Passport authentication strategy against an Active Directory server. This module is a Passport strategy wrapper for ldapauth-fork
npm install passport-adauth
var ActiveDirectoryStrategy = require('passport-adauth');
passport.use(new ActiveDirectoryStrategy({
server: {
host: 'ad.company.com',
principal: 'company.com'
}
}));
-
server
: LDAP settings. These are passed directly to ldapauth-fork. See its documentation for all available options.url
: e.g.ldap://localhost:389
bindDn
: e.g.cn='root'
bindCredentials
: Password for bindDnsearchBase
: e.g.o=users,o=example.com
searchFilter
: LDAP search filter, e.g.(uid={{username}})
. Use literal{{username}}
to have the given username used in the search.searchAttributes
: Optional array of attributes to fetch from LDAP server, e.g.['displayName', 'mail']
. Defaults toundefined
, i.e. fetch all attributestlsOptions
: Optional object with options accepted by Node.js tls module.
-
usernameField
: Field name where the username is found, defaults to username -
passwordField
: Field name where the password is found, defaults to password -
passReqToCallback
: Whentrue
,req
is the first argument to the verify callback (default:false
):passport.use(new ActiveDirectoryStrategy(..., function(req, user, done) { ... done(null, user); } ));
Note: you can pass a function instead of an object as options
, see the example below
Use passport.authenticate()
, specifying the 'adauth'
strategy, to authenticate requests.
In addition to default authentication options the following options are available for passport.authenticate()
:
badRequestMessage
flash message for missing username/password (default: 'Missing credentials')invalidCredentials
flash message forInvalidCredentialsError
,NoSuchObjectError
, and/no such user/i
LDAP errors (default: 'Invalid username/password')userNotFound
flash message when LDAP returns no error but also no user (default: 'Invalid username/password')constraintViolation
flash message when user account is locked (default: 'Exceeded password retry limit, account locked')
var express = require('express'),
passport = require('passport'),
bodyParser = require('body-parser'),
ActiveDirectoryStrategy = require('passport-adauth');
var OPTS = {
server: {
host: 'ad.company.com',
principal: 'company.com'
}
};
var app = express();
passport.use(new ActiveDirectoryStrategy(OPTS));
app.use(bodyParser.json());
app.use(bodyParser.urlencoded({extended: false}));
app.use(passport.initialize());
app.post('/login', passport.authenticate('adauth', {session: false}), function(req, res) {
res.send({status: 'ok'});
});
app.listen(8080);
Simple example config for connecting over ldaps://
to a server requiring some internal CA certificate (often the case in corporations using Windows AD).
var fs = require('fs');
var opts = {
server: {
url: 'ldaps://ad.corporate.com:636',
bindDn: 'cn=non-person,ou=system,dc=corp,dc=corporate,dc=com',
bindCredentials: 'secret',
searchBase: 'dc=corp,dc=corporate,dc=com',
searchFilter: '(&(objectcategory=person)(objectclass=user)(|(samaccountname={{username}})(mail={{username}})))',
searchAttributes: ['displayName', 'mail'],
tlsOptions: {
ca: [
fs.readFileSync('/path/to/root_ca_cert.crt')
]
}
}
};
...
Instead of providing a static configuration object, you can pass a function as options
that will take care of fetching the configuration. It will be called with the req
object and a callback function having the standard (err, result)
signature. Notice that the provided function will be called on every authenticate request.
var getLDAPConfiguration = function(req, callback) {
// Fetching things from database or whatever
process.nextTick(function() {
var opts = {
server: {
url: 'ldap://localhost:389',
bindDn: 'cn=root',
bindCredentials: 'secret',
searchBase: 'ou=passport-adauth',
searchFilter: '(uid={{username}})'
}
};
callback(null, opts);
});
};
var LdapStrategy = require('passport-adauth');
passport.use(new LdapStrategy(getLDAPConfiguration,
function(user, done) {
...
return done(null, user);
}
));
MIT