is not a valid JPEG");
            }
-            Ok(base64::encode(data))
+            Ok(base64::engine::general_purpose::STANDARD.encode(data))
        }
        JsFile {
            file: None,
            contents: Some(data),
-        } => Ok(base64::encode(data)),
+        } => Ok(base64::engine::general_purpose::STANDARD.encode(data)),
    }
 }

@@ -98,7 +99,7 @@ impl Component for JpegFileInput {
                    .props()
                    .value
                    .as_ref()
-                    .and_then(|x| base64::decode(x).ok()),
+                    .and_then(|x| base64::engine::general_purpose::STANDARD.decode(x).ok()),
            }),
            reader: None,
        }
@@ -111,7 +112,7 @@ impl Component for JpegFileInput {
                .props()
                .value
                .as_ref()
-                .and_then(|x| base64::decode(x).ok()),
+                .and_then(|x| base64::engine::general_purpose::STANDARD.decode(x).ok()),
        });
        self.reader = None;
        true
@@ -147,20 +148,18 @@ impl Component for JpegFileInput {
                true
            }
            Msg::FileLoaded(file_name, data) => {
-                if let Some(avatar) = &mut self.avatar {
-                    if let Some(file) = &avatar.file {
-                        if file.name() == file_name {
-                            if let Result::Ok(data) = data {
-                                if !is_valid_jpeg(data.as_slice()) {
-                                    // Clear the selection.
-                                    self.avatar = Some(JsFile::default());
-                                    // TODO: bail!("Chosen image is not a valid JPEG");
-                                } else {
-                                    avatar.contents = Some(data);
-                                    return true;
-                                }
-                            }
-                        }
+                if let Some(avatar) = &mut self.avatar
+                    && let Some(file) = &avatar.file
+                    && file.name() == file_name
+                    && let Result::Ok(data) = data
+                {
+                    if !is_valid_jpeg(data.as_slice()) {
+                        // Clear the selection.
+                        self.avatar = Some(JsFile::default());
+                        // TODO: bail!("Chosen image is not a valid JPEG");
+                    } else {
+                        avatar.contents = Some(data);
+                        return true;
                    }
                }
                self.reader = None;
@@ -232,7 +231,7 @@ impl JpegFileInput {
 }

 fn is_valid_jpeg(bytes: &[u8]) -> bool {
-    image::io::Reader::with_format(std::io::Cursor::new(bytes), image::ImageFormat::Jpeg)
+    image::ImageReader::with_format(std::io::Cursor::new(bytes), image::ImageFormat::Jpeg)
        .decode()
        .is_ok()
 }
--- a/app/src/components/group_details_form.rs
+++ b/app/src/components/group_details_form.rs
@@ -248,13 +248,13 @@ impl GroupDetailsForm {
            };
        let mut group_input = update_group::UpdateGroupInput {
            id: self.group.id,
-            displayName: None,
-            removeAttributes: None,
-            insertAttributes: None,
+            display_name: None,
+            remove_attributes: None,
+            insert_attributes: None,
        };
        let default_group_input = group_input.clone();
-        group_input.removeAttributes = remove_attributes;
-        group_input.insertAttributes = insert_attributes;
+        group_input.remove_attributes = remove_attributes;
+        group_input.insert_attributes = insert_attributes;
        // Nothing changed.
        if group_input == default_group_input {
            return Ok(false);
--- a/app/src/components/login.rs
+++ b/app/src/components/login.rs
@@ -27,7 +27,7 @@ pub struct LoginForm {
 pub struct FormModel {
    #[validate(length(min = 1, message = "Missing username"))]
    username: String,
-    #[validate(length(min = 8, message = "Invalid password. Min length: 8"))]
+    #[validate(length(min = 1, message = "Missing password"))]
    password: String,
 }

--- a/app/src/components/user_details_form.rs
+++ b/app/src/components/user_details_form.rs
@@ -260,16 +260,16 @@ impl UserDetailsForm {
        let mut user_input = update_user::UpdateUserInput {
            id: self.user.id.clone(),
            email: None,
-            displayName: None,
-            firstName: None,
-            lastName: None,
+            display_name: None,
+            first_name: None,
+            last_name: None,
            avatar: None,
-            removeAttributes: None,
-            insertAttributes: None,
+            remove_attributes: None,
+            insert_attributes: None,
        };
        let default_user_input = user_input.clone();
-        user_input.removeAttributes = remove_attributes;
-        user_input.insertAttributes = insert_attributes;
+        user_input.remove_attributes = remove_attributes;
+        user_input.insert_attributes = insert_attributes;
        // Nothing changed.
        if user_input == default_user_input {
            return Ok(false);
--- a/app/src/infra/api.rs
+++ b/app/src/infra/api.rs
@@ -94,7 +94,7 @@ impl HostService {
    where
        QueryType: GraphQLQuery + 'static,
    {
-        let unwrap_graphql_response = |graphql_client::Response { data, errors }| {
+        let unwrap_graphql_response = |graphql_client::Response { data, errors, .. }| {
            data.ok_or_else(|| {
                anyhow!(
                    "Errors: [{}]",
--- a/app/src/infra/attributes.rs
+++ b/app/src/infra/attributes.rs
@@ -8,12 +8,17 @@ pub mod group {

    use super::AttributeDescription;

-    pub fn resolve_group_attribute_description(name: &str) -> Option<AttributeDescription> {
+    pub fn resolve_group_attribute_description(name: &'_ str) -> Option<AttributeDescription<'_>> {
        match name {
            "creation_date" => Some(AttributeDescription {
                attribute_identifier: name,
                attribute_name: "creationdate",
-                aliases: vec![name, "createtimestamp", "modifytimestamp"],
+                aliases: vec![name, "createtimestamp"],
+            }),
+            "modified_date" => Some(AttributeDescription {
+                attribute_identifier: name,
+                attribute_name: "modifydate",
+                aliases: vec![name, "modifytimestamp"],
            }),
            "display_name" => Some(AttributeDescription {
                attribute_identifier: name,
@@ -34,7 +39,9 @@ pub mod group {
        }
    }

-    pub fn resolve_group_attribute_description_or_default(name: &str) -> AttributeDescription {
+    pub fn resolve_group_attribute_description_or_default(
+        name: &'_ str,
+    ) -> AttributeDescription<'_> {
        match resolve_group_attribute_description(name) {
            Some(d) => d,
            None => AttributeDescription {
@@ -50,7 +57,7 @@ pub mod user {

    use super::AttributeDescription;

-    pub fn resolve_user_attribute_description(name: &str) -> Option<AttributeDescription> {
+    pub fn resolve_user_attribute_description(name: &'_ str) -> Option<AttributeDescription<'_>> {
        match name {
            "avatar" => Some(AttributeDescription {
                attribute_identifier: name,
@@ -60,7 +67,17 @@ pub mod user {
            "creation_date" => Some(AttributeDescription {
                attribute_identifier: name,
                attribute_name: "creationdate",
-                aliases: vec![name, "createtimestamp", "modifytimestamp"],
+                aliases: vec![name, "createtimestamp"],
+            }),
+            "modified_date" => Some(AttributeDescription {
+                attribute_identifier: name,
+                attribute_name: "modifydate",
+                aliases: vec![name, "modifytimestamp"],
+            }),
+            "password_modified_date" => Some(AttributeDescription {
+                attribute_identifier: name,
+                attribute_name: "passwordmodifydate",
+                aliases: vec![name, "pwdchangedtime"],
            }),
            "display_name" => Some(AttributeDescription {
                attribute_identifier: name,
@@ -96,7 +113,9 @@ pub mod user {
        }
    }

-    pub fn resolve_user_attribute_description_or_default(name: &str) -> AttributeDescription {
+    pub fn resolve_user_attribute_description_or_default(
+        name: &'_ str,
+    ) -> AttributeDescription<'_> {
        match resolve_user_attribute_description(name) {
            Some(d) => d,
            None => AttributeDescription {
--- a/app/src/infra/graphql.rs
+++ b/app/src/infra/graphql.rs
@@ -1 +1,2 @@
-pub type DateTimeUtc = chrono::DateTime<chrono::Utc>;
+pub type DateTime = chrono::DateTime<chrono::Utc>;
+pub type DateTimeUtc = DateTime;
--- a/app/src/lib.rs
+++ b/app/src/lib.rs
@@ -2,6 +2,7 @@
 #![forbid(non_ascii_idents)]
 #![allow(clippy::uninlined_format_args)]
 #![allow(clippy::let_unit_value)]
+#![allow(clippy::unnecessary_operation)] // Doesn't work well with the html macro.

 pub mod components;
 pub mod infra;
--- a/crates/access-control/Cargo.toml
+++ b/crates/access-control/Cargo.toml
@@ -1,16 +1,17 @@
 [package]
 name = "lldap_access_control"
-version = "0.1.0"
+version = "0.1.1"
 description = "Access control wrappers for LLDAP"
 authors.workspace = true
 edition.workspace = true
 homepage.workspace = true
 license.workspace = true
 repository.workspace = true
+rust-version.workspace = true

 [dependencies]
-tracing = "*"
-async-trait = "0.1"
+tracing = { workspace = true }
+async-trait = { workspace = true }

 [dependencies.lldap_auth]
 path = "../auth"
--- a/crates/auth/Cargo.toml
+++ b/crates/auth/Cargo.toml
@@ -1,12 +1,13 @@
 [package]
 name = "lldap_auth"
-version = "0.6.0"
+version = "0.6.3"
 description = "Authentication protocol for LLDAP"
 edition.workspace = true
 authors.workspace = true
 homepage.workspace = true
 license.workspace = true
 repository.workspace = true
+rust-version.workspace = true

 [features]
 default = ["opaque_server", "opaque_client"]
@@ -17,34 +18,23 @@ sea_orm = ["dep:sea-orm"]
 test = []

 [dependencies]
+chrono = { workspace = true }
+derive_more = { workspace = true }
+opaque-ke = { workspace = true }
+serde = { workspace = true }
 rust-argon2 = "2"
 curve25519-dalek = "3"
 digest = "0.9"
 generic-array = "0.14"
-rand = "0.8"
+rand = { workspace = true }
 sha2 = "0.9"
-thiserror = "2"
-
-[dependencies.derive_more]
-features = ["debug", "display"]
-default-features = false
-version = "1"
-
-[dependencies.opaque-ke]
-version = "0.7"
-
-[dependencies.chrono]
-version = "*"
-features = ["serde"]
+thiserror = { workspace = true }
+uuid = { workspace = true, features = ["serde"] }

 [dependencies.sea-orm]
 workspace = true
-features = ["macros"]
 optional = true

-[dependencies.serde]
-workspace = true
-
 # For WASM targets, use the JS getrandom.
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies.getrandom]
 version = "0.2"
--- a/crates/auth/src/lib.rs
+++ b/crates/auth/src/lib.rs
@@ -4,6 +4,7 @@ use chrono::prelude::*;
 use serde::{Deserialize, Serialize};
 use std::collections::HashSet;
 use std::fmt;
+use uuid::Uuid;

 pub mod access_control;
 pub mod opaque;
@@ -208,8 +209,11 @@ pub mod types {

 #[derive(Clone, Serialize, Deserialize)]
 pub struct JWTClaims {
+    #[serde(with = "chrono::serde::ts_seconds")]
    pub exp: DateTime<Utc>,
+    #[serde(with = "chrono::serde::ts_seconds")]
    pub iat: DateTime<Utc>,
+    pub jti: Uuid,
    pub user: String,
    pub groups: HashSet<String>,
 }
--- a/crates/domain-handlers/Cargo.toml
+++ b/crates/domain-handlers/Cargo.toml
@@ -1,32 +1,28 @@
 [package]
 name = "lldap_domain_handlers"
-version = "0.1.0"
+version = "0.1.1"
 edition.workspace = true
 authors.workspace = true
 homepage.workspace = true
 license.workspace = true
 repository.workspace = true
+rust-version.workspace = true

 [features]
 test = []

 [dependencies]
-async-trait = "0.1"
-base64 = "0.21"
-ldap3_proto = "0.6.0"
-serde_bytes = "0.11"
+async-trait = { workspace = true }
+base64 = { workspace = true }
+chrono = { workspace = true }
+derive_more = { workspace = true }
+ldap3_proto = { workspace = true }
+serde = { workspace = true }
+serde_bytes = { workspace = true }
+uuid = { workspace = true }

 [dev-dependencies]
-pretty_assertions = "1"
-
-[dependencies.chrono]
-features = ["serde"]
-version = "0.4"
-
-[dependencies.derive_more]
-features = ["debug", "display", "from", "from_str"]
-default-features = false
-version = "1"
+pretty_assertions = { workspace = true }

 [dependencies.lldap_auth]
 path = "../auth"
@@ -37,10 +33,3 @@ path = "../domain"

 [dependencies.lldap_domain_model]
 path = "../domain-model"
-
-[dependencies.serde]
-workspace = true
-
-[dependencies.uuid]
-features = ["v1", "v3"]
-version = "1"
--- a/crates/domain-model/Cargo.toml
+++ b/crates/domain-model/Cargo.toml
@@ -1,33 +1,30 @@
 [package]
 name = "lldap_domain_model"
-version = "0.1.0"
+version = "0.1.1"
 edition.workspace = true
 authors.workspace = true
 homepage.workspace = true
 license.workspace = true
 repository.workspace = true
+rust-version.workspace = true

 [features]
 test = []

 [dependencies]
-base64 = "0.21"
-bincode = "1.3"
-orion = "0.17"
-serde_bytes = "0.11"
-thiserror = "2"
+base64 = { workspace = true }
+bincode = { workspace = true }
+chrono = { workspace = true }
+derive_more = { workspace = true }
+orion = { workspace = true }
+sea-orm = { workspace = true }
+serde = { workspace = true }
+serde_bytes = { workspace = true }
+thiserror = { workspace = true }
+uuid = { workspace = true }

 [dev-dependencies]
-pretty_assertions = "1"
-
-[dependencies.chrono]
-features = ["serde"]
-version = "0.4"
-
-[dependencies.derive_more]
-features = ["debug", "display", "from", "from_str"]
-default-features = false
-version = "1"
+pretty_assertions = { workspace = true }

 [dependencies.lldap_auth]
 path = "../auth"
@@ -35,14 +32,3 @@ features = ["opaque_server", "opaque_client", "sea_orm"]

 [dependencies.lldap_domain]
 path = "../domain"
-
-[dependencies.sea-orm]
-workspace = true
-features = ["macros"]
-
-[dependencies.serde]
-workspace = true
-
-[dependencies.uuid]
-features = ["v1", "v3"]
-version = "1"
--- a/crates/domain-model/src/model/groups.rs
+++ b/crates/domain-model/src/model/groups.rs
@@ -14,6 +14,7 @@ pub struct Model {
    pub lowercase_display_name: String,
    pub creation_date: chrono::NaiveDateTime,
    pub uuid: Uuid,
+    pub modified_date: chrono::NaiveDateTime,
 }

 #[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
@@ -39,6 +40,7 @@ impl From<Model> for lldap_domain::types::Group {
            uuid: group.uuid,
            users: vec![],
            attributes: Vec::new(),
+            modified_date: group.modified_date,
        }
    }
 }
@@ -51,6 +53,7 @@ impl From<Model> for lldap_domain::types::GroupDetails {
            creation_date: group.creation_date,
            uuid: group.uuid,
            attributes: Vec::new(),
+            modified_date: group.modified_date,
        }
    }
 }
--- a/crates/domain-model/src/model/users.rs
+++ b/crates/domain-model/src/model/users.rs
@@ -21,6 +21,8 @@ pub struct Model {
    pub totp_secret: Option<String>,
    pub mfa_type: Option<String>,
    pub uuid: Uuid,
+    pub modified_date: chrono::NaiveDateTime,
+    pub password_modified_date: chrono::NaiveDateTime,
 }

 impl EntityName for Entity {
@@ -40,6 +42,8 @@ pub enum Column {
    TotpSecret,
    MfaType,
    Uuid,
+    ModifiedDate,
+    PasswordModifiedDate,
 }

 impl ColumnTrait for Column {
@@ -56,6 +60,8 @@ impl ColumnTrait for Column {
            Column::TotpSecret => ColumnType::String(StringLen::N(64)),
            Column::MfaType => ColumnType::String(StringLen::N(64)),
            Column::Uuid => ColumnType::String(StringLen::N(36)),
+            Column::ModifiedDate => ColumnType::DateTime,
+            Column::PasswordModifiedDate => ColumnType::DateTime,
        }
        .def()
    }
@@ -121,6 +127,8 @@ impl From<Model> for lldap_domain::types::User {
            creation_date: user.creation_date,
            uuid: user.uuid,
            attributes: Vec::new(),
+            modified_date: user.modified_date,
+            password_modified_date: user.password_modified_date,
        }
    }
 }
--- a/crates/domain/Cargo.toml
+++ b/crates/domain/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "lldap_domain"
-version = "0.1.0"
+version = "0.1.1"
 authors = [
    "Valentin Tolmer <valentin@tolmer.fr>",
    "Simon Broeng Jensen <sbj@cwconsult.dk>",
@@ -9,56 +9,29 @@ edition.workspace = true
 homepage.workspace = true
 license.workspace = true
 repository.workspace = true
+rust-version.workspace = true

 [features]
 test = []

 [dependencies]
-anyhow = "*"
-base64 = "0.21"
-bincode = "1.3"
-itertools = "0.10"
-juniper = "0.15"
-serde_bytes = "0.11"
-
-[dev-dependencies]
-pretty_assertions = "1"
-
-[dependencies.chrono]
-features = ["serde"]
-version = "*"
-
-[dependencies.derive_more]
-features = ["debug", "display", "from", "from_str"]
-default-features = false
-version = "1"
-
-[dependencies.image]
-features = ["jpeg"]
-default-features = false
-version = "0.24"
+anyhow = { workspace = true }
+base64 = { workspace = true }
+bincode = { workspace = true }
+chrono = { workspace = true }
+derive_more = { workspace = true }
+image = { workspace = true }
+itertools = { workspace = true }
+juniper = { workspace = true }
+sea-orm = { workspace = true }
+serde = { workspace = true }
+serde_bytes = { workspace = true }
+strum = { workspace = true }
+uuid = { workspace = true }

 [dependencies.lldap_auth]
 path = "../auth"
 features = ["opaque_server", "opaque_client", "sea_orm"]

-[dependencies.sea-orm]
-workspace = true
-features = [
-    "macros",
-    "with-chrono",
-    "with-uuid",
-    "sqlx-all",
-    "runtime-actix-rustls",
-]
-
-[dependencies.serde]
-workspace = true
-
-[dependencies.strum]
-features = ["derive"]
-version = "0.25"
-
-[dependencies.uuid]
-features = ["v1", "v3"]
-version = "1"
+[dev-dependencies]
+pretty_assertions = { workspace = true }
--- a/crates/domain/src/public_schema.rs
+++ b/crates/domain/src/public_schema.rs
@@ -34,6 +34,24 @@ impl From<Schema> for PublicSchema {
                is_hardcoded: true,
                is_readonly: true,
            },
+            AttributeSchema {
+                name: "modified_date".into(),
+                attribute_type: AttributeType::DateTime,
+                is_list: false,
+                is_visible: true,
+                is_editable: false,
+                is_hardcoded: true,
+                is_readonly: true,
+            },
+            AttributeSchema {
+                name: "password_modified_date".into(),
+                attribute_type: AttributeType::DateTime,
+                is_list: false,
+                is_visible: true,
+                is_editable: false,
+                is_hardcoded: true,
+                is_readonly: true,
+            },
            AttributeSchema {
                name: "mail".into(),
                attribute_type: AttributeType::String,
@@ -85,6 +103,15 @@ impl From<Schema> for PublicSchema {
                is_hardcoded: true,
                is_readonly: true,
            },
+            AttributeSchema {
+                name: "modified_date".into(),
+                attribute_type: AttributeType::DateTime,
+                is_list: false,
+                is_visible: true,
+                is_editable: false,
+                is_hardcoded: true,
+                is_readonly: true,
+            },
            AttributeSchema {
                name: "uuid".into(),
                attribute_type: AttributeType::String,
--- a/crates/domain/src/types.rs
+++ b/crates/domain/src/types.rs
@@ -7,8 +7,8 @@ use sea_orm::{
    DbErr, DeriveValueType, QueryResult, TryFromU64, TryGetError, TryGetable, Value,
    entity::IntoActiveValue,
    sea_query::{
-        ArrayType, ColumnType, Nullable, SeaRc, StringLen, ValueTypeErr,
-        extension::mysql::MySqlType, value::ValueType,
+        ArrayType, ColumnType, SeaRc, StringLen, ValueTypeErr, extension::mysql::MySqlType,
+        value::ValueType,
    },
 };
 use serde::{Deserialize, Serialize};
@@ -333,7 +333,7 @@ impl TryFrom<&[u8]> for JpegPhoto {
            return Ok(JpegPhoto::null());
        }
        // Confirm that it's a valid Jpeg, then store only the bytes.
-        image::io::Reader::with_format(std::io::Cursor::new(bytes), image::ImageFormat::Jpeg)
+        image::ImageReader::with_format(std::io::Cursor::new(bytes), image::ImageFormat::Jpeg)
            .decode()?;
        Ok(JpegPhoto(bytes.to_vec()))
    }
@@ -346,7 +346,7 @@ impl TryFrom<Vec<u8>> for JpegPhoto {
            return Ok(JpegPhoto::null());
        }
        // Confirm that it's a valid Jpeg, then store only the bytes.
-        image::io::Reader::with_format(
+        image::ImageReader::with_format(
            std::io::Cursor::new(bytes.as_slice()),
            image::ImageFormat::Jpeg,
        )
@@ -397,7 +397,7 @@ impl JpegPhoto {

    #[cfg(any(feature = "test", test))]
    pub fn for_tests() -> Self {
-        use image::{ImageOutputFormat, Rgb, RgbImage};
+        use image::{ImageFormat, Rgb, RgbImage};
        let img = RgbImage::from_fn(32, 32, |x, y| {
            if (x + y) % 2 == 0 {
                Rgb([0, 0, 0])
@@ -406,21 +406,12 @@ impl JpegPhoto {
            }
        });
        let mut bytes: Vec<u8> = Vec::new();
-        img.write_to(
-            &mut std::io::Cursor::new(&mut bytes),
-            ImageOutputFormat::Jpeg(0),
-        )
-        .unwrap();
+        img.write_to(&mut std::io::Cursor::new(&mut bytes), ImageFormat::Jpeg)
+            .unwrap();
        Self(bytes)
    }
 }

-impl Nullable for JpegPhoto {
-    fn null() -> Value {
-        JpegPhoto::null().into()
-    }
-}
-
 impl IntoActiveValue<Serialized> for JpegPhoto {
    fn into_active_value(self) -> sea_orm::ActiveValue<Serialized> {
        if self.is_empty() {
@@ -546,6 +537,8 @@ pub struct User {
    pub creation_date: NaiveDateTime,
    pub uuid: Uuid,
    pub attributes: Vec<Attribute>,
+    pub modified_date: NaiveDateTime,
+    pub password_modified_date: NaiveDateTime,
 }

 #[cfg(feature = "test")]
@@ -559,6 +552,8 @@ impl Default for User {
            creation_date: epoch,
            uuid: Uuid::from_name_and_date("", &epoch),
            attributes: Vec::new(),
+            modified_date: epoch,
+            password_modified_date: epoch,
        }
    }
 }
@@ -654,6 +649,7 @@ pub struct Group {
    pub uuid: Uuid,
    pub users: Vec<UserId>,
    pub attributes: Vec<Attribute>,
+    pub modified_date: NaiveDateTime,
 }

 #[derive(Debug, Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]
@@ -663,6 +659,7 @@ pub struct GroupDetails {
    pub creation_date: NaiveDateTime,
    pub uuid: Uuid,
    pub attributes: Vec<Attribute>,
+    pub modified_date: NaiveDateTime,
 }

 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -688,7 +685,7 @@ mod tests {
        );
        assert_eq!(
            &format!("{:?}", Serialized::from(&JpegPhoto::for_tests())),
-            "Serialized(\"hash: 0xB947C77A16F3C3BD\")"
+            "Serialized(\"hash: 0xBB3017828B2F3DEF\")"
        );
    }

--- a/crates/frontend-options/Cargo.toml
+++ b/crates/frontend-options/Cargo.toml
@@ -1,12 +1,13 @@
 [package]
 name = "lldap_frontend_options"
-version = "0.1.0"
+version = "0.1.1"
 description = "Frontend options for LLDAP"
 authors.workspace = true
 edition.workspace = true
 homepage.workspace = true
 license.workspace = true
 repository.workspace = true
+rust-version.workspace = true

-[dependencies.serde]
-workspace = true
+[dependencies]
+serde = { workspace = true }
--- a/crates/graphql-server/Cargo.toml
+++ b/crates/graphql-server/Cargo.toml
@@ -1,23 +1,23 @@
 [package]
 name = "lldap_graphql_server"
-version = "0.1.0"
+version = "0.1.1"
 description = "GraphQL server for LLDAP"
 edition.workspace = true
 authors.workspace = true
 homepage.workspace = true
 license.workspace = true
 repository.workspace = true
+rust-version.workspace = true

 [dependencies]
-anyhow = "*"
-juniper = "0.15"
-serde_json = "1"
-tracing = "*"
-urlencoding = "2"
-
-[dependencies.chrono]
-features = ["serde"]
-version = "*"
+anyhow = { workspace = true }
+chrono = { workspace = true }
+juniper = { workspace = true }
+serde = { workspace = true }
+serde_json = { workspace = true }
+tracing = { workspace = true }
+urlencoding = { workspace = true }
+uuid = { workspace = true }

 [dependencies.lldap_access_control]
 path = "../access-control"
@@ -44,16 +44,10 @@ path = "../sql-backend-handler"
 [dependencies.lldap_validation]
 path = "../validation"

-[dependencies.serde]
-workspace = true
-
-[dependencies.uuid]
-features = ["v1", "v3"]
-version = "1"
-
 [dev-dependencies]
-mockall = "0.11.4"
-pretty_assertions = "1"
+mockall = { workspace = true }
+pretty_assertions = { workspace = true }
+tokio = { workspace = true }

