Steward

Delegated Active Directory administration for MSPs. Steward is a small, secure web console in which your technicians and your clients' power users manage user accounts (and groups and computers) in the OUs they are delegated: search, edit, reset a password, unlock, onboard a new hire, offboard a leaver. Nobody needs a domain controller session, ADUC, RSAT or an admin account.

One independent instance per client, running as Docker containers on a small Linux server at that client. No Entra ID, Azure AD or Microsoft Graph: Steward talks LDAPS to the client's own domain controllers.

Quick start: Steward for a client in 15 minutes How it is secured

Why Steward

• Least privilege by construction. Operators sign in with their own, non-privileged AD account (or through Teleport) and can only do what a delegation allows, on the OUs it covers. The console's own service accounts hold only the AD rights the delegation script grants them. Tier 0/1 accounts and privileged groups are never touched.
• Two independent authorizations. An action happens only if Steward's delegation model allows it (action, attribute, OU) and Active Directory allows the console's service account to do it. A bug or a misconfiguration on one side is caught by the other.
• Built for MSPs. One console per client, nothing shared between clients, a control plane (Tenantry) that watches the whole fleet, Teleport single sign-on for technicians, baselines to configure every console the same way.
• Everything is audited. A tamper-evident audit chain records who did what, with the ticket number, and can be forwarded to the client's log platform.
• Easy to run. One install script (guided or scripted), a browser setup wizard, a publicly trusted HTTPS certificate renewed automatically, backups in one command.

Architecture

flowchart LR
  subgraph msp["MSP"]
    tech["Technicians"]
    tenantry["Tenantry<br/>(control plane)"]
    tp["Teleport<br/>(SSO, MFA, audit)"]
  end
  subgraph client["Client site"]
    pu["Client power users<br/>(LAN)"]
    subgraph host["Linux Docker host"]
      steward["Steward console"]
      pwd["Password service<br/>(optional helpdesk)"]
      acme["ACME sidecar<br/>(certificate)"]
    end
    ad[("Active Directory<br/>domain controllers")]
  end
  tech -- "HTTPS via Teleport" --> tp
  tp -- "application access" --> steward
  pu -- "HTTPS on the client LAN" --> steward
  tenantry -. "read-only fleet status" .-> steward
  tenantry -. "generates the Teleport side" .-> tp
  steward -- "LDAPS 636" --> ad
  pwd -- "LDAPS 636" --> ad
  steward -- "signed internal link" --> pwd

• Steward console: the web application and its API, a SQLite database (roles, delegations, settings, audit) and its secrets, in two Docker volumes. It runs as a non-root user on a read-only file system.
• Password service (optional, for the helpdesk): a separate container that holds the only account allowed to reset passwords (and, optionally, read LAPS passwords). The console never sees those credentials. See Helpdesk.
• ACME sidecar (optional, recommended): obtains and renews a publicly trusted certificate. See HTTPS certificate.
• Operators reach the console on the client LAN, through Teleport (recommended for MSP technicians), or behind a WAF such as Cloudflare Access. The console is never published raw on the Internet. See Exposure and access.
• Tenantry (documentation) is the MSP control plane: it generates the Teleport side of each console and polls every console's fleet API for a read-only health status.

Where to go next

I want to...	Read
Install a console for a client	Quick start, then the installer reference
Understand the browser setup	Setup wizard
Decide who can do what	Delegation model and AD rights
Let technicians reset passwords and unlock accounts	Helpdesk, LAPS
Create and offboard accounts	Onboarding and leavers, Bulk actions and CSV import
Add governance	Approval requests, Access reviews
Run it day to day	Operations, Notifications, Troubleshooting
Answer a security officer	Security model, Privacy and personal data

The console is available in English and French (adding a language).

Source code: github.com/Verttigo28/steward. Licensed under the AGPL-3.0-or-later: see License.

Active Directory and Windows are trademarks of Microsoft; Teleport is a trademark of Gravitational, Inc.; Cloudflare is a trademark of Cloudflare, Inc. Steward is an independent project, not affiliated with or endorsed by them.