diff --git a/pkgs/development/python-modules/devpi-ldap/default.nix b/pkgs/development/python-modules/devpi-ldap/default.nix
new file mode 100644
index 000000000000..894819670e38
--- /dev/null
+++ b/pkgs/development/python-modules/devpi-ldap/default.nix
@@ -0,0 +1,57 @@
+{
+  lib,
+  buildPythonPackage,
+  devpi-server,
+  fetchFromGitHub,
+  ldap3,
+  mock,
+  pytest-cov-stub,
+  pytest-flake8,
+  pytestCheckHook,
+  pythonOlder,
+  pyyaml,
+  setuptools,
+  webtest,
+}:
+
+buildPythonPackage rec {
+  pname = "devpi-ldap";
+  version = "2.1.1-unstable-2023-11-28";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "devpi";
+    repo = "devpi-ldap";
+    rev = "281a21d4e8d11bfec7dca2cf23fa39660a6d5796";
+    hash = "sha256-vwX0bOb2byN3M6iBk0tZJy8H39fjwBYvA0Nxi7OTzFQ=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    devpi-server
+    pyyaml
+    ldap3
+  ];
+
+  nativeCheckInputs = [
+    devpi-server
+    mock
+    pytest-cov-stub
+    pytest-flake8
+    pytestCheckHook
+    webtest
+  ];
+
+  pythonImportsCheck = [ "devpi_ldap" ];
+
+  meta = {
+    homepage = "https://github.com/devpi/devpi-ldap";
+    description = "LDAP authentication for devpi-server";
+    changelog = "https://github.com/devpi/devpi-ldap/blob/main/CHANGELOG.rst";
+    license = lib.licenses.mit; # according to its setup.py
+    maintainers = with lib.maintainers; [ confus ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 1aa45ee6272e..1b146911df78 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3491,6 +3491,8 @@ self: super: with self; {
 
   devpi-common = callPackage ../development/python-modules/devpi-common { };
 
+  devpi-ldap = callPackage ../development/python-modules/devpi-ldap { };
+
   devtools = callPackage ../development/python-modules/devtools { };
 
   dfdiskcache = callPackage ../development/python-modules/dfdiskcache { };