@robi Short answer: no, not in the sense you mean.
Infisical has no third-party extension mechanism. There is no equivalent of vault plugin register, no external plugin binaries, no stable interface for adding auth methods or secrets engines. The backend/src/server/plugins/ directory is just Fastify's internal module convention, and the Backstage / Airflow / varlock "Infisical plugins" you may run across are plugins for those systems that consume Infisical's API. Nothing extends the server itself.
LDAP is also about the worst candidate for a community implementation, because of where it lives: backend/src/ee/services/ldap-config/, alongside the SAML and OIDC SSO services. Everything under ee/ is proprietary-licensed rather than MIT, and the self-hosted terms say Infisical retains rights over modifications and patches to it. You could write a clean-room LDAP auth method in the MIT half instead, which sidesteps the licence question, but it would never be merged upstream since it competes directly with the paid feature. That means maintaining a permanent fork of a codebase shipping several releases a month, and on Cloudron, building and tracking your own image forever.
Worth separating two things though. What is gated is human SSO. Machine identity auth including OIDC is on the free tier, per the feature table in my first post, so machines can already federate against Keycloak or similar without a licence. It is only admin login to the Infisical UI that needs LDAP/SAML/OIDC.
If you want a genuine plugin system with no open core, OpenBao is the honest answer: MPL 2.0, Linux Foundation governance, external plugin binaries in a separate repo, with LDAP auth, the SSH CA and dynamic secrets all included free. Not something you bolt onto Infisical, an alternative to it.
We are currently packaging OpenBao for Cloudron and will hopefully make it available as a community application later.
