Best practices for LDAP authentication¶
Introduction¶
You will find here some best practices to code LDAP authentication in your applications:
- Use a filter to recover user DN: do not build DN with a concatenation of login and branch
- Use service account to query LDAP: some directories will not allow anonymous access
Search and Bind¶
Here is a standard LDAP authentication workflow:
- A bind is done with a Directory Service Account (that has read rights on user entries)
- A search is done with the user identifier in the filter, for example:
Search base: ou=users,dc=example,dc=com
Search filter: (&(uid=<user identifier>)(objectClass=person))
Search scope: one
Search attributes: uid
- The DN of the user is found in the result. If more of one entry is returned, or no entry is returned, there should be an error.
- A bind is done with the DN found and the password submitted by the user. If the operation fails (error code 49), the password is wrong.