 #[dev-dependencies.lldap_auth]
 #path = "../auth"
@@ -69,7 +63,3 @@ path = "../test-utils"
 #[dev-dependencies.lldap_sql_backend_handler]
 #path = "../sql-backend-handler"
 #features = ["test"]
-
-[dev-dependencies.tokio]
-features = ["full"]
-version = "1.25"
--- a/crates/graphql-server/src/api.rs
+++ b/crates/graphql-server/src/api.rs
@@ -60,7 +60,7 @@ impl<Handler: BackendHandler> Context<Handler> {
 impl<Handler: BackendHandler> juniper::Context for Context<Handler> {}

 type Schema<Handler> =
-    RootNode<'static, Query<Handler>, Mutation<Handler>, EmptySubscription<Context<Handler>>>;
+    RootNode<Query<Handler>, Mutation<Handler>, EmptySubscription<Context<Handler>>>;

 pub fn schema<Handler: BackendHandler>() -> Schema<Handler> {
    Schema::new(
@@ -73,7 +73,7 @@ pub fn schema<Handler: BackendHandler>() -> Schema<Handler> {
 pub fn export_schema(output_file: Option<String>) -> anyhow::Result<()> {
    use anyhow::Context;
    use lldap_sql_backend_handler::SqlBackendHandler;
-    let output = schema::<SqlBackendHandler>().as_schema_language();
+    let output = schema::<SqlBackendHandler>().as_sdl();
    match output_file {
        None => println!("{output}"),
        Some(path) => {
--- a/crates/graphql-server/src/mutation/helpers.rs
+++ b/crates/graphql-server/src/mutation/helpers.rs
@@ -0,0 +1,160 @@
+use anyhow::{Context as AnyhowContext, anyhow};
+use juniper::FieldResult;
+use lldap_access_control::{AdminBackendHandler, ReadonlyBackendHandler};
+use lldap_domain::{
+    deserialize::deserialize_attribute_value,
+    public_schema::PublicSchema,
+    requests::CreateGroupRequest,
+    schema::AttributeList,
+    types::{Attribute as DomainAttribute, AttributeName, Email},
+};
+use lldap_domain_handlers::handler::{BackendHandler, ReadSchemaBackendHandler};
+use std::{collections::BTreeMap, sync::Arc};
+use tracing::{Instrument, Span};
+
+use super::inputs::AttributeValue;
+use crate::api::{Context, field_error_callback};
+
+pub struct UnpackedAttributes {
+    pub email: Option<Email>,
+    pub display_name: Option<String>,
+    pub attributes: Vec<DomainAttribute>,
+}
+
+pub fn unpack_attributes(
+    attributes: Vec<AttributeValue>,
+    schema: &PublicSchema,
+    is_admin: bool,
+) -> FieldResult<UnpackedAttributes> {
+    let email = attributes
+        .iter()
+        .find(|attr| attr.name == "mail")
+        .cloned()
+        .map(|attr| deserialize_attribute(&schema.get_schema().user_attributes, attr, is_admin))
+        .transpose()?
+        .map(|attr| attr.value.into_string().unwrap())
+        .map(Email::from);
+    let display_name = attributes
+        .iter()
+        .find(|attr| attr.name == "display_name")
+        .cloned()
+        .map(|attr| deserialize_attribute(&schema.get_schema().user_attributes, attr, is_admin))
+        .transpose()?
+        .map(|attr| attr.value.into_string().unwrap());
+    let attributes = attributes
+        .into_iter()
+        .filter(|attr| attr.name != "mail" && attr.name != "display_name")
+        .map(|attr| deserialize_attribute(&schema.get_schema().user_attributes, attr, is_admin))
+        .collect::<Result<Vec<_>, _>>()?;
+    Ok(UnpackedAttributes {
+        email,
+        display_name,
+        attributes,
+    })
+}
+
+/// Consolidates caller supplied user fields and attributes into a list of attributes.
+///
+/// A number of user fields are internally represented as attributes, but are still also
+/// available as fields on user objects. This function consolidates these fields and the
+/// given attributes into a resulting attribute list. If a value is supplied for both a
+/// field and the corresponding attribute, the attribute will take precedence.
+pub fn consolidate_attributes(
+    attributes: Vec<AttributeValue>,
+    first_name: Option<String>,
+    last_name: Option<String>,
+    avatar: Option<String>,
+) -> Vec<AttributeValue> {
+    // Prepare map of the client provided attributes
+    let mut provided_attributes: BTreeMap<AttributeName, AttributeValue> = attributes
+        .into_iter()
+        .map(|x| {
+            (
+                x.name.clone().into(),
+                AttributeValue {
+                    name: x.name.to_ascii_lowercase(),
+                    value: x.value,
+                },
+            )
+        })
+        .collect::<BTreeMap<_, _>>();
+    // Prepare list of fallback attribute values
+    let field_attrs = [
+        ("first_name", first_name),
+        ("last_name", last_name),
+        ("avatar", avatar),
+    ];
+    for (name, value) in field_attrs.into_iter() {
+        if let Some(val) = value {
+            let attr_name: AttributeName = name.into();
+            provided_attributes
+                .entry(attr_name)
+                .or_insert_with(|| AttributeValue {
+                    name: name.to_string(),
+                    value: vec![val],
+                });
+        }
+    }
+    // Return the values of the resulting map
+    provided_attributes.into_values().collect()
+}
+
+pub async fn create_group_with_details<Handler: BackendHandler>(
+    context: &Context<Handler>,
+    request: super::inputs::CreateGroupInput,
+    span: Span,
+) -> FieldResult<crate::query::Group<Handler>> {
+    let handler = context
+        .get_admin_handler()
+        .ok_or_else(field_error_callback(&span, "Unauthorized group creation"))?;
+    let schema = handler.get_schema().await?;
+    let public_schema: PublicSchema = schema.into();
+    let attributes = request
+        .attributes
+        .unwrap_or_default()
+        .into_iter()
+        .map(|attr| deserialize_attribute(&public_schema.get_schema().group_attributes, attr, true))
+        .collect::<Result<Vec<_>, _>>()?;
+    let request = CreateGroupRequest {
+        display_name: request.display_name.into(),
+        attributes,
+    };
+    let group_id = handler.create_group(request).await?;
+    let group_details = handler.get_group_details(group_id).instrument(span).await?;
+    crate::query::Group::<Handler>::from_group_details(group_details, Arc::new(public_schema))
+}
+
+pub fn deserialize_attribute(
+    attribute_schema: &AttributeList,
+    attribute: AttributeValue,
+    is_admin: bool,
+) -> FieldResult<DomainAttribute> {
+    let attribute_name = AttributeName::from(attribute.name.as_str());
+    let attribute_schema = attribute_schema
+        .get_attribute_schema(&attribute_name)
+        .ok_or_else(|| anyhow!("Attribute {} is not defined in the schema", attribute.name))?;
+    if attribute_schema.is_readonly {
+        return Err(anyhow!(
+            "Permission denied: Attribute {} is read-only",
+            attribute.name
+        )
+        .into());
+    }
+    if !is_admin && !attribute_schema.is_editable {
+        return Err(anyhow!(
+            "Permission denied: Attribute {} is not editable by regular users",
+            attribute.name
+        )
+        .into());
+    }
+    let deserialized_values = deserialize_attribute_value(
+        &attribute.value,
+        attribute_schema.attribute_type,
+        attribute_schema.is_list,
+    )
+    .context(format!("While deserializing attribute {}", attribute.name))?;
+    Ok(DomainAttribute {
+        name: attribute_name,
+        value: deserialized_values,
+    })
+}
--- a/crates/graphql-server/src/mutation/inputs.rs
+++ b/crates/graphql-server/src/mutation/inputs.rs
@@ -0,0 +1,99 @@
+use juniper::{GraphQLInputObject, GraphQLObject};
+
+#[derive(Clone, PartialEq, Eq, Debug, GraphQLInputObject)]
+// This conflicts with the attribute values returned by the user/group queries.
+#[graphql(name = "AttributeValueInput")]
+pub struct AttributeValue {
+    /// The name of the attribute. It must be present in the schema, and the type informs how
+    /// to interpret the values.
+    pub name: String,
+    /// The values of the attribute.
+    /// If the attribute is not a list, the vector must contain exactly one element.
+    /// Integers (signed 64 bits) are represented as strings.
+    /// Dates are represented as strings in RFC3339 format, e.g. "2019-10-12T07:20:50.52Z".
+    /// JpegPhotos are represented as base64 encoded strings. They must be valid JPEGs.
+    pub value: Vec<String>,
+}
+
+#[derive(PartialEq, Eq, Debug, GraphQLInputObject)]
+/// The details required to create a user.
+pub struct CreateUserInput {
+    pub id: String,
+    // The email can be specified as an attribute, but one of the two is required.
+    pub email: Option<String>,
+    pub display_name: Option<String>,
+    /// First name of user. Deprecated: use attribute instead.
+    /// If both field and corresponding attribute is supplied, the attribute will take precedence.
+    pub first_name: Option<String>,
+    /// Last name of user. Deprecated: use attribute instead.
+    /// If both field and corresponding attribute is supplied, the attribute will take precedence.
+    pub last_name: Option<String>,
+    /// Base64 encoded JpegPhoto. Deprecated: use attribute instead.
+    /// If both field and corresponding attribute is supplied, the attribute will take precedence.
+    pub avatar: Option<String>,
+    /// Attributes.
+    pub attributes: Option<Vec<AttributeValue>>,
+}
+
+#[derive(PartialEq, Eq, Debug, GraphQLInputObject)]
+/// The details required to create a group.
+pub struct CreateGroupInput {
+    pub display_name: String,
+    /// User-defined attributes.
+    pub attributes: Option<Vec<AttributeValue>>,
+}
+
+#[derive(PartialEq, Eq, Debug, GraphQLInputObject)]
+/// The fields that can be updated for a user.
+pub struct UpdateUserInput {
+    pub id: String,
+    pub email: Option<String>,
+    pub display_name: Option<String>,
+    /// First name of user. Deprecated: use attribute instead.
+    /// If both field and corresponding attribute is supplied, the attribute will take precedence.
+    pub first_name: Option<String>,
+    /// Last name of user. Deprecated: use attribute instead.
+    /// If both field and corresponding attribute is supplied, the attribute will take precedence.
+    pub last_name: Option<String>,
+    /// Base64 encoded JpegPhoto. Deprecated: use attribute instead.
+    /// If both field and corresponding attribute is supplied, the attribute will take precedence.
+    pub avatar: Option<String>,
+    /// Attribute names to remove.
+    /// They are processed before insertions.
+    pub remove_attributes: Option<Vec<String>>,
+    /// Inserts or updates the given attributes.
+    /// For lists, the entire list must be provided.
+    pub insert_attributes: Option<Vec<AttributeValue>>,
+}
+
+#[derive(PartialEq, Eq, Debug, GraphQLInputObject)]
+/// The fields that can be updated for a group.
+pub struct UpdateGroupInput {
+    /// The group ID.
+    pub id: i32,
+    /// The new display name.
+    pub display_name: Option<String>,
+    /// Attribute names to remove.
+    /// They are processed before insertions.
+    pub remove_attributes: Option<Vec<String>>,
+    /// Inserts or updates the given attributes.
+    /// For lists, the entire list must be provided.
+    pub insert_attributes: Option<Vec<AttributeValue>>,
+}
+
+#[derive(PartialEq, Eq, Debug, GraphQLObject)]
+pub struct Success {
+    ok: bool,
+}
+
+impl Success {
+    pub fn new() -> Self {
+        Self { ok: true }
+    }
+}
+
+impl Default for Success {
+    fn default() -> Self {
+        Self::new()
+    }
+}
--- a/crates/graphql-server/src/mutation/mod.rs
+++ b/crates/graphql-server/src/mutation/mod.rs
@@ -1,27 +1,30 @@
+pub mod helpers;
+pub mod inputs;
+
+// Re-export public types
+pub use inputs::{
+    AttributeValue, CreateGroupInput, CreateUserInput, Success, UpdateGroupInput, UpdateUserInput,
+};
+
 use crate::api::{Context, field_error_callback};
-use anyhow::{Context as AnyhowContext, anyhow};
-use juniper::{FieldError, FieldResult, GraphQLInputObject, GraphQLObject, graphql_object};
+use anyhow::anyhow;
+use juniper::{FieldError, FieldResult, graphql_object};
 use lldap_access_control::{
-    AdminBackendHandler, ReadonlyBackendHandler, UserReadableBackendHandler,
-    UserWriteableBackendHandler,
+    AdminBackendHandler, UserReadableBackendHandler, UserWriteableBackendHandler,
 };
 use lldap_domain::{
-    deserialize::deserialize_attribute_value,
-    public_schema::PublicSchema,
-    requests::{
-        CreateAttributeRequest, CreateGroupRequest, CreateUserRequest, UpdateGroupRequest,
-        UpdateUserRequest,
-    },
-    schema::AttributeList,
-    types::{
-        Attribute as DomainAttribute, AttributeName, AttributeType, Email, GroupId,
-        LdapObjectClass, UserId,
-    },
+    requests::{CreateAttributeRequest, CreateUserRequest, UpdateGroupRequest, UpdateUserRequest},
+    types::{AttributeName, AttributeType, Email, GroupId, LdapObjectClass, UserId},
 };
 use lldap_domain_handlers::handler::BackendHandler;
 use lldap_validation::attributes::{ALLOWED_CHARACTERS_DESCRIPTION, validate_attribute_name};
-use std::{collections::BTreeMap, sync::Arc};
-use tracing::{Instrument, Span, debug, debug_span};
+use std::sync::Arc;
+use tracing::{Instrument, debug, debug_span};
+
+use helpers::{
+    UnpackedAttributes, consolidate_attributes, create_group_with_details, deserialize_attribute,
+    unpack_attributes,
+};

 #[derive(PartialEq, Eq, Debug)]
 /// The top-level GraphQL mutation type.
@@ -42,183 +45,6 @@ impl<Handler: BackendHandler> Mutation<Handler> {
        }
    }
 }
-
-#[derive(Clone, PartialEq, Eq, Debug, GraphQLInputObject)]
-// This conflicts with the attribute values returned by the user/group queries.
-#[graphql(name = "AttributeValueInput")]
-struct AttributeValue {
-    /// The name of the attribute. It must be present in the schema, and the type informs how
-    /// to interpret the values.
-    name: String,
-    /// The values of the attribute.
-    /// If the attribute is not a list, the vector must contain exactly one element.
-    /// Integers (signed 64 bits) are represented as strings.
-    /// Dates are represented as strings in RFC3339 format, e.g. "2019-10-12T07:20:50.52Z".
-    /// JpegPhotos are represented as base64 encoded strings. They must be valid JPEGs.
-    value: Vec<String>,
-}
-
-#[derive(PartialEq, Eq, Debug, GraphQLInputObject)]
-/// The details required to create a user.
-pub struct CreateUserInput {
-    id: String,
-    // The email can be specified as an attribute, but one of the two is required.
-    email: Option<String>,
-    display_name: Option<String>,
-    /// First name of user. Deprecated: use attribute instead.
-    /// If both field and corresponding attribute is supplied, the attribute will take precedence.
-    first_name: Option<String>,
-    /// Last name of user. Deprecated: use attribute instead.
-    /// If both field and corresponding attribute is supplied, the attribute will take precedence.
-    last_name: Option<String>,
-    /// Base64 encoded JpegPhoto. Deprecated: use attribute instead.
-    /// If both field and corresponding attribute is supplied, the attribute will take precedence.
-    avatar: Option<String>,
-    /// Attributes.
-    attributes: Option<Vec<AttributeValue>>,
-}
-
-#[derive(PartialEq, Eq, Debug, GraphQLInputObject)]
-/// The details required to create a group.
-pub struct CreateGroupInput {
-    display_name: String,
-    /// User-defined attributes.
-    attributes: Option<Vec<AttributeValue>>,
-}
-
-#[derive(PartialEq, Eq, Debug, GraphQLInputObject)]
-/// The fields that can be updated for a user.
-pub struct UpdateUserInput {
-    id: String,
-    email: Option<String>,
-    display_name: Option<String>,
-    /// First name of user. Deprecated: use attribute instead.
-    /// If both field and corresponding attribute is supplied, the attribute will take precedence.
-    first_name: Option<String>,
-    /// Last name of user. Deprecated: use attribute instead.
-    /// If both field and corresponding attribute is supplied, the attribute will take precedence.
-    last_name: Option<String>,
-    /// Base64 encoded JpegPhoto. Deprecated: use attribute instead.
-    /// If both field and corresponding attribute is supplied, the attribute will take precedence.
-    avatar: Option<String>,
-    /// Attribute names to remove.
-    /// They are processed before insertions.
-    remove_attributes: Option<Vec<String>>,
-    /// Inserts or updates the given attributes.
-    /// For lists, the entire list must be provided.
-    insert_attributes: Option<Vec<AttributeValue>>,
-}
-
-#[derive(PartialEq, Eq, Debug, GraphQLInputObject)]
-/// The fields that can be updated for a group.
-pub struct UpdateGroupInput {
-    /// The group ID.
-    id: i32,
-    /// The new display name.
-    display_name: Option<String>,
-    /// Attribute names to remove.
-    /// They are processed before insertions.
-    remove_attributes: Option<Vec<String>>,
-    /// Inserts or updates the given attributes.
-    /// For lists, the entire list must be provided.
-    insert_attributes: Option<Vec<AttributeValue>>,
-}
-
-#[derive(PartialEq, Eq, Debug, GraphQLObject)]
-pub struct Success {
-    ok: bool,
-}
-
-impl Success {
-    fn new() -> Self {
-        Self { ok: true }
-    }
-}
-
-struct UnpackedAttributes {
-    email: Option<Email>,
-    display_name: Option<String>,
-    attributes: Vec<DomainAttribute>,
-}
-
-fn unpack_attributes(
-    attributes: Vec<AttributeValue>,
-    schema: &PublicSchema,
-    is_admin: bool,
-) -> FieldResult<UnpackedAttributes> {
-    let email = attributes
-        .iter()
-        .find(|attr| attr.name == "mail")
-        .cloned()
-        .map(|attr| deserialize_attribute(&schema.get_schema().user_attributes, attr, is_admin))
-        .transpose()?
-        .map(|attr| attr.value.into_string().unwrap())
-        .map(Email::from);
-    let display_name = attributes
-        .iter()
-        .find(|attr| attr.name == "display_name")
-        .cloned()
-        .map(|attr| deserialize_attribute(&schema.get_schema().user_attributes, attr, is_admin))
-        .transpose()?
-        .map(|attr| attr.value.into_string().unwrap());
-    let attributes = attributes
-        .into_iter()
-        .filter(|attr| attr.name != "mail" && attr.name != "display_name")
-        .map(|attr| deserialize_attribute(&schema.get_schema().user_attributes, attr, is_admin))
-        .collect::<Result<Vec<_>, _>>()?;
-    Ok(UnpackedAttributes {
-        email,
-        display_name,
-        attributes,
-    })
-}
-
-/// Consolidates caller supplied user fields and attributes into a list of attributes.
-///
-/// A number of user fields are internally represented as attributes, but are still also
-/// available as fields on user objects. This function consolidates these fields and the
-/// given attributes into a resulting attribute list. If a value is supplied for both a
-/// field and the corresponding attribute, the attribute will take precedence.
-fn consolidate_attributes(
-    attributes: Vec<AttributeValue>,
-    first_name: Option<String>,
-    last_name: Option<String>,
-    avatar: Option<String>,
-) -> Vec<AttributeValue> {
-    // Prepare map of the client provided attributes
-    let mut provided_attributes: BTreeMap<AttributeName, AttributeValue> = attributes
-        .into_iter()
-        .map(|x| {
-            (
-                x.name.clone().into(),
-                AttributeValue {
-                    name: x.name.to_ascii_lowercase(),
-                    value: x.value,
-                },
-            )
-        })
-        .collect::<BTreeMap<_, _>>();
-    // Prepare list of fallback attribute values
-    let field_attrs = [
-        ("first_name", first_name),
-        ("last_name", last_name),
-        ("avatar", avatar),
-    ];
-    for (name, value) in field_attrs.into_iter() {
-        if let Some(val) = value {
-            let attr_name: AttributeName = name.into();
-            provided_attributes
-                .entry(attr_name)
-                .or_insert_with(|| AttributeValue {
-                    name: name.to_string(),
-                    value: vec![val],
-                });
-        }
-    }
-    // Return the values of the resulting map
-    provided_attributes.into_values().collect()
-}
-
 #[graphql_object(context = Context<Handler>)]
 impl<Handler: BackendHandler> Mutation<Handler> {
    async fn create_user(
@@ -721,66 +547,6 @@ impl<Handler: BackendHandler> Mutation<Handler> {
        Ok(Success::new())
    }
 }
-
-async fn create_group_with_details<Handler: BackendHandler>(
-    context: &Context<Handler>,
-    request: CreateGroupInput,
-    span: Span,
-) -> FieldResult<super::query::Group<Handler>> {
-    let handler = context
-        .get_admin_handler()
-        .ok_or_else(field_error_callback(&span, "Unauthorized group creation"))?;
-    let schema = handler.get_schema().await?;
-    let attributes = request
-        .attributes
-        .unwrap_or_default()
-        .into_iter()
-        .map(|attr| deserialize_attribute(&schema.get_schema().group_attributes, attr, true))
-        .collect::<Result<Vec<_>, _>>()?;
-    let request = CreateGroupRequest {
-        display_name: request.display_name.into(),
-        attributes,
-    };
-    let group_id = handler.create_group(request).await?;
-    let group_details = handler.get_group_details(group_id).instrument(span).await?;
-    super::query::Group::<Handler>::from_group_details(group_details, Arc::new(schema))
-}
-
-fn deserialize_attribute(
-    attribute_schema: &AttributeList,
-    attribute: AttributeValue,
-    is_admin: bool,
-) -> FieldResult<DomainAttribute> {
-    let attribute_name = AttributeName::from(attribute.name.as_str());
-    let attribute_schema = attribute_schema
-        .get_attribute_schema(&attribute_name)
-        .ok_or_else(|| anyhow!("Attribute {} is not defined in the schema", attribute.name))?;
-    if attribute_schema.is_readonly {
-        return Err(anyhow!(
-            "Permission denied: Attribute {} is read-only",
-            attribute.name
-        )
-        .into());
-    }
-    if !is_admin && !attribute_schema.is_editable {
-        return Err(anyhow!(
-            "Permission denied: Attribute {} is not editable by regular users",
-            attribute.name
-        )
-        .into());
-    }
-    let deserialized_values = deserialize_attribute_value(
-        &attribute.value,
-        attribute_schema.attribute_type,
-        attribute_schema.is_list,
-    )
-    .context(format!("While deserializing attribute {}", attribute.name))?;
-    Ok(DomainAttribute {
-        name: attribute_name,
-        value: deserialized_values,
-    })
-}
-
 #[cfg(test)]
 mod tests {
    use super::*;
@@ -795,13 +561,13 @@ mod tests {
    use mockall::predicate::eq;
    use pretty_assertions::assert_eq;

