@cepharum/ldap-bridge

ldap-bridge

remotely backed LDAP authentication

License

MIT

About

This package implements an LDAP service suitable for authenticating users. It is translating incoming requests for binding as a user into authentication requests against configurable backend services such as POP3.

Example

Using this service, you can set up an LDAP-aware service such as Jitsi or Mattermost for users authenticating against the POP3 of your local MTA.

Security

In production mode the service requires encrypted connections with its clients as well as with backend services. Due to its nature it is forwarding any password provided by a client to related backend service. It isn't storing passwords. It isn't caching any result either. The service is working stateless.

As a beneficial side effect this results in this service's horizontal scalability.

To conclude, from a user's point of view this tool relies on a security issue as soon as you authenticate against backends you don't manage. This is due to the possibility of reading/tracking sensitive information meant to be shared by your user and the remote backend, only.

Setup

In a locally created folder run:

npm install -g @cepharum/ldap-bridge

Create configuration file config.js in current folder with content from distributed template file. Review the content and adjust it according to your needs.

Eventually start the service with:

npx ldap-bridge

Docker Support

The latest version is available as a docker image named registry.gitlab.com/cepharum-foss/ldap-bridge, too.

On first run this image is writing configuration template into mounted volume for review.

mkdir -p data
docker run -it --rm -v $(pwd)/data:/config registry.gitlab.com/cepharum-foss/ldap-bridge

After adjusting the configuration in data/config.js you can start the container with:

docker run -d --rm -p 636:636 -v $(pwd)/data:/config registry.gitlab.com/cepharum-foss/ldap-bridge

Logging

The service is logging to the console using debug. Thus, you can use DEBUG environment variable to adjust log levels. In docker image this defaults to *:alter,*:error,*:warn,*:info.

Encryption Required

In a production setup the service requires LDAP-side and backends to communicate over encrypted connections, only. You need to set NODE_ENV environment variable to development to work with non-encrypted LDAP server locally.