0

I'm trying to build and openLDAP container for my nodejs app. This is the code i'm using.

try {
        client = ldap.createClient({
            url: 'ldap://openldap:389'
        })
    } catch (err) {
        return errorHandler(req, res, err)
    }
    try {
        client.bind(email, password, async (err, result) => {
(...)
}

When I'm doing a request using company LDAP I use email in my request and I got a response from my request.

But when I'm creating a container LDAP I only get a response from my request if I use DN instead of e-mail. This is the service LDAP that i'm creating for development

services:
  openldap:
    image: osixia/openldap:latest
    container_name: openldap
    hostname: openldap
    restart: always
    ports:
      - '389:389'
      - '636:636'
    environment:
      - LDAP_ORGANISATION=company
      - LDAP_DOMAIN=example.org
      - "LDAP_BASE_DN=dc=example,dc=org"
      - LDAP_ADMIN_PASSWORD=test123
    volumes:
      - ./test.ldif:/test.ldif

    networks:
      - infra-net

And my file test.ldif that I'm using is :

dn: uid=test,dc=example,dc=org
uid: test
cn: test
sn: 3
objectClass: top
objectClass: posixAccount
objectClass: inetOrgPerson
loginShell: /bin/bash
homeDirectory: /home/test
uidNumber: 14583102
gidNumber: 14564100
userPassword: test
mail: test@example.org
gecos: test User

I know I can do it with client.search but I would love to get response using client.bind like we get in production.

wsn
  • 39
  • 6
  • 1
    You have to do a search to find the DN with that email address before the bind. – user207421 Jul 21 '22 at 10:14
  • But in my production code I don't do that and I could search for email address. Is there a way I could replicate that ? – wsn Jul 21 '22 at 10:57
  • If you can do it in the production environment you should be able to do it in the test environment, unless there is some significant differences in the LDAP servers that you haven't told us about. – user207421 Jul 21 '22 at 11:36
  • I didn't do it in production environment. We're using LDAP that was other company that made that to us. – wsn Jul 21 '22 at 12:50
  • 1
    This is probably because they were using AD, which allows to use UPN (`@`) as DN for binding, ie. company email can be set as UPN. You can't do this with OpenLDAP. – EricLavault Jul 21 '22 at 13:40
  • Is there a way that I can create one AD then for development mode ? – wsn Jul 21 '22 at 13:44
  • You can try with AD LDS (Active Directory Lightweight Directory Services). Or, you could add a line that checks the environment (prod vs dev) and, if on dev, convert the UPN into DN. That said, as mentioned by @user207421 the proper way to authenticate users against LDAP is to bind with a manager account in order to be able to search for the user entry, then if such entry exists, grab its dn and bind with it (ie. code works regardless of the backend, otherwise your app is prone to break as soon as the client decides to switch from one directory to another). – EricLavault Jul 22 '22 at 14:21

0 Answers0