-    fn mutation_schema<'q, C, Q, M>(
+    fn mutation_schema<C, Q, M>(
        query_root: Q,
        mutation_root: M,
-    ) -> RootNode<'q, Q, M, EmptySubscription<C>>
+    ) -> RootNode<Q, M, EmptySubscription<C>>
    where
-        Q: GraphQLType<DefaultScalarValue, Context = C, TypeInfo = ()> + 'q,
-        M: GraphQLType<DefaultScalarValue, Context = C, TypeInfo = ()> + 'q,
+        Q: GraphQLType<DefaultScalarValue, Context = C, TypeInfo = ()>,
+        M: GraphQLType<DefaultScalarValue, Context = C, TypeInfo = ()>,
    {
        RootNode::new(query_root, mutation_root, EmptySubscription::<C>::new())
    }
--- a/crates/graphql-server/src/query.rs
+++ b/crates/graphql-server/src/query.rs
--- a/crates/graphql-server/src/query/attribute.rs
+++ b/crates/graphql-server/src/query/attribute.rs
@@ -0,0 +1,267 @@
+use chrono::TimeZone;
+use juniper::{FieldResult, graphql_object};
+use lldap_domain::public_schema::PublicSchema;
+use lldap_domain::schema::AttributeList as DomainAttributeList;
+use lldap_domain::schema::AttributeSchema as DomainAttributeSchema;
+use lldap_domain::types::{Attribute as DomainAttribute, AttributeValue as DomainAttributeValue};
+use lldap_domain::types::{Cardinality, Group as DomainGroup, GroupDetails, User as DomainUser};
+use lldap_domain_handlers::handler::BackendHandler;
+use serde::{Deserialize, Serialize};
+
+use crate::api::Context;
+
+#[derive(PartialEq, Eq, Debug, Serialize, Deserialize)]
+pub struct AttributeSchema<Handler: BackendHandler> {
+    schema: DomainAttributeSchema,
+    _phantom: std::marker::PhantomData<Box<Handler>>,
+}
+
+#[graphql_object(context = Context<Handler>)]
+impl<Handler: BackendHandler> AttributeSchema<Handler> {
+    fn name(&self) -> String {
+        self.schema.name.to_string()
+    }
+    fn attribute_type(&self) -> lldap_domain::types::AttributeType {
+        self.schema.attribute_type
+    }
+    fn is_list(&self) -> bool {
+        self.schema.is_list
+    }
+    fn is_visible(&self) -> bool {
+        self.schema.is_visible
+    }
+    fn is_editable(&self) -> bool {
+        self.schema.is_editable
+    }
+    fn is_hardcoded(&self) -> bool {
+        self.schema.is_hardcoded
+    }
+    fn is_readonly(&self) -> bool {
+        self.schema.is_readonly
+    }
+}
+
+impl<Handler: BackendHandler> Clone for AttributeSchema<Handler> {
+    fn clone(&self) -> Self {
+        Self {
+            schema: self.schema.clone(),
+            _phantom: std::marker::PhantomData,
+        }
+    }
+}
+
+impl<Handler: BackendHandler> From<DomainAttributeSchema> for AttributeSchema<Handler> {
+    fn from(value: DomainAttributeSchema) -> Self {
+        Self {
+            schema: value,
+            _phantom: std::marker::PhantomData,
+        }
+    }
+}
+
+#[derive(PartialEq, Eq, Debug, Serialize, Deserialize)]
+pub struct AttributeValue<Handler: BackendHandler> {
+    pub(super) attribute: DomainAttribute,
+    pub(super) schema: AttributeSchema<Handler>,
+    _phantom: std::marker::PhantomData<Box<Handler>>,
+}
+
+#[graphql_object(context = Context<Handler>)]
+impl<Handler: BackendHandler> AttributeValue<Handler> {
+    fn name(&self) -> &str {
+        self.attribute.name.as_str()
+    }
+
+    fn value(&self) -> FieldResult<Vec<String>> {
+        Ok(serialize_attribute_to_graphql(&self.attribute.value))
+    }
+
+    fn schema(&self) -> &AttributeSchema<Handler> {
+        &self.schema
+    }
+}
+
+impl<Handler: BackendHandler> AttributeValue<Handler> {
+    fn from_value(attr: DomainAttribute, schema: DomainAttributeSchema) -> Self {
+        Self {
+            attribute: attr,
+            schema: AttributeSchema::<Handler> {
+                schema,
+                _phantom: std::marker::PhantomData,
+            },
+            _phantom: std::marker::PhantomData,
+        }
+    }
+
+    pub(super) fn attribute_name(&self) -> &str {
+        self.attribute.name.as_str()
+    }
+}
+
+impl<Handler: BackendHandler> Clone for AttributeValue<Handler> {
+    fn clone(&self) -> Self {
+        Self {
+            attribute: self.attribute.clone(),
+            schema: self.schema.clone(),
+            _phantom: std::marker::PhantomData,
+        }
+    }
+}
+
+pub fn serialize_attribute_to_graphql(attribute_value: &DomainAttributeValue) -> Vec<String> {
+    let convert_date = |&date| chrono::Utc.from_utc_datetime(&date).to_rfc3339();
+    match attribute_value {
+        DomainAttributeValue::String(Cardinality::Singleton(s)) => vec![s.clone()],
+        DomainAttributeValue::String(Cardinality::Unbounded(l)) => l.clone(),
+        DomainAttributeValue::Integer(Cardinality::Singleton(i)) => vec![i.to_string()],
+        DomainAttributeValue::Integer(Cardinality::Unbounded(l)) => {
+            l.iter().map(|i| i.to_string()).collect()
+        }
+        DomainAttributeValue::DateTime(Cardinality::Singleton(dt)) => vec![convert_date(dt)],
+        DomainAttributeValue::DateTime(Cardinality::Unbounded(l)) => {
+            l.iter().map(convert_date).collect()
+        }
+        DomainAttributeValue::JpegPhoto(Cardinality::Singleton(p)) => vec![String::from(p)],
+        DomainAttributeValue::JpegPhoto(Cardinality::Unbounded(l)) => {
+            l.iter().map(String::from).collect()
+        }
+    }
+}
+
+impl<Handler: BackendHandler> AttributeValue<Handler> {
+    fn from_schema(a: DomainAttribute, schema: &DomainAttributeList) -> Option<Self> {
+        schema
+            .get_attribute_schema(&a.name)
+            .map(|s| AttributeValue::<Handler>::from_value(a, s.clone()))
+    }
+
+    pub fn user_attributes_from_schema(
+        user: &mut DomainUser,
+        schema: &PublicSchema,
+    ) -> Vec<AttributeValue<Handler>> {
+        let user_attributes = std::mem::take(&mut user.attributes);
+        let mut all_attributes = schema
+            .get_schema()
+            .user_attributes
+            .attributes
+            .iter()
+            .filter(|a| a.is_hardcoded)
+            .flat_map(|attribute_schema| {
+                let value: Option<DomainAttributeValue> = match attribute_schema.name.as_str() {
+                    "user_id" => Some(user.user_id.clone().into_string().into()),
+                    "creation_date" => Some(user.creation_date.into()),
+                    "modified_date" => Some(user.modified_date.into()),
+                    "password_modified_date" => Some(user.password_modified_date.into()),
+                    "mail" => Some(user.email.clone().into_string().into()),
+                    "uuid" => Some(user.uuid.clone().into_string().into()),
+                    "display_name" => user.display_name.as_ref().map(|d| d.clone().into()),
+                    "avatar" | "first_name" | "last_name" => None,
+                    _ => panic!("Unexpected hardcoded attribute: {}", attribute_schema.name),
+                };
+                value.map(|v| (attribute_schema, v))
+            })
+            .map(|(attribute_schema, value)| {
+                AttributeValue::<Handler>::from_value(
+                    DomainAttribute {
+                        name: attribute_schema.name.clone(),
+                        value,
+                    },
+                    attribute_schema.clone(),
+                )
+            })
+            .collect::<Vec<_>>();
+        user_attributes
+            .into_iter()
+            .flat_map(|a| {
+                AttributeValue::<Handler>::from_schema(a, &schema.get_schema().user_attributes)
+            })
+            .for_each(|value| all_attributes.push(value));
+        all_attributes
+    }
+
+    pub fn group_attributes_from_schema(
+        group: &mut DomainGroup,
+        schema: &PublicSchema,
+    ) -> Vec<AttributeValue<Handler>> {
+        let group_attributes = std::mem::take(&mut group.attributes);
+        let mut all_attributes = schema
+            .get_schema()
+            .group_attributes
+            .attributes
+            .iter()
+            .filter(|a| a.is_hardcoded)
+            .map(|attribute_schema| {
+                (
+                    attribute_schema,
+                    match attribute_schema.name.as_str() {
+                        "group_id" => (group.id.0 as i64).into(),
+                        "creation_date" => group.creation_date.into(),
+                        "modified_date" => group.modified_date.into(),
+                        "uuid" => group.uuid.clone().into_string().into(),
+                        "display_name" => group.display_name.clone().into_string().into(),
+                        _ => panic!("Unexpected hardcoded attribute: {}", attribute_schema.name),
+                    },
+                )
+            })
+            .map(|(attribute_schema, value)| {
+                AttributeValue::<Handler>::from_value(
+                    DomainAttribute {
+                        name: attribute_schema.name.clone(),
+                        value,
+                    },
+                    attribute_schema.clone(),
+                )
+            })
+            .collect::<Vec<_>>();
+        group_attributes
+            .into_iter()
+            .flat_map(|a| {
+                AttributeValue::<Handler>::from_schema(a, &schema.get_schema().group_attributes)
+            })
+            .for_each(|value| all_attributes.push(value));
+        all_attributes
+    }
+
+    pub fn group_details_attributes_from_schema(
+        group: &mut GroupDetails,
+        schema: &PublicSchema,
+    ) -> Vec<AttributeValue<Handler>> {
+        let group_attributes = std::mem::take(&mut group.attributes);
+        let mut all_attributes = schema
+            .get_schema()
+            .group_attributes
+            .attributes
+            .iter()
+            .filter(|a| a.is_hardcoded)
+            .map(|attribute_schema| {
+                (
+                    attribute_schema,
+                    match attribute_schema.name.as_str() {
+                        "group_id" => (group.group_id.0 as i64).into(),
+                        "creation_date" => group.creation_date.into(),
+                        "modified_date" => group.modified_date.into(),
+                        "uuid" => group.uuid.clone().into_string().into(),
+                        "display_name" => group.display_name.clone().into_string().into(),
+                        _ => panic!("Unexpected hardcoded attribute: {}", attribute_schema.name),
+                    },
+                )
+            })
+            .map(|(attribute_schema, value)| {
+                AttributeValue::<Handler>::from_value(
+                    DomainAttribute {
+                        name: attribute_schema.name.clone(),
+                        value,
+                    },
+                    attribute_schema.clone(),
+                )
+            })
+            .collect::<Vec<_>>();
+        group_attributes
+            .into_iter()
+            .flat_map(|a| {
+                AttributeValue::<Handler>::from_schema(a, &schema.get_schema().group_attributes)
+            })
+            .for_each(|value| all_attributes.push(value));
+        all_attributes
+    }
+}
--- a/crates/graphql-server/src/query/filters.rs
+++ b/crates/graphql-server/src/query/filters.rs
@@ -0,0 +1,89 @@
+use anyhow::Context as AnyhowContext;
+use juniper::{FieldResult, GraphQLInputObject};
+use lldap_domain::deserialize::deserialize_attribute_value;
+use lldap_domain::public_schema::PublicSchema;
+use lldap_domain::types::GroupId;
+use lldap_domain::types::UserId;
+use lldap_domain_handlers::handler::UserRequestFilter as DomainRequestFilter;
+use lldap_domain_model::model::UserColumn;
+use lldap_ldap::{UserFieldType, map_user_field};
+
+#[derive(PartialEq, Eq, Debug, GraphQLInputObject)]
+/// A filter for requests, specifying a boolean expression based on field constraints. Only one of
+/// the fields can be set at a time.
+pub struct RequestFilter {
+    any: Option<Vec<RequestFilter>>,
+    all: Option<Vec<RequestFilter>>,
+    not: Option<Box<RequestFilter>>,
+    eq: Option<EqualityConstraint>,
+    member_of: Option<String>,
+    member_of_id: Option<i32>,
+}
+
+impl RequestFilter {
+    pub fn try_into_domain_filter(self, schema: &PublicSchema) -> FieldResult<DomainRequestFilter> {
+        match (
+            self.eq,
+            self.any,
+            self.all,
+            self.not,
+            self.member_of,
+            self.member_of_id,
+        ) {
+            (Some(eq), None, None, None, None, None) => {
+                match map_user_field(&eq.field.as_str().into(), schema) {
+                    UserFieldType::NoMatch => {
+                        Err(format!("Unknown request filter: {}", &eq.field).into())
+                    }
+                    UserFieldType::PrimaryField(UserColumn::UserId) => {
+                        Ok(DomainRequestFilter::UserId(UserId::new(&eq.value)))
+                    }
+                    UserFieldType::PrimaryField(column) => {
+                        Ok(DomainRequestFilter::Equality(column, eq.value))
+                    }
+                    UserFieldType::Attribute(name, typ, false) => {
+                        let value = deserialize_attribute_value(&[eq.value], typ, false)
+                            .context(format!("While deserializing attribute {}", &name))?;
+                        Ok(DomainRequestFilter::AttributeEquality(name, value))
+                    }
+                    UserFieldType::Attribute(_, _, true) => {
+                        Err("Equality not supported for list fields".into())
+                    }
+                    UserFieldType::MemberOf => Ok(DomainRequestFilter::MemberOf(eq.value.into())),
+                    UserFieldType::ObjectClass | UserFieldType::Dn | UserFieldType::EntryDn => {
+                        Err("Ldap fields not supported in request filter".into())
+                    }
+                }
+            }
+            (None, Some(any), None, None, None, None) => Ok(DomainRequestFilter::Or(
+                any.into_iter()
+                    .map(|f| f.try_into_domain_filter(schema))
+                    .collect::<FieldResult<Vec<_>>>()?,
+            )),
+            (None, None, Some(all), None, None, None) => Ok(DomainRequestFilter::And(
+                all.into_iter()
+                    .map(|f| f.try_into_domain_filter(schema))
+                    .collect::<FieldResult<Vec<_>>>()?,
+            )),
+            (None, None, None, Some(not), None, None) => Ok(DomainRequestFilter::Not(Box::new(
+                (*not).try_into_domain_filter(schema)?,
+            ))),
+            (None, None, None, None, Some(group), None) => {
+                Ok(DomainRequestFilter::MemberOf(group.into()))
+            }
+            (None, None, None, None, None, Some(group_id)) => {
+                Ok(DomainRequestFilter::MemberOfId(GroupId(group_id)))
+            }
+            (None, None, None, None, None, None) => {
+                Err("No field specified in request filter".into())
+            }
+            _ => Err("Multiple fields specified in request filter".into()),
+        }
+    }
+}
+
+#[derive(PartialEq, Eq, Debug, GraphQLInputObject)]
+pub struct EqualityConstraint {
+    field: String,
+    value: String,
+}
--- a/crates/graphql-server/src/query/group.rs
+++ b/crates/graphql-server/src/query/group.rs
@@ -0,0 +1,123 @@
+use chrono::TimeZone;
+use juniper::{FieldResult, graphql_object};
+use lldap_access_control::ReadonlyBackendHandler;
+use lldap_domain::public_schema::PublicSchema;
+use lldap_domain::types::{Group as DomainGroup, GroupDetails, GroupId};
+use lldap_domain_handlers::handler::{BackendHandler, UserRequestFilter as DomainRequestFilter};
+use serde::{Deserialize, Serialize};
+use std::sync::Arc;
+use tracing::{Instrument, debug, debug_span};
+
+use super::attribute::AttributeValue;
+use super::user::User;
+use crate::api::{Context, field_error_callback};
+
+#[derive(PartialEq, Eq, Debug, Serialize, Deserialize)]
+/// Represents a single group.
+pub struct Group<Handler: BackendHandler> {
+    pub group_id: i32,
+    pub display_name: String,
+    creation_date: chrono::NaiveDateTime,
+    uuid: String,
+    attributes: Vec<AttributeValue<Handler>>,
+    pub schema: Arc<PublicSchema>,
+    _phantom: std::marker::PhantomData<Box<Handler>>,
+}
+
+impl<Handler: BackendHandler> Group<Handler> {
+    pub fn from_group(
+        mut group: DomainGroup,
+        schema: Arc<PublicSchema>,
+    ) -> FieldResult<Group<Handler>> {
+        let attributes =
+            AttributeValue::<Handler>::group_attributes_from_schema(&mut group, &schema);
+        Ok(Self {
+            group_id: group.id.0,
+            display_name: group.display_name.to_string(),
+            creation_date: group.creation_date,
+            uuid: group.uuid.into_string(),
+            attributes,
+            schema,
+            _phantom: std::marker::PhantomData,
+        })
+    }
+
+    pub fn from_group_details(
+        mut group_details: GroupDetails,
+        schema: Arc<PublicSchema>,
+    ) -> FieldResult<Group<Handler>> {
+        let attributes = AttributeValue::<Handler>::group_details_attributes_from_schema(
+            &mut group_details,
+            &schema,
+        );
+        Ok(Self {
+            group_id: group_details.group_id.0,
+            display_name: group_details.display_name.to_string(),
+            creation_date: group_details.creation_date,
+            uuid: group_details.uuid.into_string(),
+            attributes,
+            schema,
+            _phantom: std::marker::PhantomData,
+        })
+    }
+}
+
+impl<Handler: BackendHandler> Clone for Group<Handler> {
+    fn clone(&self) -> Self {
+        Self {
+            group_id: self.group_id,
+            display_name: self.display_name.clone(),
+            creation_date: self.creation_date,
+            uuid: self.uuid.clone(),
+            attributes: self.attributes.clone(),
+            schema: self.schema.clone(),
+            _phantom: std::marker::PhantomData,
+        }
+    }
+}
+
+#[graphql_object(context = Context<Handler>)]
+impl<Handler: BackendHandler> Group<Handler> {
+    fn id(&self) -> i32 {
+        self.group_id
+    }
+    fn display_name(&self) -> String {
+        self.display_name.clone()
+    }
+    fn creation_date(&self) -> chrono::DateTime<chrono::Utc> {
+        chrono::Utc.from_utc_datetime(&self.creation_date)
+    }
+    fn uuid(&self) -> String {
+        self.uuid.clone()
+    }
+
+    /// User-defined attributes.
+    fn attributes(&self) -> &[AttributeValue<Handler>] {
+        &self.attributes
+    }
+
+    /// The groups to which this user belongs.
+    async fn users(&self, context: &Context<Handler>) -> FieldResult<Vec<User<Handler>>> {
+        let span = debug_span!("[GraphQL query] group::users");
+        span.in_scope(|| {
+            debug!(name = %self.display_name);
+        });
+        let handler = context
+            .get_readonly_handler()
+            .ok_or_else(field_error_callback(
+                &span,
+                "Unauthorized access to group data",
+            ))?;
+        let domain_users = handler
+            .list_users(
+                Some(DomainRequestFilter::MemberOfId(GroupId(self.group_id))),
+                false,
+            )
+            .instrument(span)
+            .await?;
+        domain_users
+            .into_iter()
+            .map(|u| User::<Handler>::from_user_and_groups(u, self.schema.clone()))
+            .collect()
+    }
+}
--- a/crates/graphql-server/src/query/mod.rs
+++ b/crates/graphql-server/src/query/mod.rs
@@ -0,0 +1,548 @@
+pub mod attribute;
+pub mod filters;
+pub mod group;
+pub mod schema;
+pub mod user;
+
+// Re-export public types
+pub use attribute::{AttributeSchema, AttributeValue, serialize_attribute_to_graphql};
+pub use filters::{EqualityConstraint, RequestFilter};
+pub use group::Group;
+pub use schema::{AttributeList, ObjectClassInfo, Schema};
+pub use user::User;
+
+use juniper::{FieldResult, graphql_object};
+use lldap_access_control::{ReadonlyBackendHandler, UserReadableBackendHandler};
+use lldap_domain::public_schema::PublicSchema;
+use lldap_domain::types::{GroupId, UserId};
+use lldap_domain_handlers::handler::{BackendHandler, ReadSchemaBackendHandler};
+use std::sync::Arc;
+use tracing::{Instrument, Span, debug, debug_span};
+
+use crate::api::{Context, field_error_callback};
+
+#[derive(PartialEq, Eq, Debug)]
+/// The top-level GraphQL query type.
+pub struct Query<Handler: BackendHandler> {
+    _phantom: std::marker::PhantomData<Box<Handler>>,
+}
+
+impl<Handler: BackendHandler> Default for Query<Handler> {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl<Handler: BackendHandler> Query<Handler> {
+    pub fn new() -> Self {
+        Self {
+            _phantom: std::marker::PhantomData,
+        }
+    }
+}
+
+#[graphql_object(context = Context<Handler>)]
+impl<Handler: BackendHandler> Query<Handler> {
+    fn api_version() -> &'static str {
+        "1.0"
+    }
+
+    pub async fn user(
+        &self,
+        context: &Context<Handler>,
+        user_id: String,
+    ) -> FieldResult<User<Handler>> {
+        use anyhow::Context;
+        let span = debug_span!("[GraphQL query] user");
+        span.in_scope(|| {
+            debug!(?user_id);
+        });
+        let user_id = urlencoding::decode(&user_id).context("Invalid user parameter")?;
+        let user_id = UserId::new(&user_id);
+        let handler = context
+            .get_readable_handler(&user_id)
+            .ok_or_else(field_error_callback(
+                &span,
+                "Unauthorized access to user data",
+            ))?;
+        let schema: Arc<PublicSchema> = Arc::new(self.get_schema(context, span.clone()).await?);
+        let user = handler.get_user_details(&user_id).instrument(span).await?;
+        User::<Handler>::from_user(user, schema)
+    }
+
+    async fn users(
+        &self,
+        context: &Context<Handler>,
+        filters: Option<RequestFilter>,
+    ) -> FieldResult<Vec<User<Handler>>> {
+        let span = debug_span!("[GraphQL query] users");
+        span.in_scope(|| {
+            debug!(?filters);
+        });
+        let handler = context
+            .get_readonly_handler()
+            .ok_or_else(field_error_callback(
+                &span,
+                "Unauthorized access to user list",
+            ))?;
+        let schema: Arc<PublicSchema> = Arc::new(self.get_schema(context, span.clone()).await?);
+        let users = handler
+            .list_users(
+                filters
+                    .map(|f| f.try_into_domain_filter(&schema))
+                    .transpose()?,
+                false,
+            )
+            .instrument(span)
+            .await?;
+        users
+            .into_iter()
+            .map(|u| User::<Handler>::from_user_and_groups(u, schema.clone()))
+            .collect()
+    }
+
+    async fn groups(&self, context: &Context<Handler>) -> FieldResult<Vec<Group<Handler>>> {
+        let span = debug_span!("[GraphQL query] groups");
+        let handler = context
+            .get_readonly_handler()
+            .ok_or_else(field_error_callback(
+                &span,
+                "Unauthorized access to group list",
+            ))?;
+        let schema: Arc<PublicSchema> = Arc::new(self.get_schema(context, span.clone()).await?);
+        let domain_groups = handler.list_groups(None).instrument(span).await?;
+        domain_groups
+            .into_iter()
+            .map(|g| Group::<Handler>::from_group(g, schema.clone()))
+            .collect()
+    }
+
+    async fn group(
+        &self,
+        context: &Context<Handler>,
+        group_id: i32,
+    ) -> FieldResult<Group<Handler>> {
+        let span = debug_span!("[GraphQL query] group");
+        span.in_scope(|| {
+            debug!(?group_id);
+        });
+        let handler = context
+            .get_readonly_handler()
+            .ok_or_else(field_error_callback(
+                &span,
+                "Unauthorized access to group data",
+            ))?;
+        let schema: Arc<PublicSchema> = Arc::new(self.get_schema(context, span.clone()).await?);
+        let group_details = handler
+            .get_group_details(GroupId(group_id))
+            .instrument(span)
+            .await?;
+        Group::<Handler>::from_group_details(group_details, schema.clone())
+    }
+
+    async fn schema(&self, context: &Context<Handler>) -> FieldResult<Schema<Handler>> {
+        let span = debug_span!("[GraphQL query] get_schema");
+        self.get_schema(context, span).await.map(Into::into)
+    }
+}
+
+impl<Handler: BackendHandler> Query<Handler> {
+    async fn get_schema(
+        &self,
+        context: &Context<Handler>,
+        span: Span,
+    ) -> FieldResult<PublicSchema> {
+        let handler = context
+            .handler
+            .get_user_restricted_lister_handler(&context.validation_result);
+        Ok(handler
+            .get_schema()
+            .instrument(span)
+            .await
+            .map(Into::<PublicSchema>::into)?)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use chrono::TimeZone;
+    use juniper::{
+        DefaultScalarValue, EmptyMutation, EmptySubscription, GraphQLType, RootNode, Variables,
+        execute, graphql_value,
+    };
+    use lldap_auth::access_control::{Permission, ValidationResults};
+    use lldap_domain::schema::AttributeSchema as DomainAttributeSchema;
+    use lldap_domain::types::{Attribute as DomainAttribute, GroupDetails, User as DomainUser};
+    use lldap_domain::{
+        schema::{AttributeList, Schema},
+        types::{AttributeName, AttributeType, LdapObjectClass},
+    };
+    use lldap_domain_model::model::UserColumn;
+    use lldap_test_utils::{MockTestBackendHandler, setup_default_schema};
+    use mockall::predicate::eq;
+    use pretty_assertions::assert_eq;
+    use std::collections::HashSet;
+
+    fn schema<C, Q>(query_root: Q) -> RootNode<Q, EmptyMutation<C>, EmptySubscription<C>>
+    where
+        Q: GraphQLType<DefaultScalarValue, Context = C, TypeInfo = ()>,
+    {
+        RootNode::new(
+            query_root,
+            EmptyMutation::<C>::new(),
+            EmptySubscription::<C>::new(),
+        )
+    }
+
+    #[tokio::test]
+    async fn get_user_by_id() {
+        const QUERY: &str = r#"{
+          user(userId: "bob") {
+            id
+            email
+            creationDate
+            firstName
+            lastName
+            uuid
+            attributes {
+              name
+              value
+            }
+            groups {
+              id
+              displayName
+              creationDate
+              uuid
+              attributes {
+                name
+                value
+              }
+            }
+          }
+        }"#;
+
+        let mut mock = MockTestBackendHandler::new();
+        mock.expect_get_schema().returning(|| {
+            Ok(Schema {
+                user_attributes: AttributeList {
+                    attributes: vec![
+                        DomainAttributeSchema {
+                            name: "first_name".into(),
+                            attribute_type: AttributeType::String,
+                            is_list: false,
+                            is_visible: true,
+                            is_editable: true,
+                            is_hardcoded: true,
+                            is_readonly: false,
+                        },
+                        DomainAttributeSchema {
+                            name: "last_name".into(),
+                            attribute_type: AttributeType::String,
+                            is_list: false,
+                            is_visible: true,
+                            is_editable: true,
+                            is_hardcoded: true,
+                            is_readonly: false,
+                        },
+                    ],
+                },
+                group_attributes: AttributeList {
+                    attributes: vec![DomainAttributeSchema {
+                        name: "club_name".into(),
+                        attribute_type: AttributeType::String,
+                        is_list: false,
+                        is_visible: true,
+                        is_editable: true,
+                        is_hardcoded: false,
+                        is_readonly: false,
+                    }],
+                },
+                extra_user_object_classes: vec![
+                    LdapObjectClass::from("customUserClass"),
+                    LdapObjectClass::from("myUserClass"),
+                ],
+                extra_group_object_classes: vec![LdapObjectClass::from("customGroupClass")],
+            })
+        });
+        mock.expect_get_user_details()
+            .with(eq(UserId::new("bob")))
+            .return_once(|_| {
+                Ok(DomainUser {
+                    user_id: UserId::new("bob"),
+                    email: "bob@bobbers.on".into(),
+                    display_name: None,
+                    creation_date: chrono::Utc.timestamp_millis_opt(42).unwrap().naive_utc(),
+                    modified_date: chrono::Utc.timestamp_opt(0, 0).unwrap().naive_utc(),
+                    password_modified_date: chrono::Utc.timestamp_opt(0, 0).unwrap().naive_utc(),
+                    uuid: lldap_domain::types::Uuid::from_name_and_date(
+                        "bob",
+                        &chrono::Utc.timestamp_millis_opt(42).unwrap().naive_utc(),
+                    ),
+                    attributes: vec![
+                        DomainAttribute {
+                            name: "first_name".into(),
+                            value: "Bob".to_string().into(),
+                        },
+                        DomainAttribute {
+                            name: "last_name".into(),
+                            value: "Bobberson".to_string().into(),
+                        },
+                    ],
+                })
+            });
+        let mut groups = HashSet::new();
+        groups.insert(GroupDetails {
+            group_id: GroupId(3),
+            display_name: "Bobbersons".into(),
+            creation_date: chrono::Utc.timestamp_nanos(42).naive_utc(),
+            uuid: lldap_domain::types::Uuid::from_name_and_date(
+                "Bobbersons",
+                &chrono::Utc.timestamp_nanos(42).naive_utc(),
+            ),
+            attributes: vec![DomainAttribute {
+                name: "club_name".into(),
+                value: "Gang of Four".to_string().into(),
+            }],
+            modified_date: chrono::Utc.timestamp_nanos(42).naive_utc(),
+        });
+        groups.insert(GroupDetails {
+            group_id: GroupId(7),
+            display_name: "Jefferees".into(),
+            creation_date: chrono::Utc.timestamp_nanos(12).naive_utc(),
+            uuid: lldap_domain::types::Uuid::from_name_and_date(
+                "Jefferees",
+                &chrono::Utc.timestamp_nanos(12).naive_utc(),
+            ),
+            attributes: Vec::new(),
+            modified_date: chrono::Utc.timestamp_nanos(12).naive_utc(),
+        });
+        mock.expect_get_user_groups()
+            .with(eq(UserId::new("bob")))
+            .return_once(|_| Ok(groups));
+
+        let context = Context::<MockTestBackendHandler>::new_for_tests(
+            mock,
+            ValidationResults {
+                user: UserId::new("admin"),
+                permission: Permission::Admin,
+            },
+        );
+
+        let schema = schema(Query::<MockTestBackendHandler>::new());
+        let result = execute(QUERY, None, &schema, &Variables::new(), &context).await;
+        assert!(result.is_ok(), "Query failed: {:?}", result);
+    }
+
+    #[tokio::test]
+    async fn list_users() {
+        const QUERY: &str = r#"{
+          users(filters: {
+            any: [
+              {eq: {
+                field: "id"
+                value: "bob"
+              }},
+              {eq: {
+                field: "email"
+                value: "robert@bobbers.on"
+              }},
+              {eq: {
+                field: "firstName"
+                value: "robert"
+              }}
+            ]}) {
+            id
+            email
+          }
+        }"#;
+
+        let mut mock = MockTestBackendHandler::new();
+        setup_default_schema(&mut mock);
+        mock.expect_list_users()
+            .with(
+                eq(Some(lldap_domain_handlers::handler::UserRequestFilter::Or(
+                    vec![
+                        lldap_domain_handlers::handler::UserRequestFilter::UserId(UserId::new(
+                            "bob",
+                        )),
+                        lldap_domain_handlers::handler::UserRequestFilter::Equality(
+                            UserColumn::Email,
+                            "robert@bobbers.on".to_owned(),
+                        ),
+                        lldap_domain_handlers::handler::UserRequestFilter::AttributeEquality(
+                            AttributeName::from("first_name"),
+                            "robert".to_string().into(),
+                        ),
+                    ],
+                ))),
+                eq(false),
+            )
+            .return_once(|_, _| {
+                Ok(vec![
+                    lldap_domain::types::UserAndGroups {
+                        user: DomainUser {
+                            user_id: UserId::new("bob"),
+                            email: "bob@bobbers.on".into(),
+                            display_name: None,
+                            creation_date: chrono::Utc.timestamp_opt(0, 0).unwrap().naive_utc(),
+                            modified_date: chrono::Utc.timestamp_opt(0, 0).unwrap().naive_utc(),
+                            password_modified_date: chrono::Utc
+                                .timestamp_opt(0, 0)
+                                .unwrap()
+                                .naive_utc(),
+                            uuid: lldap_domain::types::Uuid::from_name_and_date(
+                                "bob",
+                                &chrono::Utc.timestamp_opt(0, 0).unwrap().naive_utc(),
+                            ),
+                            attributes: Vec::new(),
+                        },
+                        groups: None,
+                    },
+                    lldap_domain::types::UserAndGroups {
+                        user: DomainUser {
+                            user_id: UserId::new("robert"),
+                            email: "robert@bobbers.on".into(),
+                            display_name: None,
+                            creation_date: chrono::Utc.timestamp_opt(0, 0).unwrap().naive_utc(),
+                            modified_date: chrono::Utc.timestamp_opt(0, 0).unwrap().naive_utc(),
+                            password_modified_date: chrono::Utc
+                                .timestamp_opt(0, 0)
+                                .unwrap()
+                                .naive_utc(),
+                            uuid: lldap_domain::types::Uuid::from_name_and_date(
+                                "robert",
+                                &chrono::Utc.timestamp_opt(0, 0).unwrap().naive_utc(),
+                            ),
+                            attributes: Vec::new(),
+                        },
+                        groups: None,
+                    },
+                ])
+            });
+
+        let context = Context::<MockTestBackendHandler>::new_for_tests(
+            mock,
+            ValidationResults {
+                user: UserId::new("admin"),
+                permission: Permission::Admin,
+            },
+        );
+
+        let schema = schema(Query::<MockTestBackendHandler>::new());
+        assert_eq!(
+            execute(QUERY, None, &schema, &Variables::new(), &context).await,
+            Ok((
+                graphql_value!(
+                {
+                    "users": [
+                        {
+                            "id": "bob",
+                            "email": "bob@bobbers.on"
+                        },
+                        {
+                            "id": "robert",
+                            "email": "robert@bobbers.on"
+                        },
+                    ]
+                }),
+                vec![]
+            ))
+        );
+    }
+
+    #[tokio::test]
+    async fn get_schema() {
+        const QUERY: &str = r#"{
+          schema {
+            userSchema {
+                attributes {
+                    name
+                    attributeType
+                    isList
+                    isVisible
+                    isEditable
+                    isHardcoded
+                }
+                extraLdapObjectClasses
+            }
+            groupSchema {
+                attributes {
+                    name
+                    attributeType
+                    isList
+                    isVisible
+                    isEditable
+                    isHardcoded
+                }
+                extraLdapObjectClasses
+            }
+          }
+        }"#;
+
+        let mut mock = MockTestBackendHandler::new();
+
+        setup_default_schema(&mut mock);
+
+        let context = Context::<MockTestBackendHandler>::new_for_tests(
+            mock,
+            ValidationResults {
+                user: UserId::new("admin"),
+                permission: Permission::Admin,
+            },
+        );
+
+        let schema = schema(Query::<MockTestBackendHandler>::new());
+        let result = execute(QUERY, None, &schema, &Variables::new(), &context).await;
+        assert!(result.is_ok(), "Query failed: {:?}", result);
+    }
+
+    #[tokio::test]
+    async fn regular_user_doesnt_see_non_visible_attributes() {
+        const QUERY: &str = r#"{
+          schema {
+            userSchema {
+                attributes {
+                    name
+                }
+                extraLdapObjectClasses
+            }
+          }
+        }"#;
+
+        let mut mock = MockTestBackendHandler::new();
+
+        mock.expect_get_schema().times(1).return_once(|| {
+            Ok(Schema {
+                user_attributes: AttributeList {
+                    attributes: vec![DomainAttributeSchema {
+                        name: "invisible".into(),
+                        attribute_type: AttributeType::JpegPhoto,
+                        is_list: false,
+                        is_visible: false,
+                        is_editable: true,
+                        is_hardcoded: true,
+                        is_readonly: false,
+                    }],
+                },
+                group_attributes: AttributeList {
+                    attributes: Vec::new(),
+                },
+                extra_user_object_classes: vec![LdapObjectClass::from("customUserClass")],
+                extra_group_object_classes: Vec::new(),
+            })
+        });
+
+        let context = Context::<MockTestBackendHandler>::new_for_tests(
+            mock,
+            ValidationResults {
+                user: UserId::new("bob"),
+                permission: Permission::Regular,
+            },
+        );
+
+        let schema = schema(Query::<MockTestBackendHandler>::new());
+        let result = execute(QUERY, None, &schema, &Variables::new(), &context).await;
+        assert!(result.is_ok(), "Query failed: {:?}", result);
+    }
+}
--- a/crates/graphql-server/src/query/schema.rs
+++ b/crates/graphql-server/src/query/schema.rs
@@ -0,0 +1,117 @@
+use juniper::graphql_object;
+use lldap_domain::public_schema::PublicSchema;
+use lldap_domain::schema::AttributeList as DomainAttributeList;
+use lldap_domain::types::LdapObjectClass;
+use lldap_domain_handlers::handler::BackendHandler;
+use lldap_ldap::{get_default_group_object_classes, get_default_user_object_classes};
+use serde::{Deserialize, Serialize};
+
+use super::attribute::AttributeSchema;
+use crate::api::Context;
+
+#[derive(PartialEq, Eq, Debug, Serialize, Deserialize)]
+pub struct AttributeList<Handler: BackendHandler> {
+    attributes: DomainAttributeList,
+    default_classes: Vec<LdapObjectClass>,
+    extra_classes: Vec<LdapObjectClass>,
+    _phantom: std::marker::PhantomData<Box<Handler>>,
+}
+
+#[derive(Clone)]
+pub struct ObjectClassInfo {
+    object_class: String,
+    is_hardcoded: bool,
+}
+
+#[graphql_object]
+impl ObjectClassInfo {
+    fn object_class(&self) -> &str {
+        &self.object_class
+    }
+
+    fn is_hardcoded(&self) -> bool {
+        self.is_hardcoded
+    }
+}
+
+#[graphql_object(context = Context<Handler>)]
+impl<Handler: BackendHandler> AttributeList<Handler> {
+    fn attributes(&self) -> Vec<AttributeSchema<Handler>> {
+        self.attributes
+            .attributes
+            .clone()
+            .into_iter()
+            .map(Into::into)
+            .collect()
+    }
+
+    fn extra_ldap_object_classes(&self) -> Vec<String> {
+        self.extra_classes.iter().map(|c| c.to_string()).collect()
+    }
+
+    fn ldap_object_classes(&self) -> Vec<ObjectClassInfo> {
+        let mut all_object_classes: Vec<ObjectClassInfo> = self
+            .default_classes
+            .iter()
+            .map(|c| ObjectClassInfo {
+                object_class: c.to_string(),
+                is_hardcoded: true,
+            })
+            .collect();
+
+        all_object_classes.extend(self.extra_classes.iter().map(|c| ObjectClassInfo {
+            object_class: c.to_string(),
+            is_hardcoded: false,
+        }));
+
+        all_object_classes
+    }
+}
+
+impl<Handler: BackendHandler> AttributeList<Handler> {
+    pub fn new(
+        attributes: DomainAttributeList,
+        default_classes: Vec<LdapObjectClass>,
+        extra_classes: Vec<LdapObjectClass>,
+    ) -> Self {
+        Self {
+            attributes,
+            default_classes,
+            extra_classes,
+            _phantom: std::marker::PhantomData,
+        }
+    }
+}
+
+#[derive(PartialEq, Eq, Debug, Serialize, Deserialize)]
+pub struct Schema<Handler: BackendHandler> {
+    schema: PublicSchema,
+    _phantom: std::marker::PhantomData<Box<Handler>>,
+}
+
+#[graphql_object(context = Context<Handler>)]
+impl<Handler: BackendHandler> Schema<Handler> {
+    fn user_schema(&self) -> AttributeList<Handler> {
+        AttributeList::<Handler>::new(
+            self.schema.get_schema().user_attributes.clone(),
+            get_default_user_object_classes(),
+            self.schema.get_schema().extra_user_object_classes.clone(),
+        )
+    }
+    fn group_schema(&self) -> AttributeList<Handler> {
+        AttributeList::<Handler>::new(
+            self.schema.get_schema().group_attributes.clone(),
+            get_default_group_object_classes(),
+            self.schema.get_schema().extra_group_object_classes.clone(),
+        )
+    }
+}
+
+impl<Handler: BackendHandler> From<PublicSchema> for Schema<Handler> {
+    fn from(value: PublicSchema) -> Self {
+        Self {
+            schema: value,
+            _phantom: std::marker::PhantomData,
+        }
+    }
+}
--- a/crates/graphql-server/src/query/user.rs
+++ b/crates/graphql-server/src/query/user.rs
@@ -0,0 +1,136 @@
+use chrono::TimeZone;
+use juniper::{FieldResult, graphql_object};
+use lldap_access_control::UserReadableBackendHandler;
+use lldap_domain::public_schema::PublicSchema;
+use lldap_domain::types::{User as DomainUser, UserAndGroups as DomainUserAndGroups};
+use lldap_domain_handlers::handler::BackendHandler;
+use serde::{Deserialize, Serialize};
+use std::sync::Arc;
+use tracing::{Instrument, debug, debug_span};
+
+use super::attribute::AttributeValue;
+use super::group::Group;
+use crate::api::Context;
+
+#[derive(PartialEq, Eq, Debug, Serialize, Deserialize)]
+/// Represents a single user.
+pub struct User<Handler: BackendHandler> {
+    user: DomainUser,
+    attributes: Vec<AttributeValue<Handler>>,
+    schema: Arc<PublicSchema>,
+    groups: Option<Vec<Group<Handler>>>,
+    _phantom: std::marker::PhantomData<Box<Handler>>,
+}
+
+impl<Handler: BackendHandler> User<Handler> {
+    pub fn from_user(mut user: DomainUser, schema: Arc<PublicSchema>) -> FieldResult<Self> {
+        let attributes = AttributeValue::<Handler>::user_attributes_from_schema(&mut user, &schema);
+        Ok(Self {
+            user,
+            attributes,
+            schema,
+            groups: None,
+            _phantom: std::marker::PhantomData,
+        })
+    }
+}
+
+impl<Handler: BackendHandler> User<Handler> {
+    pub fn from_user_and_groups(
+        DomainUserAndGroups { user, groups }: DomainUserAndGroups,
+        schema: Arc<PublicSchema>,
+    ) -> FieldResult<Self> {
+        let mut user = Self::from_user(user, schema.clone())?;
+        if let Some(groups) = groups {
+            user.groups = Some(
+                groups
+                    .into_iter()
+                    .map(|g| Group::<Handler>::from_group_details(g, schema.clone()))
+                    .collect::<FieldResult<Vec<_>>>()?,
+            );
+        }
+        Ok(user)
+    }
+}
+
+#[graphql_object(context = Context<Handler>)]
+impl<Handler: BackendHandler> User<Handler> {
+    fn id(&self) -> &str {
+        self.user.user_id.as_str()
+    }
+
+    fn email(&self) -> &str {
+        self.user.email.as_str()
+    }
+
+    fn display_name(&self) -> &str {
+        self.user.display_name.as_deref().unwrap_or("")
+    }
+
+    fn first_name(&self) -> &str {
+        self.attributes
+            .iter()
+            .find(|a| a.attribute_name() == "first_name")
+            .map(|a| a.attribute.value.as_str().unwrap_or_default())
+            .unwrap_or_default()
+    }
+
+    fn last_name(&self) -> &str {
+        self.attributes
+            .iter()
+            .find(|a| a.attribute_name() == "last_name")
+            .map(|a| a.attribute.value.as_str().unwrap_or_default())
+            .unwrap_or_default()
+    }
+
+    fn avatar(&self) -> Option<String> {
+        self.attributes
+            .iter()
+            .find(|a| a.attribute_name() == "avatar")
+            .map(|a| {
+                String::from(
+                    a.attribute
+                        .value
+                        .as_jpeg_photo()
+                        .expect("Invalid JPEG returned by the DB"),
+                )
+            })
+    }
+
+    fn creation_date(&self) -> chrono::DateTime<chrono::Utc> {
+        chrono::Utc.from_utc_datetime(&self.user.creation_date)
+    }
+
+    fn uuid(&self) -> &str {
+        self.user.uuid.as_str()
+    }
+
+    /// User-defined attributes.
+    fn attributes(&self) -> &[AttributeValue<Handler>] {
+        &self.attributes
+    }
+
+    /// The groups to which this user belongs.
+    async fn groups(&self, context: &Context<Handler>) -> FieldResult<Vec<Group<Handler>>> {
+        if let Some(groups) = &self.groups {
+            return Ok(groups.clone());
+        }
+        let span = debug_span!("[GraphQL query] user::groups");
+        span.in_scope(|| {
+            debug!(user_id = ?self.user.user_id);
+        });
+        let handler = context
+            .get_readable_handler(&self.user.user_id)
+            .expect("We shouldn't be able to get there without readable permission");
+        let domain_groups = handler
+            .get_user_groups(&self.user.user_id)
+            .instrument(span)
+            .await?;
+        let mut groups = domain_groups
+            .into_iter()
+            .map(|g| Group::<Handler>::from_group_details(g, self.schema.clone()))
+            .collect::<FieldResult<Vec<Group<Handler>>>>()?;
+        groups.sort_by(|g1, g2| g1.display_name.cmp(&g2.display_name));
+        Ok(groups)
+    }
+}
--- a/crates/ldap/Cargo.toml
+++ b/crates/ldap/Cargo.toml
@@ -1,35 +1,28 @@
 [package]
 name = "lldap_ldap"
-version = "0.1.0"
+version = "0.1.1"
 description = "LDAP operations support"
 authors.workspace = true
 edition.workspace = true
 homepage.workspace = true
 license.workspace = true
 repository.workspace = true
+rust-version.workspace = true

