LDAP requiring Enterprise-license in Rocket.Chat 9.0

Feedback
1

The Rocket.Chat 8.8.0-rc.0 changelog contains a change that I think deserves more attention from the self-hosted community.

LDAP and SAML are being deprecated for workspaces without a Premium plan. They will continue to work in 8.8, but with Rocket.Chat 9.0.0 a Premium license containing the ldap-enterprise or saml-enterprise module will be required.

This is especially concerning because it continues a trend we have seen over the last few years: more and more functionality has moved away from the Community Edition or become restricted.

Examples include the monthly limit on push notifications, advanced LDAP functionality, read receipts, and now apparently LDAP authentication itself.

Of course, Rocket.Chat needs a sustainable business model, and charging for genuine enterprise functionality is perfectly reasonable. But there is a difference between adding new premium features and gradually removing established functionality from the Community Edition.

LDAP is particularly important because for many self-hosted organizations it is not an optional enterprise feature – it is part of their basic authentication infrastructure.

And simply staying on an older Rocket.Chat release is not really a sustainable alternative.

Rocket.Chat supports regular releases for only a limited period. Once a server version reaches End of Life, it no longer receives security or bug fixes, cloud-dependent services such as the Push Notification Gateway and Marketplace may stop working, and official Mobile/Desktop clients may eventually refuse to connect to the server.

In other words, administrators are effectively required to keep their installations reasonably current – while upgrading increasingly means losing functionality that was previously available to Community Edition users.

Is the Community Edition still intended to be a viable long-term self-hosted platform, or is it gradually becoming an entry point into the commercial editions?

2

Ldap etc has long been “Premium”. I fought hard to keep it in Starter… They were going to remove it from “free” versions altogether.

Note there is a LTS - again me and many others pushed for this. The first LTS was 7.10.x and the next will be 8.8.x - see the release life cycle in the docs.

CE - commecial realities I’m afraid. The code is there for you to use and modify as you wish. Add your own LDAP auth & notifications.

But what you really want is all the toys, pre-built, with no cost…

Ultimately devs gotta eat and Rocket can’t run and produce code without cash.

I am checking on what they are actually “removing”, or not, and will report back.

3

It always has been… Nothing new!

4

We are currently using a self-hosted Starter workspace with Active Directory (LDAP) and Microsoft Entra ID (SAML).

Does the 9.0 licensing change affect Starter as well, or only Community Edition workspaces?

The wording in the release notes is not entirely clear to me.

5

AFAIAA LDAP/SAML will still be available on Starter upwards so no panic.

Nothing definitive on OAuth, though I have personally said pulling it from Starter would be inadvisable IMHO.

If I hear anything I’ll post back.

6

I’ve just got the “news” via e-mail.

Any chances features as important as LDAP auth could be patched back using a community-developed code in versions 9 or newer? Or using an external identity manager such as Keycloak?

7

In a word no.

Note I do not work for Rocket, though I did for a while and therefore understand some of the reasoning here. So this is entirely my personal point of view.

Fact is, like a lot of open source projects, lots of big orgs use Rocket for free to make profit for themselves and contribute nothing back. Not a cent, or a minute of their time.

They’ll sell the code and support to clients for profit, but still want free help & support themselves.

Software companies can’t afford to generate code for nothing. Developers need to eat. Investors that helped build Rocket need some ROI. That’s life.

I personally know of devs who closed source because some big cloud providers were quite happy to sell their code and profit themselves, but the dv couldn’t pay the mortgage or fed their kids. Madness. The freeloaders killed the golden goose.

If it is really that important and your business relies on it then take the open source code and build your own version.

Or pay for it.

It is still free for up to 50 users, which is not a bad deal. Companies that size can turnover millions. Don’t tell me they can’t afford it.

Anyway, here’s the official message.

8

I’m certain there was already an extensive discussion about this topic (including a few years ago, when some other features became exclusive to the Commercial edition), but that wasn’t the point of my question. But since you mentioned it, I mostly agree with what you’ve said.

However, focusing on removing basic features that are expected nowadays in most software of this kind and have existed since the start of the project, instead of improving current or introducing new Premium-exclusive features so people will be interested in paying for them, is the part I don’t agree with.

Furthermore, the project grew on unrestricted open source. I don’t know to what extent, but maybe there were unpaid contributors who weren’t employed by Rocket.Chat whose contributions are now being locked as well. But maybe not, maybe contributions from unaffiliated contributors account for less than 0.1%. I don’t really know.

Back to my question: I wanted to know if Rocket.Chat’s activation/licensing method (for the Community edition) would complain if custom code were added (and a broader overhaul were required to add it back), or if it doesn’t have these kinds of checks?

Thanks!

9

Yup. I’ve said the same thing many times.

I think that answers your question.

