passport-ldapauth

Passport authentication strategy against LDAP server. This module is a Passport strategy wrapper for ldapauth-fork

Node v0.12

`dtrace-provider` issue

Currently the latest released version of ldapjs which this module depends on does not install succesfully on Node v0.12 on Mac (see issue #258) due to old dtrace-provider dependency. To work around the issue, add dependency to ldapjs master to your package.json:

{
  "dependencies": {
    "ldapjs": "mcavage/node-ldapjs",
    "passport-ldapauth": "0.3.0"
  }
}

dtrace-provider is an optional dependency, ie. if you don't need it there's no need to do anything.

SSL issue

This also comes form ldapjs (see issue #258), and the same workaround solves it.

Install

npm install passport-ldapauth

Status

Usage

Configure strategy

var LdapStrategy = require('passport-ldapauth');

passport.use(new LdapStrategy({
    server: {
      url: 'ldap://localhost:389',
      ...
    }
  }));

server: LDAP settings. These are passed directly to ldapauth-fork. See its documentation for all available options.
- url: e.g. ldap://localhost:389
- bindDn: e.g. cn='root'
- bindCredentials: Password for bindDn
- searchBase: e.g. o=users,o=example.com
- searchFilter: LDAP search filter, e.g. (uid={{username}}). Use literal {{username}} to have the given username used in the search.
- searchAttributes: Optional array of attributes to fetch from LDAP server, e.g. ['displayName', 'mail']. Defaults to undefined, i.e. fetch all attributes
- tlsOptions: Optional object with options accepted by Node.js tls module.
usernameField: Field name where the username is found, defaults to username
passwordField: Field name where the password is found, defaults to password

passReqToCallback: When true, req is the first argument to the verify callback (default: false):

  passport.use(new LdapStrategy(..., function(req, user, done) {
      ...
      done(null, user);
    }
  ));

Note: you can pass a function instead of an object as options, see the example below

Authenticate requests

Use passport.authenticate(), specifying the 'ldapauth' strategy, to authenticate requests.

`authenticate()` options

In addition to default authentication options the following options are available for passport.authenticate():

badRequestMessage flash message for missing username/password (default: 'Missing credentials')
invalidCredentials flash message for InvalidCredentialsError, NoSuchObjectError, and /no such user/i LDAP errors (default: 'Invalid username/password')
userNotFound flash message when LDAP returns no error but also no user (default: 'Invalid username/password')
constraintViolation flash message when user account is locked (default: 'Exceeded password retry limit, account locked')

Express example

var express      = require('express'),
    passport     = require('passport'),
    bodyParser   = require('body-parser'),
    LdapStrategy = require('passport-ldapauth');

var OPTS = {
  server: {
    url: 'ldap://localhost:389',
    bindDn: 'cn=root',
    bindCredentials: 'secret',
    searchBase: 'ou=passport-ldapauth',
    searchFilter: '(uid={{username}})'
  }
};

var app = express();

passport.use(new LdapStrategy(OPTS));

app.use(bodyParser.json());
app.use(bodyParser.urlencoded({extended: false}));
app.use(passport.initialize());

app.post('/login', passport.authenticate('ldapauth', {session: false}), function(req, res) {
  res.send({status: 'ok'});
});

app.listen(8080);

Active Directory over SSL example

Simple example config for connecting over ldaps:// to a server requiring some internal CA certificate (often the case in corporations using Windows AD).

var fs = require('fs');

var opts = {
  server: {
    url: 'ldaps://ad.corporate.com:636',
    bindDn: 'cn=non-person,ou=system,dc=corp,dc=corporate,dc=com',
    bindCredentials: 'secret',
    searchBase: 'dc=corp,dc=corporate,dc=com',
    searchFilter: '(&(objectcategory=person)(objectclass=user)(|(samaccountname={{username}})(mail={{username}})))',
    searchAttributes: ['displayName', 'mail'],
    tlsOptions: {
      ca: [
        fs.readFileSync('/path/to/root_ca_cert.crt')
      ]
    }
  }
};
...

Asynchronous configuration retrieval

Instead of providing a static configuration object, you can pass a function as options that will take care of fetching the configuration. It will be called with the req object and a callback function having the standard (err, result) signature. Notice that the provided function will be called on every authenticate request.

var getLDAPConfiguration = function(req, callback) {
  // Fetching things from database or whatever
  process.nextTick(function() {
    var opts = {
      server: {
        url: 'ldap://localhost:389',
        bindDn: 'cn=root',
        bindCredentials: 'secret',
        searchBase: 'ou=passport-ldapauth',
        searchFilter: '(uid={{username}})'
      }
    };

    callback(null, opts);
  });
};

var LdapStrategy = require('passport-ldapauth');

passport.use(new LdapStrategy(getLDAPConfiguration,
  function(user, done) {
    ...
    return done(null, user);
  }
));

License

MIT

jasonrojas/passport-ldapauth