 [dependencies]
-anyhow = "*"
-ldap3_proto = "0.6.0"
-tracing = "*"
-itertools = "0.10"
+anyhow = { workspace = true }
+tracing = { workspace = true }
+itertools = { workspace = true }

-[dependencies.derive_more]
-features = ["from"]
-default-features = false
-version = "1"
+derive_more = { workspace = true }

-[dependencies.chrono]
-features = ["serde"]
-version = "*"
+chrono = { workspace = true }

-[dependencies.rand]
-features = ["small_rng", "getrandom"]
-version = "0.8"
+rand = { workspace = true }

-[dependencies.uuid]
-version = "1"
-features = ["v1", "v3"]
+uuid = { workspace = true }
+
+ldap3_proto = { workspace = true }

 [dependencies.lldap_access_control]
 path = "../access-control"
@@ -54,13 +47,11 @@ path = "../opaque-handler"
 path = "../test-utils"

 [dev-dependencies]
-mockall = "0.11.4"
-pretty_assertions = "1"
+mockall = { workspace = true }
+pretty_assertions = { workspace = true }

-[dev-dependencies.tokio]
-features = ["full"]
-version = "1.25"
+tokio = { workspace = true }

 [dev-dependencies.lldap_domain]
 path = "../domain"
-features = ["test"]
+features = ["test"]
--- a/crates/ldap/src/compare.rs
+++ b/crates/ldap/src/compare.rs
@@ -124,6 +124,7 @@ mod tests {
                users: vec![UserId::new("bob")],
                uuid: uuid!("04ac75e0-2900-3e21-926c-2f732c26b3fc"),
                attributes: Vec::new(),
+                modified_date: chrono::Utc.timestamp_opt(42, 42).unwrap().naive_utc(),
            }])
        });
        let ldap_handler = setup_bound_admin_handler(mock).await;
@@ -218,6 +219,7 @@ mod tests {
                users: vec![UserId::new("bob")],
                uuid: uuid!("04ac75e0-2900-3e21-926c-2f732c26b3fc"),
                attributes: Vec::new(),
+                modified_date: chrono::Utc.timestamp_opt(42, 42).unwrap().naive_utc(),
            }])
        });
        let ldap_handler = setup_bound_admin_handler(mock).await;
--- a/crates/ldap/src/core/group.rs
+++ b/crates/ldap/src/core/group.rs
@@ -72,6 +72,12 @@ pub fn get_group_attribute(
                .to_rfc3339()
                .into_bytes(),
        ],
+        GroupFieldType::ModifiedDate => vec![
+            chrono::Utc
+                .from_utc_datetime(&group.modified_date)
+                .to_rfc3339()
+                .into_bytes(),
+        ],
        GroupFieldType::Member => group
            .users
            .iter()
@@ -167,22 +173,31 @@ fn get_group_attribute_equality_filter(
    typ: AttributeType,
    is_list: bool,
    value: &str,
-) -> GroupRequestFilter {
+) -> LdapResult<GroupRequestFilter> {
+    if is_list {
+        return Err(LdapError {
+            code: LdapResultCode::UnwillingToPerform,
+            message: format!(
+                "Equality filter on list attribute \"{}\" is not supported",
+                field
+            ),
+        });
+    }
    let value_lc = value.to_ascii_lowercase();
-    let serialized_value = deserialize_attribute_value(&[value.to_owned()], typ, is_list);
-    let serialized_value_lc = deserialize_attribute_value(&[value_lc.to_owned()], typ, is_list);
+    let serialized_value = deserialize_attribute_value(&[value.to_owned()], typ, false);
+    let serialized_value_lc = deserialize_attribute_value(&[value_lc.to_owned()], typ, false);
    match (serialized_value, serialized_value_lc) {
-        (Ok(v), Ok(v_lc)) => GroupRequestFilter::Or(vec![
+        (Ok(v), Ok(v_lc)) => Ok(GroupRequestFilter::Or(vec![
            GroupRequestFilter::AttributeEquality(field.clone(), v),
            GroupRequestFilter::AttributeEquality(field.clone(), v_lc),
-        ]),
+        ])),
        (Ok(_), Err(e)) => {
            warn!("Invalid value for attribute {} (lowercased): {}", field, e);
-            GroupRequestFilter::from(false)
+            Ok(GroupRequestFilter::False)
        }
        (Err(e), _) => {
            warn!("Invalid value for attribute {}: {}", field, e);
-            GroupRequestFilter::from(false)
+            Ok(GroupRequestFilter::False)
        }
    }
 }
@@ -203,7 +218,7 @@ fn convert_group_filter(
                    .map(|id| GroupRequestFilter::GroupId(GroupId(id)))
                    .unwrap_or_else(|_| {
                        warn!("Given group id is not a valid integer: {}", value_lc);
-                        GroupRequestFilter::from(false)
+                        GroupRequestFilter::False
                    })),
                GroupFieldType::DisplayName => Ok(GroupRequestFilter::DisplayName(value_lc.into())),
                GroupFieldType::Uuid => Uuid::try_from(value_lc.as_str())
@@ -220,7 +235,7 @@ fn convert_group_filter(
                .map(GroupRequestFilter::Member)
                .unwrap_or_else(|e| {
                    warn!("Invalid member filter on group: {}", e);
-                    GroupRequestFilter::from(false)
+                    GroupRequestFilter::False
                })),
                GroupFieldType::ObjectClass => Ok(GroupRequestFilter::from(
                    get_default_group_object_classes()
@@ -240,7 +255,7 @@ fn convert_group_filter(
                    .map(GroupRequestFilter::DisplayName)
                    .unwrap_or_else(|_| {
                        warn!("Invalid dn filter on group: {}", value_lc);
-                        GroupRequestFilter::from(false)
+                        GroupRequestFilter::False
                    }))
                }
                GroupFieldType::NoMatch => {
@@ -251,32 +266,70 @@ fn convert_group_filter(
                            field
                        );
                    }
-                    Ok(GroupRequestFilter::from(false))
+                    Ok(GroupRequestFilter::False)
+                }
+                GroupFieldType::Attribute(field, typ, is_list) => {
+                    get_group_attribute_equality_filter(&field, typ, is_list, value)
                }
-                GroupFieldType::Attribute(field, typ, is_list) => Ok(
-                    get_group_attribute_equality_filter(&field, typ, is_list, value),
-                ),
                GroupFieldType::CreationDate => Err(LdapError {
                    code: LdapResultCode::UnwillingToPerform,
                    message: "Creation date filter for groups not supported".to_owned(),
                }),
+                GroupFieldType::ModifiedDate => Err(LdapError {
+                    code: LdapResultCode::UnwillingToPerform,
+                    message: "Modified date filter for groups not supported".to_owned(),
+                }),
            }
        }
-        LdapFilter::And(filters) => Ok(GroupRequestFilter::And(
-            filters.iter().map(rec).collect::<LdapResult<_>>()?,
-        )),
-        LdapFilter::Or(filters) => Ok(GroupRequestFilter::Or(
-            filters.iter().map(rec).collect::<LdapResult<_>>()?,
-        )),
-        LdapFilter::Not(filter) => Ok(GroupRequestFilter::Not(Box::new(rec(filter)?))),
+        LdapFilter::And(filters) => {
+            let res = filters
+                .iter()
+                .map(rec)
+                .filter(|f| !matches!(f, Ok(GroupRequestFilter::True)))
+                .flat_map(|f| match f {
+                    Ok(GroupRequestFilter::And(v)) => v.into_iter().map(Ok).collect(),
+                    f => vec![f],
+                })
+                .collect::<LdapResult<Vec<_>>>()?;
+            if res.is_empty() {
+                Ok(GroupRequestFilter::True)
+            } else if res.len() == 1 {
+                Ok(res.into_iter().next().unwrap())
+            } else {
+                Ok(GroupRequestFilter::And(res))
+            }
+        }
+        LdapFilter::Or(filters) => {
+            let res = filters
+                .iter()
+                .map(rec)
+                .filter(|c| !matches!(c, Ok(GroupRequestFilter::False)))
+                .flat_map(|f| match f {
+                    Ok(GroupRequestFilter::Or(v)) => v.into_iter().map(Ok).collect(),
+                    f => vec![f],
+                })
+                .collect::<LdapResult<Vec<_>>>()?;
+            if res.is_empty() {
+                Ok(GroupRequestFilter::False)
+            } else if res.len() == 1 {
+                Ok(res.into_iter().next().unwrap())
+            } else {
+                Ok(GroupRequestFilter::Or(res))
+            }
+        }
+        LdapFilter::Not(filter) => Ok(match rec(filter)? {
+            GroupRequestFilter::True => GroupRequestFilter::False,
+            GroupRequestFilter::False => GroupRequestFilter::True,
+            f => GroupRequestFilter::Not(Box::new(f)),
+        }),
        LdapFilter::Present(field) => {
            let field = AttributeName::from(field.as_str());
            Ok(match map_group_field(&field, schema) {
                GroupFieldType::Attribute(name, _, _) => {
                    GroupRequestFilter::CustomAttributePresent(name)
                }
-                GroupFieldType::NoMatch => GroupRequestFilter::from(false),
-                _ => GroupRequestFilter::from(true),
+                GroupFieldType::NoMatch => GroupRequestFilter::False,
+                _ => GroupRequestFilter::True,
            })
        }
        LdapFilter::Substring(field, substring_filter) => {
@@ -285,7 +338,7 @@ fn convert_group_filter(
                GroupFieldType::DisplayName => Ok(GroupRequestFilter::DisplayNameSubString(
                    substring_filter.clone().into(),
                )),
-                GroupFieldType::NoMatch => Ok(GroupRequestFilter::from(false)),
+                GroupFieldType::NoMatch => Ok(GroupRequestFilter::False),
                _ => Err(LdapError {
                    code: LdapResultCode::UnwillingToPerform,
                    message: format!(
@@ -344,3 +397,381 @@ pub fn convert_groups_to_ldap_op<'a>(
        ))
    })
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::{
+        handler::tests::{make_group_search_request, setup_bound_admin_handler},
+        search::{make_search_request, make_search_success},
+    };
+    use ldap3_proto::proto::LdapSubstringFilter;
+    use lldap_domain::{
+        types::{GroupId, UserId},
+        uuid,
+    };
+    use lldap_domain_handlers::handler::*;
+    use lldap_test_utils::MockTestBackendHandler;
+    use mockall::predicate::eq;
+    use pretty_assertions::assert_eq;
+
+    #[tokio::test]
+    async fn test_search_groups() {
+        let mut mock = MockTestBackendHandler::new();
+        mock.expect_list_groups()
+            .with(eq(Some(GroupRequestFilter::True)))
+            .times(1)
+            .return_once(|_| {
+                Ok(vec![
+                    Group {
+                        id: GroupId(1),
+                        display_name: "group_1".into(),
+                        creation_date: chrono::Utc.timestamp_opt(42, 42).unwrap().naive_utc(),
+                        users: vec![UserId::new("bob"), UserId::new("john")],
+                        uuid: uuid!("04ac75e0-2900-3e21-926c-2f732c26b3fc"),
+                        attributes: Vec::new(),
+                        modified_date: chrono::Utc.timestamp_opt(42, 42).unwrap().naive_utc(),
+                    },
+                    Group {
+                        id: GroupId(3),
+                        display_name: "BestGroup".into(),
+                        creation_date: chrono::Utc.timestamp_opt(42, 42).unwrap().naive_utc(),
+                        users: vec![UserId::new("john")],
+                        uuid: uuid!("04ac75e0-2900-3e21-926c-2f732c26b3fc"),
+                        attributes: Vec::new(),
+                        modified_date: chrono::Utc.timestamp_opt(42, 42).unwrap().naive_utc(),
+                    },
+                ])
+            });
+        let ldap_handler = setup_bound_admin_handler(mock).await;
+        let request = make_group_search_request(
+            LdapFilter::And(vec![]),
+            vec![
+                "objectClass",
+                "dn",
+                "cn",
+                "uniqueMember",
+                "entryUuid",
+                "entryDN",
+            ],
+        );
+        assert_eq!(
+            ldap_handler.do_search_or_dse(&request).await,
+            Ok(vec![
+                LdapOp::SearchResultEntry(LdapSearchResultEntry {
+                    dn: "cn=group_1,ou=groups,dc=example,dc=com".to_string(),
+                    attributes: vec![
+                        LdapPartialAttribute {
+                            atype: "cn".to_string(),
+                            vals: vec![b"group_1".to_vec()]
+                        },
+                        LdapPartialAttribute {
+                            atype: "entryDN".to_string(),
+                            vals: vec![b"uid=group_1,ou=groups,dc=example,dc=com".to_vec()],
+                        },
+                        LdapPartialAttribute {
+                            atype: "entryUuid".to_string(),
+                            vals: vec![b"04ac75e0-2900-3e21-926c-2f732c26b3fc".to_vec()],
+                        },
+                        LdapPartialAttribute {
+                            atype: "objectClass".to_string(),
+                            vals: vec![b"groupOfUniqueNames".to_vec(), b"groupOfNames".to_vec()]
+                        },
+                        LdapPartialAttribute {
+                            atype: "uniqueMember".to_string(),
+                            vals: vec![
+                                b"uid=bob,ou=people,dc=example,dc=com".to_vec(),
+                                b"uid=john,ou=people,dc=example,dc=com".to_vec(),
+                            ],
+                        },
+                    ],
+                }),
+                LdapOp::SearchResultEntry(LdapSearchResultEntry {
+                    dn: "cn=BestGroup,ou=groups,dc=example,dc=com".to_string(),
+                    attributes: vec![
+                        LdapPartialAttribute {
+                            atype: "cn".to_string(),
+                            vals: vec![b"BestGroup".to_vec()]
+                        },
+                        LdapPartialAttribute {
+                            atype: "entryDN".to_string(),
+                            vals: vec![b"uid=BestGroup,ou=groups,dc=example,dc=com".to_vec()],
+                        },
+                        LdapPartialAttribute {
+                            atype: "entryUuid".to_string(),
+                            vals: vec![b"04ac75e0-2900-3e21-926c-2f732c26b3fc".to_vec()],
+                        },
+                        LdapPartialAttribute {
+                            atype: "objectClass".to_string(),
+                            vals: vec![b"groupOfUniqueNames".to_vec(), b"groupOfNames".to_vec()]
+                        },
+                        LdapPartialAttribute {
+                            atype: "uniqueMember".to_string(),
+                            vals: vec![b"uid=john,ou=people,dc=example,dc=com".to_vec()],
+                        },
+                    ],
+                }),
+                make_search_success(),
+            ])
+        );
+    }
+
+    #[tokio::test]
+    async fn test_search_groups_by_groupid() {
+        let mut mock = MockTestBackendHandler::new();
+        mock.expect_list_groups()
+            .with(eq(Some(GroupRequestFilter::GroupId(GroupId(1)))))
+            .times(1)
+            .return_once(|_| {
+                Ok(vec![Group {
+                    display_name: "group_1".into(),
+                    id: GroupId(1),
+                    creation_date: chrono::Utc.timestamp_opt(42, 42).unwrap().naive_utc(),
+                    users: vec![],
+                    uuid: uuid!("04ac75e0-2900-3e21-926c-2f732c26b3fc"),
+                    attributes: Vec::new(),
+                    modified_date: chrono::Utc.timestamp_opt(42, 42).unwrap().naive_utc(),
+                }])
+            });
+        let ldap_handler = setup_bound_admin_handler(mock).await;
+        let request = make_group_search_request(
+            LdapFilter::Equality("groupid".to_string(), "1".to_string()),
+            vec!["dn"],
+        );
+        assert_eq!(
+            ldap_handler.do_search_or_dse(&request).await,
+            Ok(vec![
+                LdapOp::SearchResultEntry(LdapSearchResultEntry {
+                    dn: "cn=group_1,ou=groups,dc=example,dc=com".to_string(),
+                    attributes: vec![],
+                }),
+                make_search_success(),
+            ])
+        );
+    }
+
+    #[tokio::test]
+    async fn test_search_groups_filter() {
+        let mut mock = MockTestBackendHandler::new();
+        mock.expect_list_groups()
+            .with(eq(Some(GroupRequestFilter::And(vec![
+                GroupRequestFilter::DisplayName("group_1".into()),
+                GroupRequestFilter::Member(UserId::new("bob")),
+                GroupRequestFilter::DisplayName("rockstars".into()),
+                false.into(),
+                GroupRequestFilter::Uuid(uuid!("04ac75e0-2900-3e21-926c-2f732c26b3fc")),
+                false.into(),
+                GroupRequestFilter::DisplayNameSubString(SubStringFilter {
+                    initial: Some("iNIt".to_owned()),
+                    any: vec!["1".to_owned(), "2aA".to_owned()],
+                    final_: Some("finAl".to_owned()),
+                }),
+            ]))))
+            .times(1)
+            .return_once(|_| {
+                Ok(vec![Group {
+                    display_name: "group_1".into(),
+                    id: GroupId(1),
+                    creation_date: chrono::Utc.timestamp_opt(42, 42).unwrap().naive_utc(),
+                    users: vec![],
+                    uuid: uuid!("04ac75e0-2900-3e21-926c-2f732c26b3fc"),
+                    attributes: Vec::new(),
+                    modified_date: chrono::Utc.timestamp_opt(42, 42).unwrap().naive_utc(),
+                }])
+            });
+        let ldap_handler = setup_bound_admin_handler(mock).await;
+        let request = make_group_search_request(
+            LdapFilter::And(vec![
+                LdapFilter::Equality("cN".to_string(), "Group_1".to_string()),
+                LdapFilter::Equality(
+                    "uniqueMember".to_string(),
+                    "uid=bob,ou=peopLe,Dc=eXample,dc=com".to_string(),
+                ),
+                LdapFilter::Equality(
+                    "dn".to_string(),
+                    "uid=rockstars,ou=groups,dc=example,dc=com".to_string(),
+                ),
+                LdapFilter::Equality(
+                    "dn".to_string(),
+                    "uid=rockstars,ou=people,dc=example,dc=com".to_string(),
+                ),
+                LdapFilter::Equality(
+                    "uuid".to_string(),
+                    "04ac75e0-2900-3e21-926c-2f732c26b3fc".to_string(),
+                ),
+                LdapFilter::Equality("obJEctclass".to_string(), "groupofUniqueNames".to_string()),
+                LdapFilter::Equality("objectclass".to_string(), "groupOfNames".to_string()),
+                LdapFilter::Present("objectclass".to_string()),
+                LdapFilter::Present("dn".to_string()),
+                LdapFilter::Not(Box::new(LdapFilter::Present(
+                    "random_attribUte".to_string(),
+                ))),
+                LdapFilter::Equality("unknown_attribute".to_string(), "randomValue".to_string()),
+                LdapFilter::Substring(
+                    "cn".to_owned(),
+                    LdapSubstringFilter {
+                        initial: Some("iNIt".to_owned()),
+                        any: vec!["1".to_owned(), "2aA".to_owned()],
+                        final_: Some("finAl".to_owned()),
+                    },
+                ),
+            ]),
+            vec!["1.1"],
+        );
+        assert_eq!(
+            ldap_handler.do_search_or_dse(&request).await,
+            Ok(vec![
+                LdapOp::SearchResultEntry(LdapSearchResultEntry {
+                    dn: "cn=group_1,ou=groups,dc=example,dc=com".to_string(),
+                    attributes: vec![],
+                }),
+                make_search_success(),
+            ])
+        );
+    }
+
+    #[tokio::test]
+    async fn test_search_groups_filter_2() {
+        let mut mock = MockTestBackendHandler::new();
+        mock.expect_list_groups()
+            .with(eq(Some(GroupRequestFilter::Or(vec![
+                GroupRequestFilter::DisplayName("group_1".into()),
+                GroupRequestFilter::Member(UserId::new("bob")),
+            ]))))
+            .times(1)
+            .return_once(|_| Ok(vec![]));
+        let ldap_handler = setup_bound_admin_handler(mock).await;
+        let request = make_group_search_request(
+            LdapFilter::Or(vec![
+                LdapFilter::Equality("cn".to_string(), "group_1".to_string()),
+                LdapFilter::Equality(
+                    "member".to_string(),
+                    "uid=bob,ou=people,dc=example,dc=com".to_string(),
+                ),
+            ]),
+            vec!["cn"],
+        );
+        assert_eq!(
+            ldap_handler.do_search_or_dse(&request).await,
+            Ok(vec![make_search_success()])
+        );
+    }
+
+    #[tokio::test]
+    async fn test_search_groups_filter_3() {
+        let mut mock = MockTestBackendHandler::new();
+        mock.expect_list_groups()
+            .with(eq(Some(GroupRequestFilter::Not(Box::new(
+                GroupRequestFilter::DisplayName("group_1".into()),
+            )))))
+            .times(1)
+            .return_once(|_| Ok(vec![]));
+        let ldap_handler = setup_bound_admin_handler(mock).await;
+        let request = make_group_search_request(
+            LdapFilter::Not(Box::new(LdapFilter::Equality(
+                "cn".to_string(),
+                "group_1".to_string(),
+            ))),
+            vec!["cn"],
+        );
+        assert_eq!(
+            ldap_handler.do_search_or_dse(&request).await,
+            Ok(vec![make_search_success()])
+        );
+    }
+
+    #[tokio::test]
+    async fn test_equality_filter_on_list_group_attribute_returns_error() {
+        use lldap_domain::schema::{AttributeList, AttributeSchema, Schema};
+        let mut mock = MockTestBackendHandler::new();
+        mock.expect_get_schema().returning(|| {
+            Ok(Schema {
+                user_attributes: AttributeList {
+                    attributes: Vec::new(),
+                },
+                group_attributes: AttributeList {
+                    attributes: vec![AttributeSchema {
+                        name: "tags".into(),
+                        attribute_type: AttributeType::String,
+                        is_list: true,
+                        is_visible: true,
+                        is_editable: true,
+                        is_hardcoded: false,
+                        is_readonly: false,
+                    }],
+                },
+                extra_user_object_classes: Vec::new(),
+                extra_group_object_classes: Vec::new(),
+            })
+        });
+        let ldap_handler = setup_bound_admin_handler(mock).await;
+        let request = make_group_search_request(
+            LdapFilter::Equality("tags".to_string(), "foo".to_string()),
+            vec!["dn"],
+        );
+        assert_eq!(
+            ldap_handler.do_search_or_dse(&request).await,
+            Err(LdapError {
+                code: LdapResultCode::UnwillingToPerform,
+                message: r#"Equality filter on list attribute "tags" is not supported"#.to_string(),
+            })
+        );
+    }
+
+    #[tokio::test]
+    async fn test_equality_filter_on_non_list_group_attribute() {
+        use lldap_domain::schema::{AttributeList, AttributeSchema, Schema};
+        let mut mock = MockTestBackendHandler::new();
+        mock.expect_get_schema().returning(|| {
+            Ok(Schema {
+                user_attributes: AttributeList {
+                    attributes: Vec::new(),
+                },
+                group_attributes: AttributeList {
+                    attributes: vec![AttributeSchema {
+                        name: "club_name".into(),
+                        attribute_type: AttributeType::String,
+                        is_list: false,
+                        is_visible: true,
+                        is_editable: true,
+                        is_hardcoded: false,
+                        is_readonly: false,
+                    }],
+                },
+                extra_user_object_classes: Vec::new(),
+                extra_group_object_classes: Vec::new(),
+            })
+        });
+        mock.expect_list_groups()
+            .times(1)
+            .return_once(|_| Ok(vec![]));
+        let ldap_handler = setup_bound_admin_handler(mock).await;
+        let request = make_group_search_request(
+            LdapFilter::Equality("club_name".to_string(), "myclub".to_string()),
+            vec!["dn"],
+        );
+        assert_eq!(
+            ldap_handler.do_search_or_dse(&request).await,
+            Ok(vec![make_search_success()])
+        );
+    }
+
+    #[tokio::test]
+    async fn test_search_group_as_scope() {
+        let mut mock = MockTestBackendHandler::new();
+        mock.expect_list_groups()
+            .with(eq(Some(GroupRequestFilter::DisplayName("group_1".into()))))
+            .times(1)
+            .return_once(|_| Ok(vec![]));
+        let ldap_handler = setup_bound_admin_handler(mock).await;
+        let request = make_search_request(
+            "cn=group_1,ou=groups,dc=example,dc=com",
+            LdapFilter::And(vec![]),
+            vec!["objectClass"],
+        );
+        assert_eq!(
+            ldap_handler.do_search_or_dse(&request).await,
+            Ok(vec![make_search_success()]),
+        );
+    }
+}
--- a/crates/ldap/src/core/user.rs
+++ b/crates/ldap/src/core/user.rs
@@ -3,10 +3,10 @@ use crate::core::{
    utils::{
        ExpandedAttributes, LdapInfo, UserFieldType, expand_attribute_wildcards,
        get_custom_attribute, get_group_id_from_distinguished_name_or_plain_name,
-        get_user_id_from_distinguished_name_or_plain_name, map_user_field,
+        get_user_id_from_distinguished_name_or_plain_name, map_user_field, to_generalized_time,
    },
 };
-use chrono::TimeZone;
+
 use ldap3_proto::{
    LdapFilter, LdapPartialAttribute, LdapResultCode, LdapSearchResultEntry, proto::LdapOp,
 };
@@ -87,12 +87,15 @@ pub fn get_user_attribute(
        UserFieldType::PrimaryField(UserColumn::DisplayName) => {
            vec![user.display_name.clone()?.into_bytes()]
        }
-        UserFieldType::PrimaryField(UserColumn::CreationDate) => vec![
-            chrono::Utc
-                .from_utc_datetime(&user.creation_date)
-                .to_rfc3339()
-                .into_bytes(),
-        ],
+        UserFieldType::PrimaryField(UserColumn::CreationDate) => {
+            vec![to_generalized_time(&user.creation_date)]
+        }
+        UserFieldType::PrimaryField(UserColumn::ModifiedDate) => {
+            vec![to_generalized_time(&user.modified_date)]
+        }
+        UserFieldType::PrimaryField(UserColumn::PasswordModifiedDate) => {
+            vec![to_generalized_time(&user.password_modified_date)]
+        }
        UserFieldType::Attribute(attr, _, _) => get_custom_attribute(&user.attributes, &attr)?,
        UserFieldType::NoMatch => match attribute.as_str() {
            "1.1" => return None,
@@ -179,22 +182,31 @@ fn get_user_attribute_equality_filter(
    typ: AttributeType,
    is_list: bool,
    value: &str,
-) -> UserRequestFilter {
+) -> LdapResult<UserRequestFilter> {
+    if is_list {
+        return Err(LdapError {
+            code: LdapResultCode::UnwillingToPerform,
+            message: format!(
+                "Equality filter on list attribute \"{}\" is not supported",
+                field
+            ),
+        });
+    }
    let value_lc = value.to_ascii_lowercase();
-    let serialized_value = deserialize_attribute_value(&[value.to_owned()], typ, is_list);
-    let serialized_value_lc = deserialize_attribute_value(&[value_lc.to_owned()], typ, is_list);
+    let serialized_value = deserialize_attribute_value(&[value.to_owned()], typ, false);
+    let serialized_value_lc = deserialize_attribute_value(&[value_lc.to_owned()], typ, false);
