godap browses and edits a directory from a terminal

A directory tree in a terminal window

godap describes itself as a complete terminal user interface for LDAP, and the design goal is visible in the feature list. The tree explorer is fast and loads objects on demand, so you are not waiting for a directory with a million objects to be enumerated before you can look at one. The attribute rendering is also deliberate rather than raw, since the tool formats date and time, boolean and other categorical attributes into readable text, and the presentation is described as pretty colors and cool emojis, with an option to prefix objects with an emoji. Underneath, the interface is built on tview with tcell for the terminal, and the command line is cobra with pflag, which is why the flags are consistent and why the tool has a subcommand and keybinding surface rather than only configuration files. The directory layout in the repository matches the shape, with a tui/ directory for the interface, a pkg/ directory for the rest and godap.go at the root.

Audit surfaces, not just a browser

The parts of the feature list that go beyond reading are the reason to use a purpose built tool instead of a script. There is an interactive userAccountControl editor, which is where the account flags live, and an interactive DACL viewer and editor for the access control list. There is an interactive ADIDNS viewer and editor, described as basic, for the DNS records an Active Directory environment publishes. There is a GPO viewer for the group policy objects that would otherwise need a different tool entirely. Objects can be created, edited and removed, including their attributes, and they can be moved and renamed, so the tool is not read-only. There is also a search for deleted and recycled objects, which matters when you are reconstructing what happened, and an export of specific subtrees of the directory into JSON files, which is how you snapshot a branch for later analysis. Group members and user groups lookups are described as flexible, and a recursive object search comes with useful saved searches.

Every bind mechanism on the command line

The authentication surface is the widest part of the tool, and it is the part an operator will actually type. The simple case binds with a username and password and a domain:

$ godap <hostname or IP> -u <username> -p <password> -d <domain>

By default, the username and password flags perform an NTLM bind, and adding the simple flag forces a simple LDAP bind instead. A username can also be given in the user at domain form. An NT hash can be used directly for a pass-the-hash bind with the hash flag, and Kerberos is selected with the kerberos flag and accepts any of several credential types, or none at all to use an existing CCACHE through KRB5CCNAME. The documented Kerberos options are a CCACHE, a password, an NT hash, a hex encoded AES128 or AES256 key:

$ godap <hostname or IP> -k -u <username> --aes-key <key> -d <domain>

and PKINIT with a client certificate, plus a PEM certificate and key or a PKCS#12 file for SChannel style certificate authentication. An anonymous bind needs no flags at all.

Switching auth and TLS from inside the app

One of the more useful design decisions is that every bind method can also be selected and edited from inside the running tool. You open the connection settings panel with the l key, pick a mechanism from the Auth Type dropdown, where the choices are Simple Bind, NTLM, Kerberos and Certificate, fill in the credential fields you want, and reconnect with the Update button. Each mechanism page shows all of its credentials at once, so the Kerberos page has fields for CCACHE, password, NT hash, AES key and a client certificate together, and the tool picks the strongest one you have filled in using the same precedence as the command line flags, which is AES key over NT hash over password over CCACHE, with a client certificate taking priority for PKINIT. TLS is handled in the same panel, where you can change the port, toggle LDAPS and set the IgnoreCert value, and reconnect with Ctrl plus r. StartTLS is a keybinding, Ctrl plus u, and the certificate bypass is the -I flag.

Flags that change what you see

The flag list is where you control the shape of the session. The username and password flags are the obvious ones, and the passfile flag takes a path to a file containing the password, or a dash for standard input, which is the difference between a password on the command line, which ends up in your shell history, and one that is not. The port flag sets a custom port, defaulting to 389 or 636 when LDAPS is provided. The rootDN flag sets the initial root distinguished name, with automatic as the default, and the filter flag sets the initial LDAP search filter, defaulting to objectClass equals everything. The backend flag chooses the flavor of the server, msad, basic or auto, which is how the tool decides whether to expose Active Directory specific behaviour. The emojis flag prefixes objects with an emoji. The SOCKS flag takes a schema colon slash slash address, where the schema is socks4, socks4a or socks5, so a connection can be tunnelled through a proxy, and the proxy address can also be changed later with the settings panel.

Install it with go install

Building from source is three commands:

$ git clone https://github.com/Macmod/godap
$ cd godap
$ go install .

The module path is versioned as github.com/Macmod/godap/v2 and the Go version required is 1.24.1. There are also packaged builds, listed in a table with the maintainer of each, with Homebrew, the Alpine Linux community repository and the Arch User Repository all providing working releases, and the documentation points at Repology for the wider picture. The advice attached to that list is worth repeating. Remember to check the version before using these packages, as some of them might not always be up to date, and in case you need the latest features the project also provides automated releases for several platforms. The last point is the practical one for a security tool, because a packaged version that lags a release behind can be missing the authentication change you need.

The Go stack behind the interface

The dependency list is a good map of what the tool has to implement itself. The LDAP protocol is handled by go-ldap, with the go-asn1-ber package for encoding, and Kerberos comes from the gokrb5 family with the AES and identity packages that the key and PKINIT options need. The adauth package from RedTeamPentesting provides the NTLM side, and the Azure go-ntlmssp and vadimi go-ntlm packages appear as indirect dependencies of that. Certificates are handled through go-pkcs12, and SOCKS through h12.io/socks. The interface is tview on top of tcell, and the command line is cobra with pflag. The release history is brisk, with v2.12.2 and v2.12.1 both published on 2026-08-21 and v2.12.0 on 2026-08-16, and the last push on 2026-08-21, so the tool is actively worked on. The licence is MIT, the repository has a TODO.md at the root, and the README closes with a disclaimers section that is worth reading before you point it at a production directory.

Editorial conclusion

godap fits a directory administrator or a security engineer who has to inspect or change objects on a server that has no browser access, since a terminal client works over SSH and the tree loads objects on demand rather than pulling the whole directory. It does not fit a Windows administrator who wants a point and click tool, since a TUI is slower to drive with a mouse, and it does not fit a policy that forbids pass-the-hash style binds, because the NTLM hash flag and the NT hash field in the Kerberos page are features rather than accidents. Before you use it, check whether the server certificate is trusted on the machine you run it from, since the ignore certificate option exists for a reason, and note that the project is MIT licensed, the last push was on 2026-08-21 and the newest release is v2.12.2 from the same day.

Frequently asked questions

Official sources

1. Issues
2. License: MIT
3. Macmod/godap on GitHub
4. README
5. Releases