# node-ldapauthz

> A simple node.js lib for user authorization based on LDAP server groups.

Latest version **0.1.1** (published 2014-08-07) · 0 weekly downloads

## Install

```sh
npm install node-ldapauthz
pnpm add node-ldapauthz
yarn add node-ldapauthz
bun add node-ldapauthz
```

## Health

**Score 15/100 (F)** — status: abandoned.

Positive: no vulnerabilities.

Warnings: low downloads; no types; no esm support; pre 1.0.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 0.1.1 |
| Published | 2014-08-07 |
| First published | 2014-08-07 |
| Weekly downloads | 0 |
| TypeScript types | none |
| Module format | CommonJS |
| Node | >=0.8 |
| Dependencies | 2 |
| Known vulnerabilities | 0 |
| Install scripts | no |
| Author | Diego Rani Mazine |
| Maintainers | diegorm |

## Links

- npm: https://www.npmjs.com/package/node-ldapauthz
- npm.io page: https://npm.io/package/node-ldapauthz

## Dependencies (2)

- [ldapjs](https://npm.io/package/ldapjs.md) ^0.7.1
- [assert-plus](https://npm.io/package/assert-plus.md) ^0.1.5

## Recent versions

- 0.1.1 (latest) — 2014-08-07

## README

# node-ldapauthz

A simple node.js lib for user authorization based on LDAP server groups.

## License

##Installation

```
$ npm install connect-roles
```

## Usage

```
 var LdapAuthz = require('ldapauthz');
 
 var authz = new LdapAuthz({url: 'ldaps://ldap.example.com:663', ...});
 
 ...
 
 authz.getGrantedAuthorities(username, function (err, authorities) { ... });
 
 ...
 
 authz.close(function (err) { ... }) 
```

## API

### LdapAuthz(opts)

Creates an LDAP authz class.

* **opts** {Object} Configuration options
  - **url** {String} A valid LDAP url. E.g. 'ldaps://ldap.example.com:663'
  - **adminDn** {String} Optional, e.g. 'uid=myapp,ou=users,o=example.com'
  - **adminPassword** {String} Password for adminDn.
  - **groupSearchBase** {String} Defines the part of the directory tree under which group searches should be performed. E.g. 'ou=groups,o=example.com'
  - **groupSearchScope** {String} Optional, default 'sub'. Scope of the search, one of 'base', 'one', or 'sub'.
  - **groupSearchFilter** {String} The filter which is used to search for group membership. Use the literal '{{username}}' to have the given username be interpolated in for the LDAP search. The default is (uniqueMember={{username}}), corresponding to the groupOfUniqueMembers LDAP class.
  - **groupRoleAttribute** {String} The attribute which contains the name of the authority defined by the group entry. Defaults to cn.
  - **log4js** Optional. The require'd log4js module to use for logging. If given this will result in TRACE-level logging for ldapauthz.
  - **verbose** {Boolean} Optional, default false. If `log4js` is also given, this will add TRACE-level logging for ldapjs (quite verbose).
  - **timeout** {Integer} Optional, default Infinity. How long the client should let operations live for before timing out.
  - **connectTimeout** {Integer} Optional, default is up to the OS. How long the client should wait before timing out on TCP connections.
  - **tlsOptions** {Object} Additional options passed to the TLS connection layer when connecting via ldaps://. See http://nodejs.org/api/tls.html#tls_tls_connect_options_callback for available options.
  - **maxConnections** {Integer} Whether or not to enable connection pooling, and if so, how many to maintain.
  - **bindDN** {String} The DN all connections should be bound as. Defaults to adminDn.
  - **bindCredentials** {String} The credentials to use with bindDN. Defaults to adminPassword.
  - **checkInterval** {Integer} How often to schedule health checks for the connection pool.
  - **maxIdleTime** {Integer} How long a client can be idle before health-checking the connection (subject to the checkInterval frequency).

### close(callback)

Closes the LDAP client.

* **callback** {Function} Callback function.

### getGrantedAuthorities(username, callback);

Gets the list of authorities for the user.

* **username** {String} The user name.
* **callback** {Function} `function (err, authorities)` The callback function.

### 
## Examples

### Example using express, passport and connect-roles

```
const URL = 'ldap://localhost:389';
const ADMIN_DN = 'cn=root,ou=person,dc=sample,dc=com';
const ADMIN_PASSWORD = 'secret';

const SEARCH_BASE = 'ou=person,dc=sample,dc=com';
const SEARCH_FILTER = '(&(objectclass=inetOrgPerson)(uid={{username}}))';

const GROUP_SEARCH_BASE = 'ou=group,dc=sample,dc=com';
const GROUP_SEARCH_FILTER = '(&(uniqueMember={{username}})(objectClass=group))';

var _ = require("underscore"),
  express = require('express'),
  bodyParser = require('body-parser'),
  session = require('express-session'),
  cookieParser = require('cookie-parser'),
  passport = require('passport'),
  LdapStrategy = require('passport-ldapauth').Strategy,
  ConnectRoles = require('connect-roles'),
  LdapAuthz = require('./ldapauthz.js');

var app = express();

var user = new ConnectRoles();

passport.use(new LdapStrategy({
    server: {
      url: URL,
      adminDn: ADMIN_DN,
      adminPassword: ADMIN_PASSWORD,
      searchBase: SEARCH_BASE,
      searchFilter: SEARCH_FILTER
    }
  },
  function(user, done) {

    console.log('user: ' + user.dn);

    var authz = new LdapAuthz({
      url: URL,
      adminDn: ADMIN_DN,
      adminPassword: ADMIN_PASSWORD,
      groupSearchBase: GROUP_SEARCH_BASE,
      groupSearchFilter: GROUP_SEARCH_FILTER
    });

    authz.getGrantedAuthorities(user.dn, function (err, authorities) {
      authz.close(function (err) {});

      if (err) {
        return done(err);
      }

      user.roles = authorities;
      return done(null, user);
    });
  }
));

passport.serializeUser(function(user, done) {
  done(null, user);
});

passport.deserializeUser(function(obj, done) {
  done(null, obj);
});

app.use(bodyParser.urlencoded({extended: true}));
app.use(bodyParser.json());
app.use(session({ secret: 'keyboard cat', saveUninitialized: true, resave: true }));
app.use(cookieParser());
app.use(passport.initialize());
app.use(passport.session());
app.use(user.middleware());

// Anonymous users can only access the home page
// Returning false stops any more rules from being considered
user.use(function (req, action) {
  if (!req.isAuthenticated()) {
    return action === 'access home page';
  }
})

user.use('user', function (req) {
  return  _.contains(req.user.roles, 'GEC-BR-search-usuarios');
});

user.use('admin', function (req) {
  return  _.contains(req.user.roles, 'GEC-BR-search-administradores');
});

app.get('/', user.can('access home page'), function (req, res) {
  res.send({status: 'home - ok'}).end();
});

app.get('/login', passport.authenticate('ldapauth'), function(req, res) {
  res.send({status: 'login - ok'}).end();
});

app.get('/user', user.is('user'), function (req, res) {
  res.send({status: 'user - ok'}).end();
});

app.get('/admin', user.is('admin'), function (req, res) {
  res.send({status: 'admin - ok'}).end();
});

app.listen(8080);
```

---
_Source: https://npm.io/package/node-ldapauthz · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._