    match (serialized_value, serialized_value_lc) {
-        (Ok(v), Ok(v_lc)) => UserRequestFilter::Or(vec![
+        (Ok(v), Ok(v_lc)) => Ok(UserRequestFilter::Or(vec![
            UserRequestFilter::AttributeEquality(field.clone(), v),
            UserRequestFilter::AttributeEquality(field.clone(), v_lc),
-        ]),
+        ])),
        (Ok(_), Err(e)) => {
            warn!("Invalid value for attribute {} (lowercased): {}", field, e);
-            UserRequestFilter::from(false)
+            Ok(UserRequestFilter::False)
        }
        (Err(e), _) => {
            warn!("Invalid value for attribute {}: {}", field, e);
-            UserRequestFilter::from(false)
+            Ok(UserRequestFilter::False)
        }
    }
 }
@@ -206,13 +218,47 @@ fn convert_user_filter(
 ) -> LdapResult<UserRequestFilter> {
    let rec = |f| convert_user_filter(ldap_info, f, schema);
    match filter {
-        LdapFilter::And(filters) => Ok(UserRequestFilter::And(
-            filters.iter().map(rec).collect::<LdapResult<_>>()?,
-        )),
-        LdapFilter::Or(filters) => Ok(UserRequestFilter::Or(
-            filters.iter().map(rec).collect::<LdapResult<_>>()?,
-        )),
-        LdapFilter::Not(filter) => Ok(UserRequestFilter::Not(Box::new(rec(filter)?))),
+        LdapFilter::And(filters) => {
+            let res = filters
+                .iter()
+                .map(rec)
+                .filter(|c| !matches!(c, Ok(UserRequestFilter::True)))
+                .flat_map(|f| match f {
+                    Ok(UserRequestFilter::And(v)) => v.into_iter().map(Ok).collect(),
+                    f => vec![f],
+                })
+                .collect::<LdapResult<Vec<_>>>()?;
+            if res.is_empty() {
+                Ok(UserRequestFilter::True)
+            } else if res.len() == 1 {
+                Ok(res.into_iter().next().unwrap())
+            } else {
+                Ok(UserRequestFilter::And(res))
+            }
+        }
+        LdapFilter::Or(filters) => {
+            let res = filters
+                .iter()
+                .map(rec)
+                .filter(|c| !matches!(c, Ok(UserRequestFilter::False)))
+                .flat_map(|f| match f {
+                    Ok(UserRequestFilter::Or(v)) => v.into_iter().map(Ok).collect(),
+                    f => vec![f],
+                })
+                .collect::<LdapResult<Vec<_>>>()?;
+            if res.is_empty() {
+                Ok(UserRequestFilter::False)
+            } else if res.len() == 1 {
+                Ok(res.into_iter().next().unwrap())
+            } else {
+                Ok(UserRequestFilter::Or(res))
+            }
+        }
+        LdapFilter::Not(filter) => Ok(match rec(filter)? {
+            UserRequestFilter::True => UserRequestFilter::False,
+            UserRequestFilter::False => UserRequestFilter::True,
+            f => UserRequestFilter::Not(Box::new(f)),
+        }),
        LdapFilter::Equality(field, value) => {
            let field = AttributeName::from(field.as_str());
            let value_lc = value.to_ascii_lowercase();
@@ -224,12 +270,27 @@ fn convert_user_filter(
                    UserColumn::LowercaseEmail,
                    value_lc,
                )),
+                UserFieldType::PrimaryField(UserColumn::DisplayName) => {
+                    // DisplayName (cn) should match case-insensitively, so we try both
+                    // the original value and the lowercase value (if different)
+                    if value.as_str() == value_lc {
+                        Ok(UserRequestFilter::Equality(
+                            UserColumn::DisplayName,
+                            value_lc,
+                        ))
+                    } else {
+                        Ok(UserRequestFilter::Or(vec![
+                            UserRequestFilter::Equality(UserColumn::DisplayName, value.to_string()),
+                            UserRequestFilter::Equality(UserColumn::DisplayName, value_lc),
+                        ]))
+                    }
+                }
                UserFieldType::PrimaryField(field) => {
                    Ok(UserRequestFilter::Equality(field, value_lc))
                }
-                UserFieldType::Attribute(field, typ, is_list) => Ok(
-                    get_user_attribute_equality_filter(&field, typ, is_list, value),
-                ),
+                UserFieldType::Attribute(field, typ, is_list) => {
+                    get_user_attribute_equality_filter(&field, typ, is_list, value)
+                }
                UserFieldType::NoMatch => {
                    if !ldap_info.ignored_user_attributes.contains(&field) {
                        warn!(
@@ -238,7 +299,7 @@ fn convert_user_filter(
                            field
                        );
                    }
-                    Ok(UserRequestFilter::from(false))
+                    Ok(UserRequestFilter::False)
                }
                UserFieldType::ObjectClass => Ok(UserRequestFilter::from(
                    get_default_user_object_classes()
@@ -257,7 +318,7 @@ fn convert_user_filter(
                .map(UserRequestFilter::MemberOf)
                .unwrap_or_else(|e| {
                    warn!("Invalid memberOf filter: {}", e);
-                    UserRequestFilter::from(false)
+                    UserRequestFilter::False
                })),
                UserFieldType::EntryDn | UserFieldType::Dn => {
                    Ok(get_user_id_from_distinguished_name_or_plain_name(
@@ -268,7 +329,7 @@ fn convert_user_filter(
                    .map(UserRequestFilter::UserId)
                    .unwrap_or_else(|_| {
                        warn!("Invalid dn filter on user: {}", value_lc);
-                        UserRequestFilter::from(false)
+                        UserRequestFilter::False
                    }))
                }
            }
@@ -279,8 +340,8 @@ fn convert_user_filter(
                UserFieldType::Attribute(name, _, _) => {
                    UserRequestFilter::CustomAttributePresent(name)
                }
-                UserFieldType::NoMatch => UserRequestFilter::from(false),
-                _ => UserRequestFilter::from(true),
+                UserFieldType::NoMatch => UserRequestFilter::False,
+                _ => UserRequestFilter::True,
            })
        }
        LdapFilter::Substring(field, substring_filter) => {
@@ -299,7 +360,7 @@ fn convert_user_filter(
                    code: LdapResultCode::UnwillingToPerform,
                    message: format!("Unsupported user attribute for substring filter: {field:?}"),
                }),
-                UserFieldType::NoMatch => Ok(UserRequestFilter::from(false)),
+                UserFieldType::NoMatch => Ok(UserRequestFilter::False),
                UserFieldType::PrimaryField(UserColumn::Email) => Ok(UserRequestFilter::SubString(
                    UserColumn::LowercaseEmail,
                    substring_filter.clone().into(),
@@ -363,3 +424,494 @@ pub fn convert_users_to_ldap_op<'a>(
        ))
    })
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::{
+        handler::tests::{
+            make_user_search_request, setup_bound_admin_handler, setup_bound_handler_with_group,
+            setup_bound_readonly_handler,
+        },
+        search::{make_search_request, make_search_success},
+    };
+    use chrono::{DateTime, Duration, NaiveDateTime, TimeZone, Utc};
+    use lldap_domain::types::{Attribute, GroupDetails, JpegPhoto};
+    use lldap_test_utils::MockTestBackendHandler;
+    use mockall::predicate::eq;
+    use pretty_assertions::assert_eq;
+
+    fn assert_timestamp_within_margin(
+        timestamp_bytes: &[u8],
+        base_timestamp_dt: DateTime<Utc>,
+        time_margin: Duration,
+    ) {
+        let timestamp_str =
+            std::str::from_utf8(timestamp_bytes).expect("Invalid conversion from UTF-8 to string");
+        let timestamp_naive = NaiveDateTime::parse_from_str(timestamp_str, "%Y%m%d%H%M%SZ")
+            .expect("Invalid timestamp format");
+        let timestamp_dt: DateTime<Utc> = Utc.from_utc_datetime(&timestamp_naive);
+
+        let within_range = (base_timestamp_dt - timestamp_dt).abs() <= time_margin;
+
+        assert!(
+            within_range,
+            "Timestamp not within range: expected within [{} - {}], got [{}]",
+            base_timestamp_dt - time_margin,
+            base_timestamp_dt + time_margin,
+            timestamp_dt
+        );
+    }
+
+    #[tokio::test]
+    async fn test_search_regular_user() {
+        let mut mock = MockTestBackendHandler::new();
+        mock.expect_list_users()
+            .with(
+                eq(Some(UserRequestFilter::And(vec![
+                    UserRequestFilter::True,
+                    UserRequestFilter::UserId(UserId::new("test")),
+                ]))),
+                eq(false),
+            )
+            .times(1)
+            .return_once(|_, _| {
+                Ok(vec![UserAndGroups {
+                    user: User {
+                        user_id: UserId::new("test"),
+                        ..Default::default()
+                    },
+                    groups: None,
+                }])
+            });
+        let ldap_handler = setup_bound_handler_with_group(mock, "regular").await;
+
+        let request =
+            make_user_search_request::<String>(LdapFilter::And(vec![]), vec!["1.1".to_string()]);
+        assert_eq!(
+            ldap_handler.do_search_or_dse(&request).await,
+            Ok(vec![
+                LdapOp::SearchResultEntry(LdapSearchResultEntry {
+                    dn: "uid=test,ou=people,dc=example,dc=com".to_string(),
+                    attributes: vec![],
+                }),
+                make_search_success()
+            ]),
+        );
+    }
+
+    #[tokio::test]
+    async fn test_search_readonly_user() {
+        let mut mock = MockTestBackendHandler::new();
+        mock.expect_list_users()
+            .with(eq(Some(UserRequestFilter::True)), eq(false))
+            .times(1)
+            .return_once(|_, _| Ok(vec![]));
+        let ldap_handler = setup_bound_readonly_handler(mock).await;
+        let request = make_user_search_request(LdapFilter::And(vec![]), vec!["1.1"]);
+        assert_eq!(
+            ldap_handler.do_search_or_dse(&request).await,
+            Ok(vec![make_search_success()]),
+        );
+    }
+
+    #[tokio::test]
+    async fn test_search_member_of() {
+        let mut mock = MockTestBackendHandler::new();
+        mock.expect_list_users()
+            .with(eq(Some(UserRequestFilter::True)), eq(true))
+            .times(1)
+            .return_once(|_, _| {
+                Ok(vec![UserAndGroups {
+                    user: User {
+                        user_id: UserId::new("bob"),
+                        ..Default::default()
+                    },
+                    groups: Some(vec![GroupDetails {
+                        group_id: lldap_domain::types::GroupId(42),
+                        display_name: "rockstars".into(),
+                        creation_date: chrono::Utc.timestamp_opt(42, 42).unwrap().naive_utc(),
+                        uuid: lldap_domain::uuid!("a1a2a3a4b1b2c1c2d1d2d3d4d5d6d7d8"),
+                        attributes: Vec::new(),
+                        modified_date: chrono::Utc.timestamp_opt(42, 42).unwrap().naive_utc(),
+                    }]),
+                }])
+            });
+        let ldap_handler = setup_bound_readonly_handler(mock).await;
+        let request = make_user_search_request::<String>(
+            LdapFilter::And(vec![]),
+            vec!["memberOf".to_string()],
+        );
+        assert_eq!(
+            ldap_handler.do_search_or_dse(&request).await,
+            Ok(vec![
+                LdapOp::SearchResultEntry(LdapSearchResultEntry {
+                    dn: "uid=bob,ou=people,dc=example,dc=com".to_string(),
+                    attributes: vec![LdapPartialAttribute {
+                        atype: "memberOf".to_string(),
+                        vals: vec![b"cn=rockstars,ou=groups,dc=example,dc=com".to_vec()]
+                    }],
+                }),
+                make_search_success(),
+            ]),
+        );
+    }
+
+    #[tokio::test]
+    async fn test_search_user_as_scope() {
+        let mut mock = MockTestBackendHandler::new();
+        mock.expect_list_users()
+            .with(
+                eq(Some(UserRequestFilter::UserId(UserId::new("bob")))),
+                eq(false),
+            )
+            .times(1)
+            .return_once(|_, _| Ok(vec![]));
+        let ldap_handler = setup_bound_admin_handler(mock).await;
+        let request = make_search_request(
+            "uid=bob,ou=people,dc=example,dc=com",
+            LdapFilter::And(vec![]),
+            vec!["objectClass"],
+        );
+        assert_eq!(
+            ldap_handler.do_search_or_dse(&request).await,
+            Ok(vec![make_search_success()]),
+        );
+    }
+
+    #[tokio::test]
+    async fn test_search_users() {
+        use chrono::prelude::*;
+        use lldap_domain::uuid;
+        let mut mock = MockTestBackendHandler::new();
+        mock.expect_list_users().times(1).return_once(|_, _| {
+            Ok(vec![
+                UserAndGroups {
+                    user: User {
+                        user_id: UserId::new("bob_1"),
+                        email: "bob@bobmail.bob".into(),
+                        display_name: Some("Bôb Böbberson".to_string()),
+                        uuid: uuid!("698e1d5f-7a40-3151-8745-b9b8a37839da"),
+                        attributes: vec![
+                            Attribute {
+                                name: "first_name".into(),
+                                value: "Bôb".to_string().into(),
+                            },
+                            Attribute {
+                                name: "last_name".into(),
+                                value: "Böbberson".to_string().into(),
+                            },
+                        ],
+                        ..Default::default()
+                    },
+                    groups: None,
+                },
+                UserAndGroups {
+                    user: User {
+                        user_id: UserId::new("jim"),
+                        email: "jim@cricket.jim".into(),
+                        display_name: Some("Jimminy Cricket".to_string()),
+                        attributes: vec![
+                            Attribute {
+                                name: "avatar".into(),
+                                value: JpegPhoto::for_tests().into(),
+                            },
+                            Attribute {
+                                name: "first_name".into(),
+                                value: "Jim".to_string().into(),
+                            },
+                            Attribute {
+                                name: "last_name".into(),
+                                value: "Cricket".to_string().into(),
+                            },
+                        ],
+                        uuid: uuid!("04ac75e0-2900-3e21-926c-2f732c26b3fc"),
+                        creation_date: Utc
+                            .with_ymd_and_hms(2014, 7, 8, 9, 10, 11)
+                            .unwrap()
+                            .naive_utc(),
+                        modified_date: Utc
+                            .with_ymd_and_hms(2014, 7, 8, 9, 10, 11)
+                            .unwrap()
+                            .naive_utc(),
+                        password_modified_date: Utc
+                            .with_ymd_and_hms(2014, 7, 8, 9, 10, 11)
+                            .unwrap()
+                            .naive_utc(),
+                    },
+                    groups: None,
+                },
+            ])
+        });
+        let ldap_handler = setup_bound_admin_handler(mock).await;
+        let request = make_user_search_request(
+            LdapFilter::And(vec![]),
+            vec![
+                "objectClass",
+                "dn",
+                "uid",
+                "mail",
+                "givenName",
+                "sn",
+                "cn",
+                "createTimestamp",
+                "entryUuid",
+                "jpegPhoto",
+            ],
+        );
+        assert_eq!(
+            ldap_handler.do_search_or_dse(&request).await,
+            Ok(vec![
+                LdapOp::SearchResultEntry(LdapSearchResultEntry {
+                    dn: "uid=bob_1,ou=people,dc=example,dc=com".to_string(),
+                    attributes: vec![
+                        LdapPartialAttribute {
+                            atype: "cn".to_string(),
+                            vals: vec!["Bôb Böbberson".to_string().into_bytes()]
+                        },
+                        LdapPartialAttribute {
+                            atype: "createTimestamp".to_string(),
+                            vals: vec![b"19700101000000Z".to_vec()]
+                        },
+                        LdapPartialAttribute {
+                            atype: "entryUuid".to_string(),
+                            vals: vec![b"698e1d5f-7a40-3151-8745-b9b8a37839da".to_vec()]
+                        },
+                        LdapPartialAttribute {
+                            atype: "givenName".to_string(),
+                            vals: vec!["Bôb".to_string().into_bytes()]
+                        },
+                        LdapPartialAttribute {
+                            atype: "mail".to_string(),
+                            vals: vec![b"bob@bobmail.bob".to_vec()]
+                        },
+                        LdapPartialAttribute {
+                            atype: "objectClass".to_string(),
+                            vals: vec![
+                                b"inetOrgPerson".to_vec(),
+                                b"posixAccount".to_vec(),
+                                b"mailAccount".to_vec(),
+                                b"person".to_vec(),
+                                b"customUserClass".to_vec(),
+                            ]
+                        },
+                        LdapPartialAttribute {
+                            atype: "sn".to_string(),
+                            vals: vec!["Böbberson".to_string().into_bytes()]
+                        },
+                        LdapPartialAttribute {
+                            atype: "uid".to_string(),
+                            vals: vec![b"bob_1".to_vec()]
+                        },
+                    ],
+                }),
+                LdapOp::SearchResultEntry(LdapSearchResultEntry {
+                    dn: "uid=jim,ou=people,dc=example,dc=com".to_string(),
+                    attributes: vec![
+                        LdapPartialAttribute {
+                            atype: "cn".to_string(),
+                            vals: vec![b"Jimminy Cricket".to_vec()]
+                        },
+                        LdapPartialAttribute {
+                            atype: "createTimestamp".to_string(),
+                            vals: vec![b"20140708091011Z".to_vec()]
+                        },
+                        LdapPartialAttribute {
+                            atype: "entryUuid".to_string(),
+                            vals: vec![b"04ac75e0-2900-3e21-926c-2f732c26b3fc".to_vec()]
+                        },
+                        LdapPartialAttribute {
+                            atype: "givenName".to_string(),
+                            vals: vec![b"Jim".to_vec()]
+                        },
+                        LdapPartialAttribute {
+                            atype: "jpegPhoto".to_string(),
+                            vals: vec![JpegPhoto::for_tests().into_bytes()]
+                        },
+                        LdapPartialAttribute {
+                            atype: "mail".to_string(),
+                            vals: vec![b"jim@cricket.jim".to_vec()]
+                        },
+                        LdapPartialAttribute {
+                            atype: "objectClass".to_string(),
+                            vals: vec![
+                                b"inetOrgPerson".to_vec(),
+                                b"posixAccount".to_vec(),
+                                b"mailAccount".to_vec(),
+                                b"person".to_vec(),
+                                b"customUserClass".to_vec(),
+                            ]
+                        },
+                        LdapPartialAttribute {
+                            atype: "sn".to_string(),
+                            vals: vec![b"Cricket".to_vec()]
+                        },
+                        LdapPartialAttribute {
+                            atype: "uid".to_string(),
+                            vals: vec![b"jim".to_vec()]
+                        },
+                    ],
+                }),
+                make_search_success(),
+            ])
+        );
+    }
+
+    #[tokio::test]
+    async fn test_pwd_changed_time_format() {
+        use lldap_domain::uuid;
+        let mut mock = MockTestBackendHandler::new();
+        mock.expect_list_users().times(1).return_once(|_, _| {
+            Ok(vec![UserAndGroups {
+                user: User {
+                    user_id: UserId::new("bob_1"),
+                    email: "bob@bobmail.bob".into(),
+                    uuid: uuid!("698e1d5f-7a40-3151-8745-b9b8a37839da"),
+                    attributes: vec![],
+                    password_modified_date: Utc
+                        .with_ymd_and_hms(2014, 7, 8, 9, 10, 11)
+                        .unwrap()
+                        .naive_utc(),
+                    ..Default::default()
+                },
+                groups: None,
+            }])
+        });
+        let ldap_handler = setup_bound_admin_handler(mock).await;
+        let request = make_user_search_request(LdapFilter::And(vec![]), vec!["pwdChangedTime"]);
+        if let LdapOp::SearchResultEntry(entry) =
+            &ldap_handler.do_search_or_dse(&request).await.unwrap()[0]
+        {
+            assert_eq!(entry.attributes.len(), 1);
+            assert_eq!(entry.attributes[0].atype, "pwdChangedTime");
+            assert_eq!(entry.attributes[0].vals.len(), 1);
+            assert_timestamp_within_margin(
+                &entry.attributes[0].vals[0],
+                Utc.with_ymd_and_hms(2014, 7, 8, 9, 10, 11).unwrap(),
+                Duration::seconds(1),
+            );
+        } else {
+            panic!("Expected SearchResultEntry");
+        }
+    }
+
+    #[tokio::test]
+    async fn test_equality_filter_on_list_user_attribute_returns_error() {
+        use lldap_domain::schema::{AttributeList, AttributeSchema, Schema};
+        let mut mock = MockTestBackendHandler::new();
+        mock.expect_get_schema().returning(|| {
+            Ok(Schema {
+                user_attributes: AttributeList {
+                    attributes: vec![AttributeSchema {
+                        name: "mailalias".into(),
+                        attribute_type: AttributeType::String,
+                        is_list: true,
+                        is_visible: true,
+                        is_editable: true,
+                        is_hardcoded: false,
+                        is_readonly: false,
+                    }],
+                },
+                group_attributes: AttributeList {
+                    attributes: Vec::new(),
+                },
+                extra_user_object_classes: Vec::new(),
+                extra_group_object_classes: Vec::new(),
+            })
+        });
+        let ldap_handler = setup_bound_admin_handler(mock).await;
+        let request = make_user_search_request(
+            LdapFilter::Equality("mailalias".to_string(), "alias@example.com".to_string()),
+            vec!["dn"],
+        );
+        assert_eq!(
+            ldap_handler.do_search_or_dse(&request).await,
+            Err(LdapError {
+                code: LdapResultCode::UnwillingToPerform,
+                message: r#"Equality filter on list attribute "mailalias" is not supported"#
+                    .to_string(),
+            })
+        );
+    }
+
+    #[tokio::test]
+    async fn test_equality_filter_on_non_list_user_attribute() {
+        use lldap_domain::schema::{AttributeList, AttributeSchema, Schema};
+        let mut mock = MockTestBackendHandler::new();
+        mock.expect_get_schema().returning(|| {
+            Ok(Schema {
+                user_attributes: AttributeList {
+                    attributes: vec![AttributeSchema {
+                        name: "nickname".into(),
+                        attribute_type: AttributeType::String,
+                        is_list: false,
+                        is_visible: true,
+                        is_editable: true,
+                        is_hardcoded: false,
+                        is_readonly: false,
+                    }],
+                },
+                group_attributes: AttributeList {
+                    attributes: Vec::new(),
+                },
+                extra_user_object_classes: Vec::new(),
+                extra_group_object_classes: Vec::new(),
+            })
+        });
+        mock.expect_list_users()
+            .times(1)
+            .return_once(|_, _| Ok(vec![]));
+        let ldap_handler = setup_bound_admin_handler(mock).await;
+        let request = make_user_search_request(
+            LdapFilter::Equality("nickname".to_string(), "alice".to_string()),
+            vec!["dn"],
+        );
+        assert_eq!(
+            ldap_handler.do_search_or_dse(&request).await,
+            Ok(vec![make_search_success()])
+        );
+    }
+
+    #[tokio::test]
+    async fn test_search_cn_case_insensitive() {
+        use lldap_domain::uuid;
+        let mut mock = MockTestBackendHandler::new();
+        mock.expect_list_users()
+            .with(
+                eq(Some(UserRequestFilter::Or(vec![
+                    UserRequestFilter::Equality(UserColumn::DisplayName, "TestAll".to_string()),
+                    UserRequestFilter::Equality(UserColumn::DisplayName, "testall".to_string()),
+                ]))),
+                eq(false),
+            )
+            .times(1)
+            .return_once(|_, _| {
+                Ok(vec![UserAndGroups {
+                    user: User {
+                        user_id: UserId::new("testall"),
+                        email: "test@example.com".into(),
+                        display_name: Some("TestAll".to_string()),
+                        uuid: uuid!("698e1d5f-7a40-3151-8745-b9b8a37839da"),
+                        attributes: vec![],
+                        ..Default::default()
+                    },
+                    groups: None,
+                }])
+            });
+        let ldap_handler = setup_bound_admin_handler(mock).await;
+        let request = make_user_search_request(
+            LdapFilter::Equality("cn".to_string(), "TestAll".to_string()),
+            vec!["cn", "uid"],
+        );
+        let results = ldap_handler.do_search_or_dse(&request).await.unwrap();
+        assert_eq!(results.len(), 2);
+        if let LdapOp::SearchResultEntry(entry) = &results[0] {
+            assert_eq!(entry.dn, "uid=testall,ou=people,dc=example,dc=com");
+            assert_eq!(entry.attributes.len(), 2);
+            assert_eq!(entry.attributes[0].atype, "cn");
+            assert_eq!(entry.attributes[0].vals[0], b"TestAll");
+        } else {
+            panic!("Expected SearchResultEntry");
+        }
+    }
+}
--- a/crates/ldap/src/core/utils.rs
+++ b/crates/ldap/src/core/utils.rs
@@ -3,7 +3,7 @@ use crate::core::{
    group::{REQUIRED_GROUP_ATTRIBUTES, get_default_group_object_classes},
    user::{REQUIRED_USER_ATTRIBUTES, get_default_user_object_classes},
 };
-use chrono::TimeZone;
+use chrono::{NaiveDateTime, TimeZone};
 use itertools::join;
 use ldap3_proto::LdapResultCode;
 use lldap_domain::{
@@ -18,6 +18,16 @@ use lldap_domain_model::model::UserColumn;
 use std::collections::BTreeMap;
 use tracing::{debug, instrument, warn};

