lmenezes/cerebro

LDAP and Windows AD

Open

#392 opened on Aug 22, 2019

View on GitHub
 (1 comment) (0 reactions) (0 assignees)JavaScript (5,411 stars) (721 forks)batch import
bughelp wanted

Description

I have LDAP working with Windows AD using mail as user-attr.

Recently I changed mail address in Windows user accounts and now they cannot access Cerebro using LDAP. They get a user/password error.

After doing some tests I found that Cerebro LDAP (using mail as user attribute) only works if mail and UPN attributes matches in AD. Another combination fails to authenticate.

This is the actual configuration I use: type: ldap method = "simple" user-template = "%s" user-attr = "mail"

Could it be an issue with Cerebro LDAP config?

Thanks.

Contributor guide

Tech stack
javascriptnodejs
Domain
backendauthentication
Issue type
bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
mostly clear
Prerequisites
LDAP basicsWindows Active DirectoryCerebro authentication config
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
35
Research direction
Investigate the LDAP authentication module in the Cerebro source code, specifically how user attr and user template are used to construct the bind DN. The issue suggests a mismatch when mail and UPN differ, so check if the code assumes they are identical. Look for the search filter and binding logic in files like server/authentication/ldap.js. Consider testing with a Windows AD environment where mail and UPN are different to confirm the bug. Then propose a fix that uses the specified user attr consistently for authentication.