You can do as you wish with the open source code. You just can’t do anything with licenced code.

Nothing will check your own code - just protect their own.

“Expected”. By who? Users?

Why should Rocket be “Expected” to deliver that for free to a business making profit?

Does your business work for free?

It is what it is and I explained why.

If it is that important to you, why not pay?

What little was contributed years ago has long since been rewritten. There are very few contributions today beyond minor fixes - yup in part because Rocket has focused on paying customers

They had to do what they had to do to survive.

If not they go bust, and you get nothing. Is that what you want.

Yup, you can complain about many things here as I have for years. But I also run a business and can see the brutal reality of the market.

You have to make money to survive. They tried all sorts early on. They failed. :man_shrugging:

I know most of this is not what you want to hear, but it doesn’t make it less true.

10

I’ve made my point and stand by it.

If it is as you said, I don’t think the “Community” edition will be around for much longer then.

Thanks, that’s what I needed to know.

11

You didn’t really make any point.

You asked some questions and I answered them, and you waffled a bit because you aren’t happy.

You’ve also rapidly avoided the points about why should Rocket work completely for free, how much profit does your business make, and why shouldn’t you pay? I’m still waiting for those.

It will as per Gabriels statement.

But just basic with not many free “corporate” features.

After all, you get full features with 50 users for free on Starter.

As I said before, you can run a multi million $ business with 50 staff.

You can afford to contribute.

CE really is just for small communities that don’t need corporate features. It can also be the core code for anything you want to build yourself.

Again, Rocket has to make some money to pay devs to build code.

If you have any better ideas on how to generate revenue to pay devs then let them know by popping a comment below.

12

I really didn’t want to prolong this discussion any further, but

My point:

TL;DR

Add features and ask for money: ok and I agree with

Remove features that exist since the dawn of the project: not ok

LDAP’s RFC hasn’t changed since 2006. Code maintenance is probably minimal.

I even have other points to support my opinion, but I’ll keep them to myself. They probably won’t change the direction they’ve decided to take the project.

13

Disagree all you like.

The planet has been rotating for 4.5 billion years. Your point is? Ldap is 20 years old? They didn’t have to add support originally.

Like it or not they can add or move features as they want. They build it. It’s their prerogative, not yours.

You might not like it, but there’s no law against any of it.

Equally you can fork CE with the existing LDAP code and do your own thing.

And you’ve not offered any solution to this base issue. No one ever does. Complaints, but no action.

One also wonders how many users & clients you have? Hundreds, thousands? And how much profit the company makes?

I’ll get my popcorn while I wait for the answer to that.

14

If you read my original comment, there aren’t any complaints. I was just trying to assess the situation:

Also, the question wasn’t directed to anyone in particular. It seems you, for some reason, took it personally.

I won’t be replying about this anymore. I’ll just stick to the original premise from OP’s post and to people trying to solve the problem (if there will be any).

Good bye.

15

Hi everyone, Gabriel from Rocket.Chat here.

First, thank you for raising this. Concerns like these deserve a direct answer, not a debate about who should pay for what. Everyone here is trying to run something that works, and that’s a fair place to start from.

What is changing, to be precise
Until now, basic LDAP, SAML and OAuth were part of the Community Edition. Advanced features such as background sync and role mapping were only in the paid plans. So TheCount is right that this is a real change, and we don’t want to present it as “nothing new”. Starting with 9.0, LDAP, SAML, Social Logins and Custom OAuth will require Starter or a paid plan. On CE, local authentication still works, and so do OAuth logins through Apple, GitHub, GitLab, Google and Nextcloud. Full details are in the announcement: Upcoming Changes to Identity Management in Rocket.Chat 9.0

thash: Starter is not affected. LDAP and SAML keep working on Starter, which is free for up to 50 users and one workspace per organization.

TheCount, on being forced to upgrade: you won’t lose authentication overnight. You can stay on your current version until it reaches end of support, and 8.9.x is an LTS release, so it gives the longest window for planning a migration. You can check your version’s support dates in the Version Durability Matrix - 8.9 release is valid until October 31st 2027.

brlarini, on custom code and external identity providers: the core platform remains MIT licensed. You are free to fork it and maintain your own authentication code. Please keep in mind that a custom fork would be maintained by you, and we can’t support it. On CE in 9.0, only the OAuth providers listed above are supported, so any other identity provider would need Starter or a paid plan.

Your options before upgrading to 9.0

  1. Move to Starter (free, up to 50 users) or a paid plan. Your current configuration keeps working.
  2. Nonprofits: we’ve launched a program with reduced Commercial pricing. The eligibility details are in the announcement linked above.
  3. Switch to local authentication or one of the supported OAuth providers.

We know this change affects how some of you run your workspaces, and we appreciate the honest feedback in this thread.

16

Understood. Thank your for the clarification.