+/// Convert a NaiveDateTime to LDAP GeneralizedTime format (YYYYMMDDHHMMSSZ)
+/// This is the standard format required by LDAP for timestamp attributes like pwdChangedTime
+pub fn to_generalized_time(dt: &NaiveDateTime) -> Vec<u8> {
+    chrono::Utc
+        .from_utc_datetime(dt)
+        .format("%Y%m%d%H%M%SZ")
+        .to_string()
+        .into_bytes()
+}
+
 fn make_dn_pair<I>(mut iter: I) -> LdapResult<(String, String)>
 where
    I: Iterator<Item = String>,
@@ -239,9 +249,15 @@ pub fn map_user_field(field: &AttributeName, schema: &PublicSchema) -> UserField
            AttributeType::JpegPhoto,
            false,
        ),
-        "creationdate" | "createtimestamp" | "modifytimestamp" | "creation_date" => {
+        "creationdate" | "createtimestamp" | "creation_date" => {
            UserFieldType::PrimaryField(UserColumn::CreationDate)
        }
+        "modifytimestamp" | "modifydate" | "modified_date" => {
+            UserFieldType::PrimaryField(UserColumn::ModifiedDate)
+        }
+        "pwdchangedtime" | "passwordmodifydate" | "password_modified_date" => {
+            UserFieldType::PrimaryField(UserColumn::PasswordModifiedDate)
+        }
        "entryuuid" | "uuid" => UserFieldType::PrimaryField(UserColumn::Uuid),
        _ => schema
            .get_schema()
@@ -257,6 +273,7 @@ pub enum GroupFieldType {
    GroupId,
    DisplayName,
    CreationDate,
+    ModifiedDate,
    ObjectClass,
    Dn,
    // Like Dn, but returned as part of the attributes.
@@ -272,9 +289,8 @@ pub fn map_group_field(field: &AttributeName, schema: &PublicSchema) -> GroupFie
        "entrydn" => GroupFieldType::EntryDn,
        "objectclass" => GroupFieldType::ObjectClass,
        "cn" | "displayname" | "uid" | "display_name" | "id" => GroupFieldType::DisplayName,
-        "creationdate" | "createtimestamp" | "modifytimestamp" | "creation_date" => {
-            GroupFieldType::CreationDate
-        }
+        "creationdate" | "createtimestamp" | "creation_date" => GroupFieldType::CreationDate,
+        "modifytimestamp" | "modifydate" | "modified_date" => GroupFieldType::ModifiedDate,
        "member" | "uniquemember" => GroupFieldType::Member,
        "entryuuid" | "uuid" => GroupFieldType::Uuid,
        "group_id" | "groupid" => GroupFieldType::GroupId,
@@ -294,16 +310,27 @@ pub struct LdapInfo {
    pub ignored_group_attributes: Vec<AttributeName>,
 }

+impl LdapInfo {
+    pub fn new(
+        base_dn: &str,
+        ignored_user_attributes: Vec<AttributeName>,
+        ignored_group_attributes: Vec<AttributeName>,
+    ) -> LdapResult<Self> {
+        let base_dn = parse_distinguished_name(&base_dn.to_ascii_lowercase())?;
+        let base_dn_str = join(base_dn.iter().map(|(k, v)| format!("{k}={v}")), ",");
+        Ok(Self {
+            base_dn,
+            base_dn_str,
+            ignored_user_attributes,
+            ignored_group_attributes,
+        })
+    }
+}
+
 pub fn get_custom_attribute(
    attributes: &[Attribute],
    attribute_name: &AttributeName,
 ) -> Option<Vec<Vec<u8>>> {
-    let convert_date = |date| {
-        chrono::Utc
-            .from_utc_datetime(date)
-            .to_rfc3339()
-            .into_bytes()
-    };
    attributes
        .iter()
        .find(|a| &a.name == attribute_name)
@@ -329,9 +356,9 @@ pub fn get_custom_attribute(
            AttributeValue::JpegPhoto(Cardinality::Unbounded(l)) => {
                l.iter().map(|p| p.clone().into_bytes()).collect()
            }
-            AttributeValue::DateTime(Cardinality::Singleton(dt)) => vec![convert_date(dt)],
+            AttributeValue::DateTime(Cardinality::Singleton(dt)) => vec![to_generalized_time(dt)],
            AttributeValue::DateTime(Cardinality::Unbounded(l)) => {
-                l.iter().map(convert_date).collect()
+                l.iter().map(to_generalized_time).collect()
            }
        })
 }
@@ -515,4 +542,14 @@ mod tests {
            parsed_dn
        );
    }
+
+    #[test]
+    fn test_whitespace_in_ldap_info() {
+        assert_eq!(
+            LdapInfo::new("   ou=people, dc =example,  dc=com \n", vec![], vec![])
+                .unwrap()
+                .base_dn_str,
+            "ou=people,dc=example,dc=com"
+        );
+    }
 }
--- a/crates/ldap/src/delete.rs
+++ b/crates/ldap/src/delete.rs
@@ -154,6 +154,7 @@ mod tests {
                    uuid: uuid!("a1a2a3a4b1b2c1c2d1d2d3d4d5d6d7d8"),
                    users: Vec::new(),
                    attributes: Vec::new(),
+                    modified_date: chrono::Utc.timestamp_opt(42, 42).unwrap().naive_utc(),
                }])
            });
        mock.expect_delete_group()
@@ -284,6 +285,7 @@ mod tests {
                    uuid: uuid!("a1a2a3a4b1b2c1c2d1d2d3d4d5d6d7d8"),
                    users: Vec::new(),
                    attributes: Vec::new(),
+                    modified_date: chrono::Utc.timestamp_opt(42, 42).unwrap().naive_utc(),
                }])
            });
        mock.expect_delete_group()
--- a/crates/ldap/src/handler.rs
+++ b/crates/ldap/src/handler.rs
@@ -2,7 +2,7 @@ use crate::{
    compare,
    core::{
        error::{LdapError, LdapResult},
-        utils::{LdapInfo, parse_distinguished_name},
+        utils::LdapInfo,
    },
    create, delete, modify,
    password::{self, do_password_modification},
@@ -18,7 +18,7 @@ use ldap3_proto::proto::{
 };
 use lldap_access_control::AccessControlledBackendHandler;
 use lldap_auth::access_control::ValidationResults;
-use lldap_domain::{public_schema::PublicSchema, types::AttributeName};
+use lldap_domain::public_schema::PublicSchema;
 use lldap_domain_handlers::handler::{BackendHandler, LoginHandler, ReadSchemaBackendHandler};
 use lldap_opaque_handler::OpaqueHandler;
 use tracing::{debug, instrument};
@@ -59,7 +59,7 @@ pub(crate) fn make_modify_response(code: LdapResultCode, message: String) -> Lda
 pub struct LdapHandler<Backend> {
    user_info: Option<ValidationResults>,
    backend_handler: AccessControlledBackendHandler<Backend>,
-    ldap_info: LdapInfo,
+    ldap_info: &'static LdapInfo,
    session_uuid: uuid::Uuid,
 }

@@ -89,23 +89,13 @@ enum Credentials<'s> {
 impl<Backend: BackendHandler + LoginHandler + OpaqueHandler> LdapHandler<Backend> {
    pub fn new(
        backend_handler: AccessControlledBackendHandler<Backend>,
-        mut ldap_base_dn: String,
-        ignored_user_attributes: Vec<AttributeName>,
-        ignored_group_attributes: Vec<AttributeName>,
+        ldap_info: &'static LdapInfo,
        session_uuid: uuid::Uuid,
    ) -> Self {
-        ldap_base_dn.make_ascii_lowercase();
        Self {
            user_info: None,
            backend_handler,
-            ldap_info: LdapInfo {
-                base_dn: parse_distinguished_name(&ldap_base_dn).unwrap_or_else(|_| {
-                    panic!("Invalid value for ldap_base_dn in configuration: {ldap_base_dn}")
-                }),
-                base_dn_str: ldap_base_dn,
-                ignored_user_attributes,
-                ignored_group_attributes,
-            },
+            ldap_info,
            session_uuid,
        }
    }
@@ -114,9 +104,9 @@ impl<Backend: BackendHandler + LoginHandler + OpaqueHandler> LdapHandler<Backend
    pub fn new_for_tests(backend_handler: Backend, ldap_base_dn: &str) -> Self {
        Self::new(
            AccessControlledBackendHandler::new(backend_handler),
-            ldap_base_dn.to_string(),
-            vec![],
-            vec![],
+            Box::leak(Box::new(
+                LdapInfo::new(ldap_base_dn, Vec::new(), Vec::new()).unwrap(),
+            )),
            uuid::Uuid::parse_str("550e8400-e29b-41d4-a716-446655440000").unwrap(),
        )
    }
@@ -171,13 +161,13 @@ impl<Backend: BackendHandler + LoginHandler + OpaqueHandler> LdapHandler<Backend
        let backend_handler = self
            .backend_handler
            .get_user_restricted_lister_handler(user_info);
-        search::do_search(&backend_handler, &self.ldap_info, request).await
+        search::do_search(&backend_handler, self.ldap_info, request).await
    }

    #[instrument(skip_all, level = "debug", fields(dn = %request.dn))]
    pub async fn do_bind(&mut self, request: &LdapBindRequest) -> Vec<LdapOp> {
        let (code, message) =
-            match password::do_bind(&self.ldap_info, request, self.get_login_handler()).await {
+            match password::do_bind(self.ldap_info, request, self.get_login_handler()).await {
                Ok(user_id) => {
                    self.user_info = self
                        .backend_handler
@@ -211,7 +201,7 @@ impl<Backend: BackendHandler + LoginHandler + OpaqueHandler> LdapHandler<Backend
                    };
                    do_password_modification(
                        credentials,
-                        &self.ldap_info,
+                        self.ldap_info,
                        &self.backend_handler,
                        self.get_opaque_handler(),
                        &password_request,
@@ -257,7 +247,7 @@ impl<Backend: BackendHandler + LoginHandler + OpaqueHandler> LdapHandler<Backend
                self.backend_handler
                    .get_readable_handler(credentials, &user_id)
            },
-            &self.ldap_info,
+            self.ldap_info,
            credentials,
            request,
        )
@@ -275,7 +265,7 @@ impl<Backend: BackendHandler + LoginHandler + OpaqueHandler> LdapHandler<Backend
                code: LdapResultCode::InsufficentAccessRights,
                message: "Unauthorized write".to_string(),
            })?;
-        create::create_user_or_group(backend_handler, &self.ldap_info, request).await
+        create::create_user_or_group(backend_handler, self.ldap_info, request).await
    }

    #[instrument(skip_all, level = "debug")]
@@ -288,7 +278,7 @@ impl<Backend: BackendHandler + LoginHandler + OpaqueHandler> LdapHandler<Backend
                code: LdapResultCode::InsufficentAccessRights,
                message: "Unauthorized write".to_string(),
            })?;
-        delete::delete_user_or_group(backend_handler, &self.ldap_info, request).await
+        delete::delete_user_or_group(backend_handler, self.ldap_info, request).await
    }

    #[instrument(skip_all, level = "debug")]
@@ -398,6 +388,7 @@ pub mod tests {
                    creation_date: chrono::Utc.timestamp_opt(42, 42).unwrap().naive_utc(),
                    uuid: uuid!("a1a2a3a4b1b2c1c2d1d2d3d4d5d6d7d8"),
                    attributes: Vec::new(),
+                    modified_date: chrono::Utc.timestamp_opt(42, 42).unwrap().naive_utc(),
                });
                Ok(set)
            });
--- a/crates/ldap/src/lib.rs
+++ b/crates/ldap/src/lib.rs
@@ -7,7 +7,7 @@ pub(crate) mod modify;
 pub(crate) mod password;
 pub(crate) mod search;

-pub use core::utils::{UserFieldType, map_group_field, map_user_field};
+pub use core::utils::{LdapInfo, UserFieldType, map_group_field, map_user_field};
 pub use handler::LdapHandler;

 pub use core::group::get_default_group_object_classes;
--- a/crates/ldap/src/modify.rs
+++ b/crates/ldap/src/modify.rs
@@ -158,6 +158,7 @@ mod tests {
                        creation_date: chrono::Utc.timestamp_opt(42, 42).unwrap().naive_utc(),
                        uuid: uuid!("a1a2a3a4b1b2c1c2d1d2d3d4d5d6d7d8"),
                        attributes: Vec::new(),
+                        modified_date: chrono::Utc.timestamp_opt(42, 42).unwrap().naive_utc(),
                    });
                }
                Ok(g)
--- a/crates/ldap/src/password.rs
+++ b/crates/ldap/src/password.rs
@@ -263,6 +263,7 @@ pub mod tests {
                    creation_date: chrono::Utc.timestamp_opt(42, 42).unwrap().naive_utc(),
                    uuid: uuid!("a1a2a3a4b1b2c1c2d1d2d3d4d5d6d7d8"),
                    attributes: Vec::new(),
+                    modified_date: chrono::Utc.timestamp_opt(42, 42).unwrap().naive_utc(),
                });
                Ok(set)
            });
@@ -520,6 +521,7 @@ pub mod tests {
            creation_date: chrono::Utc.timestamp_opt(42, 42).unwrap().naive_utc(),
            uuid: uuid!("a1a2a3a4b1b2c1c2d1d2d3d4d5d6d7d8"),
            attributes: Vec::new(),
+            modified_date: chrono::Utc.timestamp_opt(42, 42).unwrap().naive_utc(),
        });
        mock.expect_get_user_groups()
            .with(eq(UserId::new("bob")))
--- a/crates/ldap/src/search.rs
+++ b/crates/ldap/src/search.rs
--- a/crates/opaque-handler/Cargo.toml
+++ b/crates/opaque-handler/Cargo.toml
@@ -1,18 +1,19 @@
 [package]
 name = "lldap_opaque_handler"
-version = "0.1.0"
+version = "0.1.1"
 description = "Opaque handler trait for LLDAP"
 authors.workspace = true
 edition.workspace = true
 homepage.workspace = true
 license.workspace = true
 repository.workspace = true
+rust-version.workspace = true

 [features]
 test = []

 [dependencies]
-async-trait = "0.1"
+async-trait = { workspace = true }

 [dependencies.lldap_auth]
 path = "../auth"
@@ -25,4 +26,4 @@ path = "../domain"
 path = "../domain-model"

 [dev-dependencies]
-mockall = "0.11.4"
+mockall = { workspace = true }
--- a/crates/sql-backend-handler/Cargo.toml
+++ b/crates/sql-backend-handler/Cargo.toml
@@ -1,55 +1,42 @@
 [package]
 name = "lldap_sql_backend_handler"
-version = "0.1.0"
+version = "0.1.1"
 description = "SQL backend for LLDAP"
 authors.workspace = true
 edition.workspace = true
 homepage.workspace = true
 license.workspace = true
 repository.workspace = true
+rust-version.workspace = true

 [features]
 test = []

 [dependencies]
-anyhow = "*"
-async-trait = "0.1"
-base64 = "0.21"
-bincode = "1.3"
-itertools = "0.10"
-ldap3_proto = "0.6.0"
-orion = "0.17"
-serde_json = "1"
-tracing = "*"
+anyhow = { workspace = true }
+async-trait = { workspace = true }
+itertools = { workspace = true }
+orion = { workspace = true }
+serde_json = { workspace = true }
+tracing = { workspace = true }

-[dependencies.chrono]
-features = ["serde"]
-version = "*"
+bincode = { workspace = true }

-[dependencies.rand]
-features = ["small_rng", "getrandom"]
-version = "0.8"
+base64 = { workspace = true }

-[dependencies.sea-orm]
-workspace = true
-features = [
-    "macros",
-    "with-chrono",
-    "with-uuid",
-    "sqlx-all",
-    "runtime-actix-rustls",
-]
+chrono = { workspace = true }

-[dependencies.secstr]
-features = ["serde"]
-version = "*"
+rand = { workspace = true }

-[dependencies.serde]
-workspace = true
+sea-orm = { workspace = true }

-[dependencies.uuid]
-version = "1"
-features = ["v1", "v3"]
+secstr = { workspace = true }
+
+serde = { workspace = true }
+
+uuid = { workspace = true }
+
+ldap3_proto = { workspace = true }

 [dependencies.lldap_access_control]
 path = "../access-control"
@@ -70,18 +57,18 @@ path = "../domain-model"
 [dependencies.lldap_opaque_handler]
 path = "../opaque-handler"

+[dev-dependencies.lldap_domain]
+path = "../domain"
+features = ["test"]
+
 [dev-dependencies.lldap_test_utils]
 path = "../test-utils"

 [dev-dependencies]
-log = "*"
-mockall = "0.11.4"
-pretty_assertions = "1"
+log = { workspace = true }
+mockall = { workspace = true }
+pretty_assertions = { workspace = true }

-[dev-dependencies.tokio]
-features = ["full"]
-version = "1.25"
+tokio = { workspace = true }

-[dev-dependencies.tracing-subscriber]
-version = "0.3"
-features = ["env-filter", "tracing-log"]
+tracing-subscriber = { workspace = true }
--- a/crates/sql-backend-handler/src/sql_group_backend_handler.rs
+++ b/crates/sql-backend-handler/src/sql_group_backend_handler.rs
@@ -206,6 +206,7 @@ impl GroupBackendHandler for SqlBackendHandler {
            lowercase_display_name: Set(lower_display_name),
            creation_date: Set(now),
            uuid: Set(uuid),
+            modified_date: Set(now),
            ..Default::default()
        };
        Ok(self
@@ -268,10 +269,12 @@ impl SqlBackendHandler {
            .display_name
            .as_ref()
            .map(|s| s.as_str().to_lowercase());
+        let now = chrono::Utc::now().naive_utc();
        let update_group = model::groups::ActiveModel {
            group_id: Set(request.group_id),
            display_name: request.display_name.map(Set).unwrap_or_default(),
            lowercase_display_name: lower_display_name.map(Set).unwrap_or_default(),
+            modified_date: Set(now),
            ..Default::default()
        };
        update_group.update(transaction).await?;
--- a/crates/sql-backend-handler/src/sql_migrations.rs
+++ b/crates/sql-backend-handler/src/sql_migrations.rs
@@ -27,6 +27,8 @@ pub enum Users {
    TotpSecret,
    MfaType,
    Uuid,
+    ModifiedDate,
+    PasswordModifiedDate,
 }

 #[derive(DeriveIden, PartialEq, Eq, Debug, Serialize, Deserialize, Clone, Copy)]
@@ -37,6 +39,7 @@ pub(crate) enum Groups {
    LowercaseDisplayName,
    CreationDate,
    Uuid,
+    ModifiedDate,
 }

 #[derive(DeriveIden, Clone, Copy)]
@@ -533,7 +536,7 @@ See https://github.com/lldap/lldap/blob/main/docs/migration_guides/v0.5.md for d
 Conflicting emails:
 "#,
        );
-        for (email, users) in &transaction
+        let duplicate_users = transaction
            .query_all(
                builder.build(
                    Query::select()
@@ -565,9 +568,8 @@ Conflicting emails:
                    row.try_get::<String>("", &Users::Email.to_string())
                        .unwrap(),
                )
-            })
-            .group_by(|(_user, email)| email.to_owned())
-        {
+            });
+        for (email, users) in &duplicate_users.chunk_by(|(_user, email)| email.to_owned()) {
            warn!("Email: {email}");
            for (user, _email) in users {
                warn!("    User: {}", user.as_str());
@@ -1112,6 +1114,53 @@ async fn migrate_to_v10(transaction: DatabaseTransaction) -> Result<DatabaseTran
    Ok(transaction)
 }

+async fn migrate_to_v11(transaction: DatabaseTransaction) -> Result<DatabaseTransaction, DbErr> {
+    let builder = transaction.get_database_backend();
+    // Add modified_date to users table
+    transaction
+        .execute(
+            builder.build(
+                Table::alter().table(Users::Table).add_column(
+                    ColumnDef::new(Users::ModifiedDate)
+                        .date_time()
+                        .not_null()
+                        .default(chrono::Utc::now().naive_utc()),
+                ),
+            ),
+        )
+        .await?;
+
+    // Add password_modified_date to users table
+    transaction
+        .execute(
+            builder.build(
+                Table::alter().table(Users::Table).add_column(
+                    ColumnDef::new(Users::PasswordModifiedDate)
+                        .date_time()
+                        .not_null()
+                        .default(chrono::Utc::now().naive_utc()),
+                ),
+            ),
+        )
+        .await?;
+
+    // Add modified_date to groups table
+    transaction
+        .execute(
+            builder.build(
+                Table::alter().table(Groups::Table).add_column(
+                    ColumnDef::new(Groups::ModifiedDate)
+                        .date_time()
+                        .not_null()
+                        .default(chrono::Utc::now().naive_utc()),
+                ),
+            ),
+        )
+        .await?;
+
+    Ok(transaction)
+}
+
 // This is needed to make an array of async functions.
 macro_rules! to_sync {
    ($l:ident) => {
@@ -1142,6 +1191,7 @@ pub(crate) async fn migrate_from_version(
        to_sync!(migrate_to_v8),
        to_sync!(migrate_to_v9),
        to_sync!(migrate_to_v10),
+        to_sync!(migrate_to_v11),
    ];
    assert_eq!(migrations.len(), (LAST_SCHEMA_VERSION.0 - 1) as usize);
    for migration in 2..=last_version.0 {
--- a/crates/sql-backend-handler/src/sql_opaque_handler.rs
+++ b/crates/sql-backend-handler/src/sql_opaque_handler.rs
@@ -197,9 +197,12 @@ impl OpaqueHandler for SqlOpaqueHandler {
        let password_file =
            opaque::server::registration::get_password_file(request.registration_upload);
        // Set the user password to the new password.
+        let now = chrono::Utc::now().naive_utc();
        let user_update = model::users::ActiveModel {
            user_id: ActiveValue::Set(username.clone()),
            password_hash: ActiveValue::Set(Some(password_file.serialize())),
+            password_modified_date: ActiveValue::Set(now),
+            modified_date: ActiveValue::Set(now),
            ..Default::default()
        };
        user_update.update(&self.sql_pool).await?;
--- a/crates/sql-backend-handler/src/sql_schema_backend_handler.rs
+++ b/crates/sql-backend-handler/src/sql_schema_backend_handler.rs
@@ -29,28 +29,76 @@ impl ReadSchemaBackendHandler for SqlBackendHandler {
 #[async_trait]
 impl SchemaBackendHandler for SqlBackendHandler {
    async fn add_user_attribute(&self, request: CreateAttributeRequest) -> Result<()> {
-        let new_attribute = model::user_attribute_schema::ActiveModel {
-            attribute_name: Set(request.name),
-            attribute_type: Set(request.attribute_type),
-            is_list: Set(request.is_list),
-            is_user_visible: Set(request.is_visible),
-            is_user_editable: Set(request.is_editable),
-            is_hardcoded: Set(false),
-        };
-        new_attribute.insert(&self.sql_pool).await?;
+        self.sql_pool
+            .transaction::<_, (), DomainError>(|transaction| {
+                Box::pin(async move {
+                    // Check for conflicting group attribute with the same name but different type.
+                    // Done inside the transaction to prevent TOCTOU races.
+                    let schema = Self::get_schema_with_transaction(transaction).await?;
+                    if let Some(group_attr) = schema
+                        .group_attributes
+                        .attributes
+                        .iter()
+                        .find(|a| a.name == request.name)
+                        && group_attr.attribute_type != request.attribute_type
+                    {
+                        return Err(DomainError::InternalError(format!(
+                            "A group attribute '{}' already exists with type {:?}, \
+                                 cannot create a user attribute with type {:?}. \
+                                 LDAP requires each attribute name to have a single type.",
+                            request.name, group_attr.attribute_type, request.attribute_type
+                        )));
+                    }
+                    let new_attribute = model::user_attribute_schema::ActiveModel {
+                        attribute_name: Set(request.name),
+                        attribute_type: Set(request.attribute_type),
+                        is_list: Set(request.is_list),
+                        is_user_visible: Set(request.is_visible),
+                        is_user_editable: Set(request.is_editable),
+                        is_hardcoded: Set(false),
+                    };
+                    new_attribute.insert(transaction).await?;
+                    Ok(())
+                })
+            })
+            .await?;
        Ok(())
    }

    async fn add_group_attribute(&self, request: CreateAttributeRequest) -> Result<()> {
-        let new_attribute = model::group_attribute_schema::ActiveModel {
-            attribute_name: Set(request.name),
-            attribute_type: Set(request.attribute_type),
-            is_list: Set(request.is_list),
-            is_group_visible: Set(request.is_visible),
-            is_group_editable: Set(request.is_editable),
-            is_hardcoded: Set(false),
-        };
-        new_attribute.insert(&self.sql_pool).await?;
+        self.sql_pool
+            .transaction::<_, (), DomainError>(|transaction| {
+                Box::pin(async move {
+                    // Check for conflicting user attribute with the same name but different type.
+                    // Done inside the transaction to prevent TOCTOU races.
+                    let schema = Self::get_schema_with_transaction(transaction).await?;
+                    if let Some(user_attr) = schema
+                        .user_attributes
+                        .attributes
+                        .iter()
+                        .find(|a| a.name == request.name)
+                        && user_attr.attribute_type != request.attribute_type
+                    {
+                        return Err(DomainError::InternalError(format!(
+                            "A user attribute '{}' already exists with type {:?}, \
+                                 cannot create a group attribute with type {:?}. \
+                                 LDAP requires each attribute name to have a single type.",
+                            request.name, user_attr.attribute_type, request.attribute_type
+                        )));
+                    }
+                    let new_attribute = model::group_attribute_schema::ActiveModel {
+                        attribute_name: Set(request.name),
+                        attribute_type: Set(request.attribute_type),
+                        is_list: Set(request.is_list),
+                        is_group_visible: Set(request.is_visible),
+                        is_group_editable: Set(request.is_editable),
+                        is_hardcoded: Set(false),
+                    };
+                    new_attribute.insert(transaction).await?;
+                    Ok(())
+                })
+            })
+            .await?;
        Ok(())
    }

--- a/crates/sql-backend-handler/src/sql_tables.rs
+++ b/crates/sql-backend-handler/src/sql_tables.rs
@@ -9,7 +9,7 @@ pub type DbConnection = sea_orm::DatabaseConnection;
 #[derive(Copy, PartialEq, Eq, Debug, Clone, PartialOrd, Ord, DeriveValueType)]
 pub struct SchemaVersion(pub i16);

-pub const LAST_SCHEMA_VERSION: SchemaVersion = SchemaVersion(10);
+pub const LAST_SCHEMA_VERSION: SchemaVersion = SchemaVersion(11);

 #[derive(Copy, PartialEq, Eq, Debug, Clone, PartialOrd, Ord)]
 pub struct PrivateKeyHash(pub [u8; 32]);
--- a/crates/sql-backend-handler/src/sql_user_backend_handler.rs
+++ b/crates/sql-backend-handler/src/sql_user_backend_handler.rs
@@ -2,7 +2,11 @@ use crate::sql_backend_handler::SqlBackendHandler;
 use async_trait::async_trait;
 use lldap_domain::{
    requests::{CreateUserRequest, UpdateUserRequest},
-    types::{AttributeName, GroupDetails, GroupId, Serialized, User, UserAndGroups, UserId, Uuid},
+    schema::Schema,
+    types::{
+        Attribute, AttributeName, GroupDetails, GroupId, Serialized, User, UserAndGroups, UserId,
+        Uuid,
+    },
 };
 use lldap_domain_handlers::handler::{
    ReadSchemaBackendHandler, UserBackendHandler, UserListerBackendHandler, UserRequestFilter,
@@ -185,18 +189,12 @@ impl UserListerBackendHandler for SqlBackendHandler {
 }

 impl SqlBackendHandler {
-    async fn update_user_with_transaction(
-        transaction: &DatabaseTransaction,
-        request: UpdateUserRequest,
-    ) -> Result<()> {
-        let lower_email = request.email.as_ref().map(|s| s.as_str().to_lowercase());
-        let update_user = model::users::ActiveModel {
-            user_id: ActiveValue::Set(request.user_id.clone()),
-            email: request.email.map(ActiveValue::Set).unwrap_or_default(),
-            lowercase_email: lower_email.map(ActiveValue::Set).unwrap_or_default(),
-            display_name: to_value(&request.display_name),
-            ..Default::default()
-        };
+    fn compute_user_attribute_changes(
+        user_id: &UserId,
+        insert_attributes: Vec<Attribute>,
+        delete_attributes: Vec<AttributeName>,
+        schema: &Schema,
+    ) -> Result<(Vec<model::user_attributes::ActiveModel>, Vec<AttributeName>)> {
        let mut update_user_attributes = Vec::new();
        let mut remove_user_attributes = Vec::new();
        let mut process_serialized =
@@ -206,24 +204,20 @@ impl SqlBackendHandler {
                }
                ActiveValue::Set(_) => {
                    update_user_attributes.push(model::user_attributes::ActiveModel {
-                        user_id: Set(request.user_id.clone()),
+                        user_id: Set(user_id.clone()),
                        attribute_name: Set(attribute_name),
                        value,
                    })
                }
                _ => unreachable!(),
            };
-        let schema = Self::get_schema_with_transaction(transaction).await?;
-        for attribute in request.insert_attributes {
+        for attribute in insert_attributes {
            if schema
                .user_attributes
                .get_attribute_type(&attribute.name)
                .is_some()
            {
-                process_serialized(
-                    ActiveValue::Set(attribute.value.into()),
-                    attribute.name.clone(),
-                );
+                process_serialized(ActiveValue::Set(attribute.value.into()), attribute.name);
            } else {
                return Err(DomainError::InternalError(format!(
                    "User attribute name {} doesn't exist in the schema, yet was attempted to be inserted in the database",
@@ -231,7 +225,7 @@ impl SqlBackendHandler {
                )));
            }
        }
-        for attribute in request.delete_attributes {
+        for attribute in delete_attributes {
            if schema
                .user_attributes
                .get_attribute_type(&attribute)
@@ -244,6 +238,31 @@ impl SqlBackendHandler {
                )));
            }
        }
+        Ok((update_user_attributes, remove_user_attributes))
+    }
+
+    async fn update_user_with_transaction(
+        transaction: &DatabaseTransaction,
+        request: UpdateUserRequest,
+    ) -> Result<()> {
+        let schema = Self::get_schema_with_transaction(transaction).await?;
+        let (update_user_attributes, remove_user_attributes) =
+            Self::compute_user_attribute_changes(
+                &request.user_id,
+                request.insert_attributes,
+                request.delete_attributes,
+                &schema,
+            )?;
+        let lower_email = request.email.as_ref().map(|s| s.as_str().to_lowercase());
+        let now = chrono::Utc::now().naive_utc();
+        let update_user = model::users::ActiveModel {
+            user_id: ActiveValue::Set(request.user_id.clone()),
+            email: request.email.map(ActiveValue::Set).unwrap_or_default(),
+            lowercase_email: lower_email.map(ActiveValue::Set).unwrap_or_default(),
+            display_name: to_value(&request.display_name),
+            modified_date: ActiveValue::Set(now),
+            ..Default::default()
+        };
        update_user.update(transaction).await?;
        if !remove_user_attributes.is_empty() {
            model::UserAttributes::delete_many()
@@ -325,6 +344,8 @@ impl UserBackendHandler for SqlBackendHandler {
            display_name: to_value(&request.display_name),
            creation_date: ActiveValue::Set(now),
            uuid: ActiveValue::Set(uuid),
+            modified_date: ActiveValue::Set(now),
+            password_modified_date: ActiveValue::Set(now),
            ..Default::default()
        };
        let mut new_user_attributes = Vec::new();
@@ -391,24 +412,70 @@ impl UserBackendHandler for SqlBackendHandler {

