@smertins27/ldap-auth-wrapper

Reusable LDAP self-authentication package built on top of ldap-authentication. It wraps the typical configuration and returns a consistent result object.

Installation

npm install @smertins27/ldap-auth-wrapper

Features

• LDAP self-authentication (user binds with own credentials)
• Simple result object: { authenticated, user, error }
• Usable as a class or a helper function
• TypeScript types included

Usage

1) Direct call via helper function

import { authenticateLdapUser } from '@smertins27/ldap-auth-wrapper';

const result = await authenticateLdapUser({
  ldapOpts: { url: 'ldaps://ldap.example.org', tlsOptions: { rejectUnauthorized: false } },
  userDn: 'uid=jdoe,ou=people,dc=example,dc=org',
  userPassword: 'secret',
  attributes: ['dn', 'cn', 'mail'],
});

if (result.authenticated) {
  console.log('OK', result.user);
} else {
  console.log('FAIL', result.error);
}

2) Reuse via the class

import { LdapSelfAuthenticator } from '@smertins27/ldap-auth-wrapper';

const authenticator = new LdapSelfAuthenticator({
  ldapOpts: { url: 'ldap://ldap.example.org' },
  userDn: 'uid=jdoe,ou=people,dc=example,dc=org',
  attributes: ['dn', 'cn', 'mail'],
});

const result = await authenticator.authenticate('secret');

Configuration

SelfAuthConfig

• ldapOpts (required): LDAP connection options.
• userDn (required): Distinguished Name of the user.
• userPassword (required): User password (only for authenticateLdapUser).
• userSearchBase (optional): Base DN for user lookup.
• usernameAttribute (optional): Username attribute (e.g. uid).
• username (optional): Username for self-auth.
• attributes (optional): LDAP attributes to return.
• groupsSearchBase (optional): Base DN for group lookup.
• groupClass (optional): LDAP group class (e.g. groupOfNames).
• groupMemberAttribute (optional): Group membership attribute.
• starttls (optional): Enable StartTLS.

LdapOptions

• url (required): LDAP URL, e.g. ldap:// or ldaps://.
• tlsOptions (optional): TLS settings (e.g. rejectUnauthorized).
• connectTimeout (optional): Timeout in ms.

Return value

AuthenticationResult:

{
  authenticated: boolean;
  user?: LdapUser | null;
  error?: unknown;
}

On success, user contains LDAP data; otherwise it is null. If an error occurs (for example from the underlying LDAP library), error is set.

Notes

• Errors are caught and returned as authenticated: false.
• This package uses ldap-authentication under the hood.

License

MIT