node.jsactive-directoryldapldapauth

NodeJS express passport-ldapauth always returns 'Invalid Username/Password'


Am using passport-ldapauth npm for LDAP / AD authentication in my web application but am always getting 'Invalid Username/Password' though am dam sure username and password is correct. Here is My Code

var express = require('express')
var app =  express();
var bodyParser = require('body-parser');
var passport     = require('passport');
var LdapStrategy = require('passport-ldapauth');
app.use(bodyParser.urlencoded({extended:true}));
app.use(bodyParser.json());
app.use(function(req, res, next) {
   res.header("Access-Control-Allow-Origin", "*");
   res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, 
   Content-Type, Accept");
   next();
});



var OPTS = {
  server: {
    "url": "ldap://ip-address:389",
    "bindDN": "cn=admin-username,dc=dcname,dc=com",
    "bindCredentials": "admin-password",
    "searchBase": "dc=dcname,dc=lan",
    "searchFilter": "(sAMAccountName={username})",//I have tried (uid={{username}}) also.
  },
  passReqToCallback : true
};

passport.use(new LdapStrategy(OPTS));

app.post('/api/login', function(req, res, next) {  
passport.authenticate('ldapauth', {session: true}, function(err, user, info) 
{
  console.log("err: " + err); //returns null
  console.log("user: " + user);//returns false
  console.log("info: " + JSON.stringify(info));//returns {"message":"Invalid username/password"}
    if (err) {
      return next(err); // will generate a 500 error
    }
    // Generate a JSON response reflecting authentication status
    if (! user) {
      return res.send({ success : false, message : 'authentication failed' 
      });
    }
    return res.send({ success : true, message : 'authentication succeeded' 
    });
   })(req, res, next);  
});
app.listen(3000, function() {
  console.log('Listening on port 3000...')
});

Please help me out guys.


Solution

  • The problem was with organizational unit (OU). The user was having one more ou other than Users which i didn't mention in bindDN. And also (sAMAccountName={{username}}) as searchFilter is also important it will not work if we give (uid={{username}}) as username we passing is sAMAccountName in LDAP AD. So the new code will be.

    var OPTS = {
        server: {
          "url": "ldap://ip-address:389",
          "bindDN": "cn=username,ou=Users,ou=user-other-ou,dc=dcname,dc=com",
          "bindCredentials": "password",
          "searchBase": "dc=dcname,dc=lan",
          "searchFilter": "(sAMAccountName={{username}})",
        },  
    };
    

    Hope it will help someone.