    #[instrument(skip_all, level = "debug", err, fields(user_id = ?user_id.as_str(), group_id))]
    async fn add_user_to_group(&self, user_id: &UserId, group_id: GroupId) -> Result<()> {
-        let new_membership = model::memberships::ActiveModel {
-            user_id: ActiveValue::Set(user_id.clone()),
-            group_id: ActiveValue::Set(group_id),
-        };
-        new_membership.insert(&self.sql_pool).await?;
+        let user_id = user_id.clone();
+        self.sql_pool
+            .transaction::<_, _, sea_orm::DbErr>(|transaction| {
+                Box::pin(async move {
+                    let new_membership = model::memberships::ActiveModel {
+                        user_id: ActiveValue::Set(user_id),
+                        group_id: ActiveValue::Set(group_id),
+                    };
+                    new_membership.insert(transaction).await?;
+
+                    // Update group modification time
+                    let now = chrono::Utc::now().naive_utc();
+                    let update_group = model::groups::ActiveModel {
+                        group_id: Set(group_id),
+                        modified_date: Set(now),
+                        ..Default::default()
+                    };
+                    update_group.update(transaction).await?;
+
+                    Ok(())
+                })
+            })
+            .await?;
        Ok(())
    }

    #[instrument(skip_all, level = "debug", err, fields(user_id = ?user_id.as_str(), group_id))]
    async fn remove_user_from_group(&self, user_id: &UserId, group_id: GroupId) -> Result<()> {
-        let res = model::Membership::delete_by_id((user_id.clone(), group_id))
-            .exec(&self.sql_pool)
-            .await?;
-        if res.rows_affected == 0 {
-            return Err(DomainError::EntityNotFound(format!(
-                "No such membership: '{user_id}' -> {group_id:?}"
-            )));
-        }
+        let user_id = user_id.clone();
+        self.sql_pool
+            .transaction::<_, _, sea_orm::DbErr>(|transaction| {
+                Box::pin(async move {
+                    let res = model::Membership::delete_by_id((user_id.clone(), group_id))
+                        .exec(transaction)
+                        .await?;
+                    if res.rows_affected == 0 {
+                        return Err(sea_orm::DbErr::Custom(format!(
+                            "No such membership: '{user_id}' -> {group_id:?}"
+                        )));
+                    }
+
+                    // Update group modification time
+                    let now = chrono::Utc::now().naive_utc();
+                    let update_group = model::groups::ActiveModel {
+                        group_id: Set(group_id),
+                        modified_date: Set(now),
+                        ..Default::default()
+                    };
+                    update_group.update(transaction).await?;
+
+                    Ok(())
+                })
+            })
+            .await
+            .map_err(|e| match e {
+                sea_orm::TransactionError::Connection(sea_orm::DbErr::Custom(msg)) => {
+                    DomainError::EntityNotFound(msg)
+                }
+                sea_orm::TransactionError::Transaction(sea_orm::DbErr::Custom(msg)) => {
+                    DomainError::EntityNotFound(msg)
+                }
+                sea_orm::TransactionError::Connection(e) => DomainError::DatabaseError(e),
+                sea_orm::TransactionError::Transaction(e) => DomainError::DatabaseError(e),
+            })?;
        Ok(())
    }
 }
--- a/crates/test-utils/Cargo.toml
+++ b/crates/test-utils/Cargo.toml
@@ -1,21 +1,21 @@
 [package]
 name = "lldap_test_utils"
-version = "0.1.0"
+version = "0.1.1"
 authors.workspace = true
 edition.workspace = true
 homepage.workspace = true
 license.workspace = true
 repository.workspace = true
+rust-version.workspace = true

 [dependencies]
-async-trait = "0.1"
-ldap3_proto = "0.6.0"
-mockall = "0.11.4"
-tracing = "*"
+async-trait = { workspace = true }
+mockall = { workspace = true }
+tracing = { workspace = true }

-[dependencies.uuid]
-version = "1"
-features = ["v1", "v3"]
+uuid = { workspace = true }
+
+ldap3_proto = { workspace = true }

 [dependencies.lldap_access_control]
 path = "../access-control"
--- a/crates/validation/Cargo.toml
+++ b/crates/validation/Cargo.toml
@@ -1,9 +1,10 @@
 [package]
 name = "lldap_validation"
-version = "0.6.0"
+version = "0.6.3"
 authors = ["Simon Broeng Jensen <sbj@cwconsult.dk>"]
 description = "Validation logic for LLDAP"
 edition.workspace = true
 homepage.workspace = true
 license.workspace = true
 repository.workspace = true
+rust-version.workspace = true
--- a/docs/install.md
+++ b/docs/install.md
@@ -3,6 +3,7 @@
 - [With Docker](#with-docker)
 - [With Podman](#with-podman)
 - [With Kubernetes](#with-kubernetes)
+- [TrueNAS SCALE](#truenas-scale)
 - [From a package repository](#from-a-package-repository)
 - [With FreeBSD](#with-freebsd)
 - [From source](#from-source)
@@ -68,7 +69,7 @@ services:
      - LLDAP_JWT_SECRET=REPLACE_WITH_RANDOM
      - LLDAP_KEY_SEED=REPLACE_WITH_RANDOM
      - LLDAP_LDAP_BASE_DN=dc=example,dc=com
-      - LLDAP_LDAP_USER_PASS=adminPas$word
+      - LLDAP_LDAP_USER_PASS=CHANGE_ME # If the password contains '$', escape it (e.g. Pas$$word sets Pas$word)
      # If using LDAPS, set enabled true and configure cert and key path
      # - LLDAP_LDAPS_OPTIONS__ENABLED=true
      # - LLDAP_LDAPS_OPTIONS__CERT_FILE=/path/to/certfile.crt
@@ -85,6 +86,7 @@ services:
      # - LLDAP_SMTP_OPTIONS__PASSWORD=PasswordGoesHere # The SMTP password
      # - LLDAP_SMTP_OPTIONS__FROM=no-reply <no-reply@example.com> # The header field, optional: how the sender appears in the email. The first is a free-form name, followed by an email between <>.
      # - LLDAP_SMTP_OPTIONS__TO=admin <admin@example.com> # Same for reply-to, optional.
+      # - LLDAP_HTTP_URL=https://lldap.example.com # URL used in the email template to compose the reset link
 ```

 Then the service will listen on two ports, one for LDAP and one for the web
@@ -93,7 +95,7 @@ front-end.
 ### With Podman

 LLDAP works well with rootless Podman either through command line deployment
-or using [quadlets](example_configs/podman-quadlets/). The example quadlets
+or using [quadlets](../example_configs/podman-quadlets/). The example quadlets
 include configuration with postgresql and file based secrets, but have comments
 for several other deployment strategies.

@@ -102,9 +104,30 @@ for several other deployment strategies.
 See https://github.com/Evantage-WS/lldap-kubernetes for a LLDAP deployment for Kubernetes

 You can bootstrap your lldap instance (users, groups)
-using [bootstrap.sh](example_configs/bootstrap/bootstrap.md#kubernetes-job).
+using [bootstrap.sh](../example_configs/bootstrap/bootstrap.md#kubernetes-job).
 It can be run by Argo CD for managing users in git-opt way, or as a one-shot job.

+### TrueNAS SCALE
+
+LLDAP can be installed on **TrueNAS SCALE** using the built-in Apps catalog, allowing users to deploy and manage LLDAP directly from the TrueNAS web interface without manually maintaining containers.
+
+To install:
+
+1. Open the TrueNAS web interface.
+2. Navigate to **Apps → Discover Apps**.
+3. Search for **LLDAP** and click **Install**.
+4. Provide the required configuration values such as:
+   - Base DN
+   - Admin credentials
+   - LDAP / LDAPS ports
+   - Persistent storage dataset
+
+TrueNAS supports selecting certificates for LDAPS and configuring a public web URL. When LDAPS is enabled, it is recommended to disable the unencrypted LDAP port to ensure secure communication.
+
+A full, step-by-step TrueNAS-specific guide (including recommended ports, certificate configuration, and common integrations) is available here:
+
+👉 [example_configs/truenas-install.md](https://github.com/lldap/lldap/blob/main/example_configs/truenas-install.md)
+
 ### From a package repository

 **Do not open issues in this repository for problems with third-party
@@ -114,7 +137,7 @@ Depending on the distribution you use, it might be possible to install LLDAP
 from a package repository, officially supported by the distribution or
 community contributed.

-Each package offers a [systemd service](https://wiki.archlinux.org/title/systemd#Using_units) `lldap.service` or [rc.d_lldap](example_configs/freebsd/rc.d_lldap) `rc.d/lldap` to (auto-)start and stop lldap.<br>
+Each package offers a [systemd service](https://wiki.archlinux.org/title/systemd#Using_units) `lldap.service` or [rc.d_lldap](../example_configs/freebsd/rc.d_lldap) `rc.d/lldap` to (auto-)start and stop lldap.<br>
 When using the distributed packages, the default login is `admin/password`. You can change that from the web UI after starting the service.

 <details>
@@ -385,7 +408,7 @@ arguments to `cargo run`. Have a look at the docker template:
 `lldap_config.docker_template.toml`.

 You can also install it as a systemd service, see
-[lldap.service](example_configs/lldap.service).
+[lldap.service](../example_configs/lldap.service).

 ### Cross-compilation

--- a/docs/nix-development.md
+++ b/docs/nix-development.md
@@ -0,0 +1,71 @@
+# Nix Development Environment
+
+LLDAP provides a Nix flake that sets up a complete development environment with all necessary tools and dependencies.
+
+## Requirements
+
+- [Nix](https://nixos.org/download.html) with flakes enabled
+- (Optional) [direnv](https://direnv.net/) for automatic environment activation
+
+## Usage
+
+```bash
+# Clone the repository
+git clone https://github.com/lldap/lldap.git
+cd lldap
+
+# Enter the development environment
+nix develop
+
+# Build the workspace
+cargo build --workspace
+
+# Run tests
+cargo test --workspace
+
+# Check formatting and linting
+cargo fmt --check --all
+cargo clippy --tests --workspace -- -D warnings
+
+# Build frontend
+./app/build.sh
+
+# Export GraphQL schema (if needed)
+./export_schema.sh
+
+# Start development server
+cargo run -- run --config-file lldap_config.docker_template.toml
+```
+
+## Building with Nix
+
+You can also build LLDAP directly using Nix:
+
+```bash
+# Build the default package (server)
+nix build
+
+# Build and run
+nix run
+```
+
+## Development Shells
+
+The flake provides two development shells:
+
+- `default` - Full development environment
+- `ci` - Minimal environment similar to CI
+
+```bash
+# Use the CI-like environment
+nix develop .#ci
+```
+
+## Automatic Environment Activation (Optional)
+
+For automatic environment activation when entering the project directory:
+
+1. Install direnv: `nix profile install nixpkgs#direnv`
+2. Set up direnv shell hook in your shell configuration 
+3. Navigate to the project directory and allow direnv: `direnv allow`
+4. The environment will automatically activate when entering the directory
--- a/example_configs/README.md
+++ b/example_configs/README.md
@@ -4,6 +4,7 @@ Some specific clients have been tested to work and come with sample
 configuration files:

 - [Airsonic Advanced](airsonic-advanced.md)
+- [Apache HTTP Server](apache.md)
 - [Apache Guacamole](apacheguacamole.md)
 - [Apereo CAS Server](apereo_cas_server.md)
 - [Authelia](authelia.md)
@@ -11,16 +12,20 @@ configuration files:
 - [Bookstack](bookstack.env.example)
 - [Calibre-Web](calibre_web.md)
 - [Carpal](carpal.md)
+- [Continuwuity](continuwuity.md)
 - [Dell iDRAC](dell_idrac.md)
 - [Dex](dex_config.yml)
 - [Dokuwiki](dokuwiki.md)
 - [Dolibarr](dolibarr.md)
 - [Duo Auth Proxy](duo_auth_proxy.md)
 - [Ejabberd](ejabberd.md)
+- [Elasticsearch](elasticsearch.md)
 - [Emby](emby.md)
 - [Ergo IRCd](ergo.md)
+- [Gerrit](gerrit.md)
 - [Gitea](gitea.md)
 - [GitLab](gitlab.md)
+- [Gogs](gogs.md)
 - [Grafana](grafana_ldap_config.toml)
 - [Grocy](grocy.md)
 - [Harbor](harbor.md)
@@ -47,10 +52,12 @@ configuration files:
 - [Nexus](nexus.md)
 - [OCIS (OwnCloud Infinite Scale)](ocis.md)
 - [OneDev](onedev.md)
+- [OpenCloud](opencloud.md)
 - [Organizr](Organizr.md)
 - [Peertube](peertube.md)
 - [Penpot](penpot.md)
 - [pgAdmin](pgadmin.md)
+- [Pocket-ID](pocket-id.md)
 - [Portainer](portainer.md)
 - [PowerDNS Admin](powerdns_admin.md)
 - [Prosody](prosody.md)
@@ -59,6 +66,7 @@ configuration files:
 - [Radicale](radicale.md)
 - [Rancher](rancher.md)
 - [Seafile](seafile.md)
+- [Semaphore](semaphore.md)
 - [Shaarli](shaarli.md)
 - [Snipe-IT](snipe-it.md)
 - [SonarQube](sonarqube.md)
--- a/example_configs/apache.md
+++ b/example_configs/apache.md
@@ -0,0 +1,65 @@
+# Configuration for Apache
+
+This example snippet provides space under `/webdav/<username>/` if they log in as the user in question.
+
+## Apache LDAP Configuration
+
+```
+# The User/Group specified in httpd.conf needs to have write permissions
+# on the directory where the DavLockDB is placed and on any directory where
+# "Dav On" is specified.
+
+DavLockDB "/var/local/apache2/DavLock"
+
+Alias /webdav "/var/local/apache2/data"
+
+<Directory "/var/local/apache2/data">
+        AllowOverride None
+        Require all denied
+        DirectoryIndex disabled
+</Directory>
+
+<DirectoryMatch "^/var/local/apache2/data/(?<user>[^/]+)">
+        AuthType Basic
+        AuthName "LDAP Credentials"
+        AuthBasicProvider ldap
+
+        AuthLDAPURL ldap://lldap:3890/ou=people,dc=example,dc=com?uid?sub?(objectClass=person)
+        AuthLDAPBindDN uid=integration,ou=people,dc=example,dc=com
+        AuthLDAPBindPassword [redacted]
+
+        <RequireAll>
+                Require ldap-user "%{env:MATCH_USER}"
+                Require ldap-group cn=WebDAV,ou=groups,dc=example,dc=com
+        </RequireAll>
+
+        Dav On
+        Options +Indexes
+</DirectoryMatch>
+```
+### Notes
+
+* Make sure you create the `data` directory, and the subdirectories for your users.
+* `integration` was an LDAP user I added with strict readonly.
+* The `WebDAV` group was something I added and put relevant users into, more as a test of functionality than out of any need.
+* I left the comment from the Apache DAV config in because it's not kidding around and it won't be obvious what's going wrong from the Apache logs if you miss that.
+
+## Apache Orchestration
+
+The stock Apache server with that stanza added to the bottom of the stock config and shared into the container.
+```
+    webdav:
+      image: httpd:2.4.66-trixie
+      restart: always
+      volumes:
+        - /opt/webdav:/var/local/apache2
+        - ./httpd.conf:/usr/local/apache2/conf/httpd.conf
+      labels:
+        - "traefik.enable=true"
+        - "traefik.http.routers.webdav.entrypoints=websecure"
+        - "traefik.http.routers.webdav.rule=Host(`redacted`) && PathPrefix(`/webdav`)"
+        - "traefik.http.routers.webdav.tls.certresolver=myresolver"
+        - "traefik.http.routers.webdav.service=webdav-service"
+        - "traefik.http.services.webdav-service.loadbalancer.server.port=80"
+```
+
--- a/example_configs/authentik.md
+++ b/example_configs/authentik.md
@@ -64,7 +64,7 @@ dc=example,dc=com

 # Additional settings

-## Group
+## Parent Group
 ```
 ---------
 ```
@@ -99,6 +99,16 @@ ou=groups
 member
 ```

+## User membership attribute
+```
+distinguishedName
+```
+
+## Looking using user attribute
+```
+false
+```
+
 ## Object uniqueness field
 ```
 uid
--- a/example_configs/bootstrap/bootstrap.md
+++ b/example_configs/bootstrap/bootstrap.md
@@ -72,6 +72,7 @@ Fields description:
 * `id`: it's just username (**MANDATORY**)
 * `email`: self-explanatory (**MANDATORY**)
 * `password`: would be used to set the password using `lldap_set_password` utility
+* `password_file`: path to a file containing the password otherwise same as above
 * `displayName`: self-explanatory
 * `firstName`: self-explanatory
 * `lastName`: self-explanatory
@@ -130,7 +131,7 @@ Fields description:
    "isVisible": true
  },
  {
-    "name": "mail_alias",
+    "name": "mail-alias",
    "attributeType": "STRING",
    "isEditable": false,
    "isList": true,
@@ -246,14 +247,14 @@ spec:
      restartPolicy: OnFailure
      containers:
        - name: lldap-bootstrap
-          image: lldap/lldap:v0.5.0
+          image: lldap/lldap:latest

          command:
-            - /bootstrap/bootstrap.sh
+            - /app/bootstrap.sh

          env:
            - name: LLDAP_URL
-              value: "http://lldap:8080"
+              value: "http://lldap:17170"

            - name: LLDAP_ADMIN_USERNAME
              valueFrom: { secretKeyRef: { name: lldap-admin-user, key: username } }
@@ -265,11 +266,6 @@ spec:
              value: "true"

          volumeMounts:
-            - name: bootstrap
-              mountPath: /bootstrap/bootstrap.sh
-              readOnly: true
-              subPath: bootstrap.sh
-
            - name: user-configs
              mountPath: /bootstrap/user-configs
              readOnly: true
@@ -279,27 +275,9 @@ spec:
              readOnly: true

      volumes:
-        - name: bootstrap
-          configMap:
-            name: bootstrap
-            defaultMode: 0555
-            items:
-              - key: bootstrap.sh
-                path: bootstrap.sh
-
        - name: user-configs
          projected:
            sources:
-              - secret:
-                  name: lldap-admin-user
-                  items:
-                    - key: user-config.json
-                      path: admin-config.json
-              - secret:
-                  name: lldap-password-manager-user
-                  items:
-                    - key: user-config.json
-                      path: password-manager-config.json
              - secret:
                  name: lldap-bootstrap-configs
                  items:
--- a/example_configs/continuwuity.md
+++ b/example_configs/continuwuity.md
@@ -0,0 +1,15 @@
+# Configuration for Continuwuity
+
+This example is with environment vars from my docker-compose.yml, this also works just as well with a [config file](https://continuwuity.org/reference/config). `uid=query,ou=people,dc=example,dc=com` is a read-only user and you need to put their password into `/etc/bind_password_file`. Users need to be in the group `matrix` to log in and users in the group `matrix-admin` will be an admin.
+
+```
+CONTINUWUITY_LDAP__ENABLE: 'true'
+CONTINUWUITY_LDAP__LDAP_ONLY: 'true'
+CONTINUWUITY_LDAP__URI: 'ldap://lldap.example.com:3890'
+CONTINUWUITY_LDAP__BASE_DN: 'ou=people,dc=example,dc=com'
+CONTINUWUITY_LDAP__BIND_DN: 'uid=query,ou=people,dc=example,dc=com'
+CONTINUWUITY_LDAP__BIND_PASSWORD_FILE: '/etc/bind_password_file'
+CONTINUWUITY_LDAP__FILTER: '(memberOf=matrix)'
+CONTINUWUITY_LDAP__UID_ATTRIBUTE: 'uid'
+CONTINUWUITY_LDAP__ADMIN_FILTER: '(memberOf=matrix-admin)'
+```
--- a/example_configs/elasticsearch.md
+++ b/example_configs/elasticsearch.md
@@ -0,0 +1,56 @@
+# Elasticsearch configuration
+
+> ⚠️ Configuring Elasticsearch to use LDAP auth requires a paid licence. Only the `default` and `file` realms are enabled on a Basic licence. Using the trial licence on cluster init will allow LDAP auth to be configured.
+
+This basic configuration example is for LLDAP auth on [Elastic Cloud on Kubernetes (ECK)](https://www.elastic.co/docs/deploy-manage/deploy/cloud-on-k8s). Advanced configuration can be found in the [Elastic docs](https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/ldap).
+
+## Elasticsearch
+
+To perform auth using LLDAP in Elasticsearch, add the following lines to the Elasticsearch spec:
+
+```yaml
+spec:
+  nodesets:
+    - name: elasticsearch
+      config:
+        xpack.security.authc.realms.ldap:
+          ldap1:
+            order: 1
+            enabled: true
+            url: "ldap://<ip.of.lldap.instance>:3890"
+            user_dn_templates:
+              - "uid={0},ou=people,dc=example,dc=com"
+            bind_dn: "uid=admin,ou=people,dc=example,dc=com"
+            group_search:
+              base_dn: "ou=groups,dc=example,dc=com"
+            unmapped_groups_as_roles: false
+  secureSettings:
+    - secretName: elasticsearch-keystore-values
+```
+
+Then, create a secret called `elasticsearch-keystore-values`:
+
+```yaml
+apiVersion: v1
+kind: Secret
+type: Opaque
+metadata:
+  name: elasticsearch-keystore-values
+  namespace: elastic
+data:
+  xpack.security.authc.realms.ldap.ldap1.secure_bind_password: base64_encoded_ldap_admin_password
+```
+
+## Kibana
+
+To allow Kibana to auth logins using LLDAP, add the following lines to the Kibana spec:
+
+```yaml
+spec:
+  config:
+    xpack.security.authc.providers:
+      basic.ldap1:
+        order: 0
+```
+
+Unless doing additional manifest configuration to automatically map, you will need to create a role mapping between an LLDAP role and an Elasticsearch role (e.g. `superuser`). This can be done by logging in using the default `elastic` user created during cluster init and then creating a role mapping in Stack Management. Once created, you will be able to login using LLDAP auth.
--- a/example_configs/gerrit.md
+++ b/example_configs/gerrit.md
@@ -0,0 +1,18 @@
+# Configuration for Gerrit
+
+Edit `gerrit.config`:
+```ini
+[auth]
+  type = ldap
+
+[ldap]
+  server = ldap://lldap:3890
+  supportAnonymous = false
+  username = uid=gerritadmin,ou=people,dc=example.com,dc=com
+  accountBase = ou=people,dc=example.com,dc=com
+  accountPattern = (uid=${username})
+  accountFullName = cn
+  accountEmailAddress = mail
+```
+
+The `supportAnonymous = false` must be set.
--- a/example_configs/gogs.md
+++ b/example_configs/gogs.md
@@ -0,0 +1,61 @@
+# Gogs LDAP configuration
+
+## Via Simple Auth (easier)
+
+Go to the Administration settings, then go to Authentication. There, you have to add an authentication source.
+
+For type, select "LDAP (Simple Auth)".
+Name your authentication source however you'd like. 
+It is up to you to select your security protocol, but the only two compatible options are "LDAPS" and "Unencrypted". 
+As your host, put in the IP or FQDN (if you have DNS).
+As your port, check your configuration. It will generally be 3890 for unencrypted (once again check your config/docker compose files), and 6360 for LDAPS (once again check your config/docker compose files).
+Your User DN should follow this pattern: `uid=%s,ou=people,<your_base_dn>` (for example, `uid=%s,ou=people,dc=example,dc=com`). Replace `<your_base_dn>` with your actual base DN.
+It is recommended to have your user filter to be `(&(objectClass=person)(uid=%s))`.
+Set username attribute to `uid`, Given Name to `givenName`, surname to `sn`, and email to `mail`
+
+You can (and should if you don't know LDAP) leave the rest empty.
+
+## Via Bind DN (more complicated)
+
+The following configuration is adapted from the example configuration at [their repository](https://github.com/gogs/gogs/blob/main/conf/auth.d/ldap_bind_dn.conf.example).
+The example is a container configuration - the file should live within `conf/auth.d/some_name.conf`:
+
+```yaml
+$ cat /srv/git/gogs/conf/auth.d/ldap_bind_dn.conf
+id           = 101
+type         = ldap_bind_dn
+name         = LDAP BindDN
+is_activated = true
+is_default   = true
+
+[config]
+host               = ldap.example.com
+port               = 6360
+# 0 - Unencrypted, 1 - LDAPS, 2 - StartTLS
+security_protocol  = 1
+# You either need to install the LDAPS certificate into your trust store -
+# Or skip verification altogether - for a restricted container deployment a sane default.
+skip_verify        = true
+bind_dn            = uid=<binduser>,ou=people,dc=example,dc=com
+bind_password      = `yourPasswordInBackticks`
+user_base          = dc=example,dc=com
+attribute_username = uid
+attribute_name     = givenName
+attribute_surname  = sn
+attribute_mail     = mail
+attributes_in_bind = false
+# restricts on the `user_base`.
+filter             = (&(objectClass=person)(uid=%s))
+# The initial administrator has to enable admin privileges.
+# This is only possible for users who were logged in once.
+# This renders the following filter obsolete; Though its response is accepted by Gogs.
+admin_filter       = (memberOf=cn=<yourAdminGroup>,ou=groups,dc=example,dc=com)
+```
+
+The `binduser` shall be a member of `lldap_strict_readonly`.
+The group `yourAdminGroup` should be adapted to your requirement - Otherwise the entire line can be omitted.
+The diamond brackets are for readability and are not required.
+
+## Tested on Gogs
+
+v0.14+dev via podman 4.3.1
--- a/example_configs/grafana_ldap_config.toml
+++ b/example_configs/grafana_ldap_config.toml
@@ -41,7 +41,14 @@ name = "displayName"
 surname = "sn"
 username = "uid"

-# If you want to map your ldap groups to grafana's groups, see: https://grafana.com/docs/grafana/latest/auth/ldap/#group-mappings
+# If you want to map your ldap groups to grafana's groups, configure the group query:
+# https://grafana.com/docs/grafana/latest/setup-grafana/configure-access/configure-authentication/ldap/#posix-schema
+# group_search_filter = "(&(objectClass=groupOfUniqueNames)(uniqueMember=%s))"
+# group_search_base_dns = ["ou=groups,dc=example,dc=com"]
+# group_search_filter_user_attribute = "uid"
+#
+# Then configure the groups:
+# https://grafana.com/docs/grafana/latest/setup-grafana/configure-access/configure-authentication/ldap/#group-mappings
 # As a quick example, here is how you would map lldap's admin group to grafana's admin
 # [[servers.group_mappings]]
 # group_dn = "cn=lldap_admin,ou=groups,dc=example,dc=org"
--- a/example_configs/lldap-ha-auth.sh
+++ b/example_configs/lldap-ha-auth.sh
@@ -64,7 +64,7 @@ if [[ ! -z "$2" ]] && ! jq -e '.groups|map(.displayName)|index("'"$2"'")' <<< $U
 	exit 1
 fi

-DISPLAY_NAME=$(jq -r .displayName <<< $USER_JSON)
+DISPLAY_NAME=$(jq -r '.displayName // .id' <<< $USER_JSON)

 IS_ADMIN=false
 if [[ ! -z "$3" ]] && jq -e '.groups|map(.displayName)|index("'"$3"'")' <<< "$USER_JSON" > /dev/null 2>&1; then
@@ -88,4 +88,4 @@ if [[ "$IS_LOCAL" = true ]]; then
 	echo "local_only = true"
 else
    echo "local_only = false"
-fi
+fi
--- a/example_configs/mailserver.md
+++ b/example_configs/mailserver.md
@@ -58,9 +58,9 @@ services:
      - LDAP_SEARCH_BASE=ou=people,dc=example,dc=com
      - LDAP_BIND_DN=uid=admin,ou=people,dc=example,dc=com
      - LDAP_BIND_PW=adminpassword
-      - LDAP_QUERY_FILTER_USER=(&(objectClass=inetOrgPerson)(|(uid=%u)(mail=%u)))
+      - LDAP_QUERY_FILTER_USER=(&(objectClass=inetOrgPerson)(mail=%s))
      - LDAP_QUERY_FILTER_GROUP=(&(objectClass=groupOfUniqueNames)(uid=%s))
-      - LDAP_QUERY_FILTER_ALIAS=(&(objectClass=inetOrgPerson)(|(uid=%u)(mail=%u)))
+      - LDAP_QUERY_FILTER_ALIAS=(&(objectClass=inetOrgPerson)(mail=%s))
      - LDAP_QUERY_FILTER_DOMAIN=(mail=*@%s)
      # <<< Postfix LDAP Integration
      # >>> Dovecot LDAP Integration
@@ -78,7 +78,8 @@ services:
    container_name: roundcubemail
    restart: always
    volumes:
-      - roundcube_data:/var/www/html
+      - roundcube_config:/var/roundcube/config
+      - roundcube_plugins:/var/www/html/plugins
    ports:
      - "9002:80"
    environment:
@@ -86,12 +87,15 @@ services:
      - ROUNDCUBEMAIL_SKIN=elastic
      - ROUNDCUBEMAIL_DEFAULT_HOST=mailserver # IMAP
      - ROUNDCUBEMAIL_SMTP_SERVER=mailserver # SMTP
+      - ROUNDCUBEMAIL_COMPOSER_PLUGINS=roundcube/carddav
+      - ROUNDCUBEMAIL_PLUGINS=carddav

 volumes:
  mailserver-data:
  mailserver-config:
  mailserver-state:
  lldap_data:
-  roundcube_data:
+  roundcube_config:
+  roundcube_plugins:

