Am using passport-ldapauth npm for LDAP / AD authentication in my web application but am always getting 'Invalid Username/Password' though am dam sure username and password is correct. Here is My Code
var express = require('express')
var app = express();
var bodyParser = require('body-parser');
var passport = require('passport');
var LdapStrategy = require('passport-ldapauth');
app.use(bodyParser.urlencoded({extended:true}));
app.use(bodyParser.json());
app.use(function(req, res, next) {
res.header("Access-Control-Allow-Origin", "*");
res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With,
Content-Type, Accept");
next();
});
var OPTS = {
server: {
"url": "ldap://ip-address:389",
"bindDN": "cn=admin-username,dc=dcname,dc=com",
"bindCredentials": "admin-password",
"searchBase": "dc=dcname,dc=lan",
"searchFilter": "(sAMAccountName={username})",//I have tried (uid={{username}}) also.
},
passReqToCallback : true
};
passport.use(new LdapStrategy(OPTS));
app.post('/api/login', function(req, res, next) {
passport.authenticate('ldapauth', {session: true}, function(err, user, info)
{
console.log("err: " + err); //returns null
console.log("user: " + user);//returns false
console.log("info: " + JSON.stringify(info));//returns {"message":"Invalid username/password"}
if (err) {
return next(err); // will generate a 500 error
}
// Generate a JSON response reflecting authentication status
if (! user) {
return res.send({ success : false, message : 'authentication failed'
});
}
return res.send({ success : true, message : 'authentication succeeded'
});
})(req, res, next);
});
app.listen(3000, function() {
console.log('Listening on port 3000...')
});
Please help me out guys.
The problem was with organizational unit (OU). The user was having one more ou other than Users which i didn't mention in bindDN. And also (sAMAccountName={{username}}) as searchFilter is also important it will not work if we give (uid={{username}}) as username we passing is sAMAccountName in LDAP AD. So the new code will be.
var OPTS = {
server: {
"url": "ldap://ip-address:389",
"bindDN": "cn=username,ou=Users,ou=user-other-ou,dc=dcname,dc=com",
"bindCredentials": "password",
"searchBase": "dc=dcname,dc=lan",
"searchFilter": "(sAMAccountName={{username}})",
},
};
Hope it will help someone.