 ```
--- a/example_configs/open-webui.md
+++ b/example_configs/open-webui.md
@@ -0,0 +1,31 @@
+# Open-WebUI LDAP configuration
+
+For the GUI settings (recommended) go to:
+`Admin Panel > General`.
+There you find the LDAP config.
+
+For the initial activation, restart OpenWebUI to load the LDAP module.
+
+The following configurations have to be provided.
+The user `binduser` has to be member of `lldap_strict_readonly`.
+
+| environment variable | GUI variable | example value | elaboration |
+|----------------------|--------------|---------------|-------------|
+| `ENABLE_LDAP` | LDAP | `true` | Toggle |
+| `LDAP_SERVER_LABEL` | Label | `any` (lldap) | name |
+| `LDAP_SERVER_HOST` | Host | `ldap.example.org` | IP/domain without scheme or port |
+| `LDAP_SERVER_PORT` | Port | `6360` | When starting Open-WebUI sometimes it only accepts the default LDAP or LDAPS port (only ENV configuration) |
+| `LDAP_ATTRIBUTE_FOR_MAIL` | Attribute for Mail | `mail` | default |
+| `LDAP_ATTRIBUTE_FOR_USERNAME` | Attribute for Username | `uid` | default |
+| `LDAP_APP_DN` | Application DN | `uid=binduser,ou=people,dc=example,dc=org` | Hovering shows: Bind user-dn |
+| `LDAP_APP_PASSWORD` | Application DN Password | `<binduser-pw>` | - |
+| `LDAP_SEARCH_BASE` | Search Base | `ou=people,dc=example,dc=org` | Who should get access from your instance. |
+| `LDAP_SEARCH_FILTER` | Search Filter | `(objectClass=person)` or `(\|(objectClass=person)(memberOf=cn=webui-members,ou=groups,dc=example,dc=org))` | Query for Open WebUI account names. |
+| `LDAP_USE_TLS` | TLS | `true` | Should be `true` for LDAPS, `false` for plain LDAP |
+| `LDAP_CA_CERT_FILE` | Certificate Path | `/ca-chain.pem` | required when TLS activated |
+| `LDAP_VALIDATE_CERT` | Validate Certificate | `true` | Set to `false` for self-signed certificates |
+| `LDAP_CIPHERS` | Ciphers | ALL | default |
+
+## Tested on Open WebUI
+
+v0.6.26 via podman 5.4.2
--- a/example_configs/opencloud.md
+++ b/example_configs/opencloud.md
@@ -0,0 +1,55 @@
+# OpenCloud example config
+
+
+## About OpenCloud
+
+A light-weight file-hosting / webDAV service written in Go and forked from ownCloud Infinite Scale (oCIS).
+
+More information:
+  * https://opencloud.eu
+  * https://github.com/opencloud-eu
+
+
+## LLDAP Configuration
+
+OpenCloud ships an OIDC provider and a built-in LDAP server. It officially supports using a third-party OIDC provider.
+
+This is **not** what this config does. This config leaves the general auth/OIDC infrastructure in place, but replaces the LDAP server from underneath it with LLDAP.
+
+Configuration happens via environment variables. On FreeBSD, these are provided via `/usr/local/etc/opencloud/config.env`; on Linux you can provide them via the Docker configuration.
+
+
+```dotenv
+# Replace with actual IP and Port
+OC_LDAP_URI=ldap://<lldap_ip>:3890
+# Remove the following if you use LDAPS and your cert is not self-signed
+OC_LDAP_INSECURE="true"
+
+# Replace with your bind-user; can be in
+OC_LDAP_BIND_DN="cn=<bind_user>,ou=people,dc=example,dc=com"
+OC_LDAP_BIND_PASSWORD="<secret>"
+
+OC_LDAP_GROUP_BASE_DN="ou=groups,dc=example,dc=com"
+OC_LDAP_GROUP_SCHEMA_ID=entryuuid
+
+OC_LDAP_USER_BASE_DN="ou=people,dc=example,dc=com"
+OC_LDAP_USER_SCHEMA_ID=entryuuid
+
+# Only allow users from specific group to login; remove this if everyone's allowed
+OC_LDAP_USER_FILTER='(&(objectClass=person)(memberOf=cn=<opencloud_users>,ou=groups,dc=example,dc=com))'
+
+# Other options have not been tested
+OC_LDAP_DISABLE_USER_MECHANISM="none"
+
+# If you bind-user is in lldap_strict_readonly set to false (this hides "forgot password"-buttons)
+OC_LDAP_SERVER_WRITE_ENABLED="false"
+# If your bind-user can change passwords:
+OC_LDAP_SERVER_WRITE_ENABLED="true"       # Not tested, yet!
+
+# Don't start built-in LDAP, because it's replaced by LLDAP
+OC_EXCLUDE_RUN_SERVICES="idm"
+```
+
+There is currently no (documented) way to give an LDAP user (or group) admin rights in OpenCloud.
+
+See also [the official LDAP documentation](https://github.com/opencloud-eu/opencloud/blob/main/devtools/deployments/opencloud_full/ldap.yml).
--- a/example_configs/opnsense.md
+++ b/example_configs/opnsense.md
@@ -92,6 +92,9 @@ Enable the following options on the OPNsense configuration page for your LLDAP s
 - Synchronize groups: `Checked`
 - Automatic user creation: `Checked`

+### Constraint Groups
+This limits the groups to prevent injection attacks. If you want to enable this feature, you need to add ou=groups,dc=example,dc=com to the Authentication Containers field. Be sure to separate with a semicolon. Otherwise disable this option.
+
 ### Create OPNsense Group

 Go to `System > Access > Groups` and create a new group with the **same** name as the LLDAP group used to authenticate users for OPNsense.
--- a/example_configs/pam/README.md
+++ b/example_configs/pam/README.md
@@ -1,40 +1,55 @@
 # Getting Started with UNIX PAM using SSSD

+This guide was tested with LDAPS on debian 12 with SSSD 2.8.2 and certificates signed by a registered CA.
+
 ## Configuring LLDAP

 ### Configure LDAPS

-You **must** use LDAPS. You MUST NOT use plain LDAP. Even over a private network this costs you nearly nothing, and passwords will be sent in PLAIN TEXT without it.
+Even in private networks you **should** configure LLDAP to communicate over HTTPS, otherwise passwords will be
+transmitted in plain text. Just using a self-signed certificate will drastically improve security.

-```jsx
+You can generate an SSL certificate for LLDAP with the following command. The `subjectAltName` is **required**. Make
+sure all domains are listed there, even your `CN`.
+
+```bash
+openssl req -x509 -nodes -newkey rsa:4096 -keyout key.pem -out cert.pem -sha256 -days 36500 -subj "/CN=ldap.example.com" -addext "subjectAltName = DNS:ldap.example.com"
+```
+
+With the generated certificates for your domain, copy the certificates and enable ldaps in the LLDAP configuration.
+
+```
 [ldaps_options]
 enabled=true
-port=6360
+port=636
 cert_file="cert.pem"
 key_file="key.pem"
 ```

-You can generate an SSL certificate for it with the following command. The `subjectAltName` is REQUIRED. Make sure all domains are listed there, even your `CN`.
+### Setting up custom attributes

-```bash
-openssl req -x509 -nodes -newkey rsa:4096 -keyout key.pem -out cert.pem -sha256 -days 36500 -nodes -subj "/CN=lldap.example.net" -addext "subjectAltName = DNS:lldap.example.net"
-```
+SSSD makes use of the `posixAccount` and `sshPublicKey` object types, their attributes have to be created manually in
+LLDAP.

-### Setting up the custom attributes
+Add the following custom attributes to the **User schema**.

-You will need to add the following custom attributes to the **user schema**.
+| Attribute     | Type    | Multiple | Example    |
+|---------------|---------|:--------:|------------|
+| uidNumber     | integer |          | 3000       |
+| gidNumber     | integer |          | 3000       |
+| homeDirectory | string  |          | /home/user |
+| unixShell     | string  |          | /bin/bash  |
+| sshPublicKey  | string  |    X     | *sshKey*   |

- uidNumber (integer)
- gidNumber (integer, multiple values)
- homeDirectory (string)
- unixShell (string)
- sshPublicKey (string) (only if you’re setting up SSH Public Key Sync)
+Add the following custom attributes to the **Group schema.**

-You will need to add the following custom attributes to the **group schema.**
+| Attribute     | Type    | Multiple | Example    |
+|---------------|---------|:--------:|------------|
+| gidNumber     | integer |          | 3000       |

- gidNumber (integer)
-
-You will now need to populate these values for all the users you wish to be able to login.
+The only optional attributes are `unixShell` and `sshPublicKey`. All other attributes **must** be fully populated for
+each group and user being used by SSSD. The `gidNumber` of the user schema represents the users primary group. To add
+more groups to a user, add the user to groups with a `gidNumber` set.

 ## Client setup

@@ -45,25 +60,113 @@ You need to install the packages `sssd` `sssd-tools` `libnss-sss` `libpam-sss` `
 E.g. on Debian/Ubuntu

 ```bash
-sudo apt update; sudo apt install -y sssd sssd-tools libnss-sss libpam-sss libsss-sudo
+sudo apt install -y sssd sssd-tools libnss-sss libpam-sss libsss-sudo
 ```

 ### Configure the client packages

-Use your favourite text editor to create/open the file `/etc/sssd/sssd.conf` .
+This example makes the following assumptions which need to be adjusted:

-E.g. Using nano
+* Domain: `example.com`
+* Domain Component: `dc=example,dc=com`
+* LDAP URL: `ldaps://ldap.example.com/`
+* Bind Username: `binduser`
+* Bind Password: `bindpassword`
+
+The global config filters **out** the root user and group. It also restricts the number of failed login attempts
+with cached credentials if the server is unreachable.
+
+Use your favourite text editor to create the SSSD global configuration:

 ```bash
 sudo nano /etc/sssd/sssd.conf
 ```

-Insert the contents of the provided template (sssd.conf), but you will need to change some of the configuration in the file. Comments have been made to guide you. The config file is an example if your LLDAP server is hosted at `lldap.example.com` and your domain is `example.com` with your dc being `dc=example,dc=com`.
+```
+[sssd]
+config_file_version = 2
+services = nss, pam, ssh
+domains = example.com

-SSSD will **refuse** to run if it’s config file is world-readable, so apply the following permissions to it:
+[nss]
+filter_users = root
+filter_groups = root
+
+[pam]
+offline_failed_login_attempts = 3
+offline_failed_login_delay = 5
+
+[ssh]
+```
+
+The following domain configuration is set up for the LLDAP `RFC2307bis` schema and the custom attributes created at the
+beginning of the guide. It allows all configured LDAP users to log in by default while filtering out users and groups
+which don't have their posix IDs set.
+
+Because caching is enabled make sure to check the [Debugging](#Debugging) section on how to
+flush the cache if you are having problems.
+
+Create a separate configuration file for your domain.
+
+```bash
+sudo nano /etc/sssd/conf.d/example.com.conf
+```
+
+```
+[domain/example.com]
+id_provider = ldap
+auth_provider = ldap
+chpass_provider = ldap
+access_provider = permit
+
+enumerate = True
+cache_credentials = True
+
+# ldap provider
+ldap_uri = ldaps://ldap.example.com/
+ldap_schema = rfc2307bis
+ldap_search_base = dc=example,dc=com
+
+ldap_default_bind_dn = uid=binduser,ou=people,dc=example,dc=com
+ldap_default_authtok = bindpassword
+
+# For certificates signed by a registered CA
+ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt
+# For self signed certificates
+# ldap_tls_cacert = cert.pem
+ldap_tls_reqcert = demand
+
+# users
+ldap_user_search_base = ou=people,dc=example,dc=com?subtree?(uidNumber=*)
+ldap_user_object_class = posixAccount
+ldap_user_name = uid
+ldap_user_gecos = cn
+ldap_user_uid_number = uidNumber
+ldap_user_gid_number = gidNumber
+ldap_user_home_directory = homeDirectory
+ldap_user_shell = unixShell
+ldap_user_ssh_public_key = sshPublicKey
+
+# groups
+ldap_group_search_base = ou=groups,dc=example,dc=com?subtree?(gidNumber=*)
+ldap_group_object_class = groupOfUniqueNames
+ldap_group_name = cn
+ldap_group_gid_number = gidNumber
+ldap_group_member = uniqueMember
+```
+
+SSSD will **refuse** to run if its config files have the wrong permissions, so apply the following permissions to the
+files:

 ```bash
 sudo chmod 600 /etc/sssd/sssd.conf
+sudo chmod 600 /etc/sssd/conf.d/example.com.conf
+```
+
+Enable automatic creation of home directories:
+
+```bash
+sudo pam-auth-update --enable mkhomedir
 ```

 Restart SSSD to apply any changes:
@@ -72,26 +175,11 @@ Restart SSSD to apply any changes:
 sudo systemctl restart sssd
 ```

-Enable automatic creation of home directories
-```bash
-sudo pam-auth-update --enable mkhomedir
-```
-
 ## Permissions and SSH Key sync

 ### SSH Key Sync

-In order to do this, you need to setup the custom attribute `sshPublicKey` in the user schema. Then, you must uncomment the following line in the SSSD config file (assuming you are using the provided template):
-
-```bash
-sudo nano /etc/sssd/sssd.conf
-```
-
-```jsx
-ldap_user_ssh_public_key = sshPublicKey
-```
-
-And the following to the bottom of your OpenSSH config file:
+Add the following to the bottom of your OpenSSH config file:

 ```bash
 sudo nano /etc/ssh/sshd_config
@@ -111,11 +199,15 @@ sudo systemctl restart sssd

 ### Permissions Sync

-Linux often manages permissions to tools such as Sudo and Docker based on group membership. There are two possible ways to achieve this. 
+Linux often manages permissions to tools such as Sudo and Docker based on group membership. There are two possible ways 
+to achieve this. 

-**Number 1**
+**Option 1**

-**If all your client systems are setup identically,** you can just check the group id of the local group, i.e. Sudo being 27 on most Debian and Ubuntu installs, and set that as the gid in LLDAP. For tools such as docker, you can create a group before install with a custom gid on the system, which must be the same on all, and use that GID on the LLDAP group
+**If all your client systems are set up identically,** you can just check the group id of the local group, i.e. `sudo`
+being 27 on most Debian and Ubuntu installs, and set that as the gid in LLDAP. 
+For tools such as docker, you can create a group before install with a custom gid on the system, which must be the same
+on all, and use that GID on the LLDAP group

 Sudo

@@ -123,15 +215,16 @@ Sudo

 Docker

-```jsx
+```bash
 sudo groupadd docker -g 722
 ```

 ![image](https://github.com/user-attachments/assets/face88d0-5a20-4442-a5e3-9f6a1ae41b68)

-**Number 2**
+**Option 2**

-Create a group in LLDAP that you would like all your users who have sudo access to be in, and add the following to the bottom of `/etc/sudoers` . 
+Create a group in LLDAP that you would like all your users who have sudo access to be in, and add the following to the
+bottom of `/etc/sudoers` . 

 E.g. if your group is named `lldap_sudo`

@@ -143,15 +236,21 @@ E.g. if your group is named `lldap_sudo`

 To verify your config file’s validity, you can run the following command

-```jsx
+```bash
 sudo sssctl config-check
 ```

 To flush SSSD’s cache

-```jsx
+```bash
 sudo sss_cache -E
 ```

+Man pages
+```bash
+man sssd
+man sssd-ldap
+```
+
 ## Final Notes
 To see the old guide for NSLCD, go to NSLCD.md.
--- a/example_configs/pocket-id.md
+++ b/example_configs/pocket-id.md
@@ -0,0 +1,27 @@
+# LLDAP Configuration for Pocket-ID 
+
+[Pocket-ID](https://pocket-id.org/) is a simple, easy-to-use OIDC provider that lets users authenticate to your services using passkeys.
+
+|               |                         | Value                                                       |
+|-----------------------|------------------------------------|-----------------------------------------------------------|
+| **Client Configuration** | LDAP URL                           | ldaps://url:port                               
+|                       | LDAP Bind DN                       | uid=binduser,ou=people,dc=example,dc=com              |
+|                       | LDAP Bind Password                 | password for binduser                      |
+|                       | LDAP Base DN                       | dc=example,dc=com                                         |
+|                       | User Search Filter                 | (objectClass=person)                                      |
+|                       | Groups Search Filter               | (objectClass=groupOfNames)                                |
+|                       | Skip Certificate Verification      | true/false                                                 |
+|                       | Keep disabled users from LDAP      | false                                               |
+| **Attribute Mapping** | User Unique Identifier Attribute   | uuid                                                      |
+|                       | Username Attribute                 | uid                                                       |
+|                       | User Mail Attribute                | mail                                                      |
+|                       | User First Name Attribute          | givenName                                                 |
+|                       | User Last Name Attribute           | sn                                                        |
+|                       | User Profile Picture Attribute     | jpegPhoto                                                 |
+|                       | Group Members Attribute            | member                                                    |
+|                       | Group Unique Identifier Attribute  | uuid                                                      |
+|                       | Group Name Attribute               | cn                                                        |
+|                       | Admin Group Name                   | pocketid_admin_group_name                                            |
+
+
+Save and Sync.
--- a/example_configs/podman-quadlets/readme.md
+++ b/example_configs/podman-quadlets/readme.md
@@ -31,13 +31,13 @@ Starting `lldap.service` will start all the other services, but stopping it will
 - At this point, you should be able to start the container.
    - Test this with:
    ```bash
-        $ podman --user daemon-reload
-        $ podman --user start lldap
-        $ podman --user status lldap
+        $ systemctl --user daemon-reload
+        $ systemctl --user start lldap
+        $ systemctl --user status lldap
    ```
    - Assuming it launched correctly, you should now stop it again.
    ```bash
-        $ podman --user stop lldap
+        $ systemctl --user stop lldap
    ```
 - Make any adjustments you feel are necessary to the network files.
 - Now all that's left to do is the [bootstrapping process](../bootstrap/bootstrap.md#docker-compose):
@@ -45,8 +45,8 @@ Starting `lldap.service` will start all the other services, but stopping it will
    - Toward the end of the container section, uncomment the lines in `lldap.container` regarding the bootstrap process.
    - Start the container:
        ```bash
-        $ podman --user daemon-reload
-        $ podman --user start lldap
+        $ systemctl --user daemon-reload
+        $ systemctl --user start lldap
        ```
    - Attach a terminal to the container, and run `bootstrap.sh`:
        ```bash
--- a/example_configs/portainer.md
+++ b/example_configs/portainer.md
@@ -56,9 +56,15 @@ ou=groups,dc=example,dc=com
 ```
 #### Group Membership Attribute
 ```
-cn
+uniqueMember
 ```
 #### Group Filter 
+Is optional:
 ```
-is optional
+(objectClass=groupofuniquenames)
 ```
+
+## Admin group search configurations 
+
+Use the same configurations as above to grant each users admin rights in their respective teams.
+You can then also fetch all groups, and select which groups have universal admin rights.
--- a/example_configs/semaphore.md
+++ b/example_configs/semaphore.md
@@ -0,0 +1,37 @@
+# Configuration for Semaphore
+
+Semaphore configuration is in `config.json`
+
+Just add the following lines:
+```json
+  "ldap_enable": true,
+  "ldap_needtls": true,
+  "ldap_server": "ldaps_server:6360",
+  "ldap_binddn": "uid=semaphorebind,ou=people,dc=example,dc=com",
+  "ldap_bindpassword": "verysecretpassword",
+  "ldap_searchdn": "ou=people,dc=example,dc=com",
+  "ldap_searchfilter": "(|(uid=%[1]s)(mail=%[1]s))",
+  "ldap_mappings": {
+    "dn": "dn",
+    "mail": "mail",
+    "uid": "uid",
+    "cn": "cn"
+  }
+```
+
+If you use environment variables:
+```bash
+Environment=SEMAPHORE_LDAP_ENABLE=true
+Environment=SEMAPHORE_LDAP_SERVER="ldaps_server:6360"
+Environment=SEMAPHORE_LDAP_NEEDTLS=true
+Environment=SEMAPHORE_LDAP_BIND_DN="uid=semaphorebind,ou=people,dc=example,dc=com"
+Environment=SEMAPHORE_LDAP_BIND_PASSWORD="verysecretpassword"
+Environment=SEMAPHORE_LDAP_SEARCH_DN="ou=people,dc=example,dc=com"
+Environment=SEMAPHORE_LDAP_SEARCH_FILTER="(|(uid=%[1]s)(mail=%[1]s))"
+Environment=SEMAPHORE_LDAP_MAPPING_UID="uid"
+Environment=SEMAPHORE_LDAP_MAPPING_CN="cn"
+Environment=SEMAPHORE_LDAP_MAPPING_MAIL="mail"
+Environment=SEMAPHORE_LDAP_MAPPING_DN="dn"
+```
+
+You can log in with username or email.
--- a/example_configs/stalwart.md
+++ b/example_configs/stalwart.md
@@ -48,3 +48,13 @@ To integrate with LLDAP,
      allow-invalid-certs = true
      enable = false
 ```
+
+## Email alias
+If you want to enable [email aliases](https://stalw.art/docs/mta/inbound/rcpt/#catch-all-addresses), you have to create a new *User-defined attribute* under *User schema* of type string. Currently, LLDAP doesn't support multi-value filters. If you want multiple aliases, you will have to create multiple attributes (`mailAlias1`, `mailAlias2`, ..., `mailAliasN`), where `N` is the maximum number of aliases an account will have.
+
+You also need to change your ldap filter for emails.
+```toml
+[directory.ldap.filter]
+# Add one clause per alias attribute you created (example: mailAlias1..mailAlias3)
+email = "(&(objectclass=person)(|(mail=?)(mailAlias1=?)(mailAlias2=?)(mailAlias3=?)))"
+```
--- a/example_configs/truenas-install.md
+++ b/example_configs/truenas-install.md
@@ -0,0 +1,126 @@
+# Installing and Configuring LLDAP on TrueNAS
+
+This guide walks through installing **LLDAP** from the TrueNAS Apps catalog and performing a basic configuration suitable for sharing authentication between multiple applications that support LDAP authentication.
+
+It is intended to accompany the example configuration files in this repository and assumes a basic familiarity with the TrueNAS web interface.
+
+## Prerequisites
+
+- TrueNAS SCALE with Apps enabled
+- Administrative access to the TrueNAS UI
+- A system with working networking and DNS
+- Optional but recommended: HTTPS certificates managed by TrueNAS
+
+## Step 1: Install LLDAP from the TrueNAS Apps Catalog
+
+1. Log in to the **TrueNAS web interface**.
+2. Navigate to **Apps → Discover Apps**.
+3. Search for **LLDAP**.
+4. Click **Install**.
+
+You will be presented with the LLDAP application configuration form.
+
+## Step 2: Application Configuration
+
+Below are the key configuration sections and recommended settings based on the official catalog definition.
+
+### Application Name
+
+- Leave the default name or choose a descriptive one (e.g. `lldap`).
+
+### Networking
+
+- **Web Port**: Default application port is typically **30325**. There is no standard port for the LLDAP web UI; this value is configurable in TrueNAS.
+- **LDAP Port**:
+  - Standard LDAP port: **389**
+  - Default port configured by the TrueNAS app: **30326**
+- **LDAPS Port**:
+  - Standard LDAPS port: **636**
+  - Default port configured by the TrueNAS app: **30327**
+
+It is recommended to adjust these ports to suit your environment. Using standard ports (389/636) can simplify client configuration, but non-standard ports may be preferred to avoid conflicts on the host system. Ensure the selected ports are not already in use.
+
+If LDAPS is enabled, it is strongly recommended to **disable the LDAP port** to ensure all directory traffic is encrypted.
+
+### Authentication / Admin Account
+
+- **LLDAP Admin Username**: Set an admin username (e.g. `admin`).
+- **LLDAP Admin Password**: Set a strong password. This account is used to access the LLDAP web UI.
+
+> ⚠️ Save this password securely. You will need it to log in and manage users and groups.
+
+### Base DN Configuration
+
+These values define your LDAP directory structure:
+
+- **Base DN**: Example: `dc=example,dc=com`
+- **User DN**: Typically `ou=people,dc=example,dc=com`
+- **Group DN**: Typically `ou=groups,dc=example,dc=com`
+
+These values must be consistent with the configuration used by client applications.
+
+## Step 3: Storage Configuration
+
+LLDAP requires persistent storage for its database.
+
+- Configure an **application dataset** or **host path** for LLDAP data.
+- Ensure the dataset is backed up as part of your normal TrueNAS backup strategy.
+
+## Step 4: (Optional) Enable HTTPS Using TrueNAS Certificates
+
+If your TrueNAS system manages certificates:
+
+1. In the app configuration, select **Use Existing Certificate**.
+2. Choose a certificate issued by TrueNAS.
+3. Ensure the web port is accessed via `https://`.
+
+This avoids storing certificate files inside the container and improves overall security.
+
+## Step 5: Deploy the App
+
+1. Review all configuration values.
+2. Click **Install**.
+3. Wait for the application status to show **Running**.
+
+## Step 6: Access the LLDAP Web UI
+
+- Navigate to: `http(s)://<truenas-ip>:<web-port>`
+- Log in using the admin credentials you configured earlier.
+
+From here you can:
+- Create users
+- Create groups
+- Assign users to groups
+
+## Step 7: Using LLDAP with Other Applications
+
+LLDAP can be used as a central identity provider for many popular applications available in the TrueNAS Apps catalog. Common examples include:
+
+- **Jellyfin** (media server)
+- **Nextcloud** (collaboration and file sharing)
+- **Gitea** (self-hosted Git service)
+- **Grafana** (monitoring and dashboards)
+- **MinIO** (object storage)
+
+Configuration examples for several of these applications are also available in the upstream LLDAP repository under `example_configs`.
+
+When configuring a client application:
+
+- **LDAP Host**: TrueNAS IP address or the LLDAP app service name
+- **LDAP / LDAPS Port**: As configured during install (prefer LDAPS if enabled)
+- **Bind DN**: A dedicated service (bind) account or admin DN
+- **Bind Password**: Password for the bind account
+- **Base DN**: Must match the LLDAP Base DN
+
+Once configured, users can authenticate to multiple applications using a single set of credentials managed centrally by LLDAP.
+
+## Notes and Tips
+
+- Prefer creating a **dedicated bind user** for applications instead of using the admin account.
+- Keep Base DN values consistent across all services.
+- Back up the LLDAP dataset regularly.
+
+## References
+
+- [TrueNAS Apps Catalog](https://apps.truenas.com/catalog/lldap/)
+- [TrueNAS SCALE Documentation](https://www.truenas.com/docs/scale/)
--- a/example_configs/udm_identity_end_point.md
+++ b/example_configs/udm_identity_end_point.md
@@ -30,7 +30,7 @@ Unique Identifier Attribute - entryUUID
 - Group Object Filter - objectClass=groupOfUniqueNames 

 Member Attribute   
-member 
+uniqueMember 

 Validate Attribute   
 enter a user e-mail address who has been added in LLDAP , and click test configuration, test show be successful 
--- a/flake.lock
+++ b/flake.lock
@@ -0,0 +1,98 @@
+{
+  "nodes": {
+    "crane": {
+      "locked": {
+        "lastModified": 1757183466,
+        "narHash": "sha256-kTdCCMuRE+/HNHES5JYsbRHmgtr+l9mOtf5dpcMppVc=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "d599ae4847e7f87603e7082d73ca673aa93c916d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1757487488,
+        "narHash": "sha256-zwE/e7CuPJUWKdvvTCB7iunV4E/+G0lKfv4kk/5Izdg=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "ab0f3607a6c7486ea22229b92ed2d355f1482ee0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "crane": "crane",
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs",
+        "rust-overlay": "rust-overlay"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1757730403,
+        "narHash": "sha256-Jxl4OZRVsXs8JxEHUVQn3oPu6zcqFyGGKaFrlNgbzp0=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "3232f7f8bd07849fc6f4ae77fe695e0abb2eba2c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
--- a/Show More
+++ b/Show More