feat: add generic LDAP authentication strategy using ldapts by 1saac-k · Pull Request #1496 · finos/git-proxy

1saac-k · 2026-04-07T15:01:33Z

Add a new ldap authentication type that integrates with any standards-compliant LDAP server. The existing
activedirectory type relies on the activedirectory2 library which is AD-specific and incompatible with lightweight
LDAP servers (e.g. lldap). This PR introduces a generic LDAP strategy built on ldapts
and passport-custom, lowering the barrier to entry for teams that want simple, manageable user authentication without
setting up a full Active Directory.

This implementation is not lldap-specific — it supports any standards-compliant LDAP server, which means it should also work with Active Directory. As a result, it may be possible in the future to replace the deprecated activedirectory2 and ldapjs dependencies with ldapts.

Testing

11 unit tests added covering authentication success/failure scenarios.
Manually verified end-to-end against a running lldap instance.

netlify · 2026-04-07T15:01:40Z

✅ Deploy Preview for endearing-brigadeiros-63f9d0 canceled.

Name	Link
🔨 Latest commit	`6219e70`
🔍 Latest deploy log	https://app.netlify.com/projects/endearing-brigadeiros-63f9d0/deploys/69e64e2b281b0c000872ba6e

linux-foundation-easycla · 2026-04-07T15:01:41Z

The committers listed above are authorized under a signed CLA.

✅ login: 1saac-k / name: Kwangjin Ko (2f496e3, 4ec8707, 735e842, a8b2bdd, ade173d, cb6633f)
✅ login: kriswest / name: Kris West (6219e70)

Add ldapts (v8.1.7) for modern LDAP client support and passport-custom (v1.1.1) for custom Passport strategy creation. Signed-off-by: Kwangjin Ko <kyet@me.com>

Add LDAP auth type definition to config.schema.json and generated TypeScript types with LdapConfig interface. Signed-off-by: Kwangjin Ko <kyet@me.com>

Add disabled ldap authentication entry with sensible defaults for attribute mappings, and group settings. Signed-off-by: Kwangjin Ko <kyet@me.com>

Add new LDAP authentication strategy that uses ldapts for LDAP operations and passport-custom for Passport integration. The authentication flow: 1. Bind with service account 2. Search for user entry 3. Check group memberships (user/admin) 4. Verify user password via user bind 5. Sync user profile to database Signed-off-by: Kwangjin Ko <kyet@me.com>

Add ldap module to passport strategy registry and include it in the list of username/password login strategies. Signed-off-by: Kwangjin Ko <kyet@me.com>

Test cases cover: successful auth with admin/non-admin roles, user not found, user group rejection, invalid password, connection errors, multiple entries in search result, missing credentials, and escapeFilterValue with normal strings, LDAP injection attempts, and RFC 4515 special characters. Signed-off-by: Kwangjin Ko <kyet@me.com>

1saac-k · 2026-04-08T14:07:00Z

Since this work was done outside of my company, I changed the commit email to my personal email and added GPG signatures to sign the CLA as an individual contributor.

dcoric

Requesting changes for the two required fixes in the inline comments:

LDAP group lookup errors are currently swallowed as “not a member”.
Missing LDAP email falls back to an empty string, which can break user upserts with the file DB unique email index.

The remaining inline comments are nits.

dcoric · 2026-04-29T14:47:38Z

          "required": ["type", "enabled", "oidcConfig"]
        },
+        {
+          "title": "LDAP Auth Config",


nit, non-blocking Since the config schema changed, please consider regenerating website/docs/configuration/reference.mdx as described in CONTRIBUTING.md. The generated website schema reference otherwise will not include the new LDAP auth config.

dcoric · 2026-04-29T14:47:38Z


 // login strategies that will work with /login e.g. take username and password
-const appropriateLoginStrategies = [passportLocal.type, passportAD.type];
+const appropriateLoginStrategies = [passportLocal.type, passportAD.type, passportLdap.type];


nit, non-blocking I do not think the CLI should implement LDAP directly: it already posts username/password to /api/auth/login, so it should work with LDAP when LDAP is the selected server-side username/password strategy. It may be useful to mention in docs or tests that git-proxy-cli login works with configured username/password auth methods, while git-proxy-cli create-user is still local DB user provisioning and does not create LDAP users.

dcoric · 2026-04-29T14:47:38Z

+    const userDN = entry.dn as string;
+
+    // Step 4: Check user group membership
+    const isMember = await isUserInGroup(client, ldapConfig, userDN, ldapConfig.userGroupDN);


nit, non-blocking The implementation checks user/admin group membership before verifying the submitted password. I would normally verify the user bind immediately after resolving the user DN, then do group authorization only for authenticated credentials. That avoids extra LDAP work for bad-password attempts and reduces timing/log side effects.

dcoric · 2026-04-29T14:47:38Z

+};
+
+const createClient = (ldapConfig: LdapConfig): Client => {
+  return new Client({


nit, non-blocking It may be worth setting or exposing LDAP operation bounds. ldapts supports client timeouts and search options such as timeLimit/sizeLimit; without them, a slow or misconfigured LDAP server can leave login requests waiting longer than expected or return unbounded matches.

dcoric · 2026-04-29T14:47:38Z

+
+  const searchBase = ldapConfig.groupSearchBase || groupDN;
+
+  try {


isUserInGroup() catches every LDAP search error and returns false, so LDAP outages, invalid filters, bad search bases, or insufficient bind permissions all look the same as "user is not in the required group." For the required userGroupDN check, that should fail authentication as an LDAP/config error rather than silently denying the user. This would also make the admin-group try/catch below meaningful: let the helper throw, treat user-group lookup errors as authentication errors, and only downgrade admin-group lookup errors to admin=false if that is the intended best-effort behavior.

dcoric · 2026-04-29T14:47:38Z

+    // Step 7: Extract profile attributes and sync to database
+    const userObj = {
+      username: String(entry[usernameAttr] || username).toLowerCase(),
+      email: String(entry[emailAttr] || '').toLowerCase(),


email falls back to an empty string when the configured LDAP email attribute is missing. The file DB has a unique email index, so two LDAP users without mail can both authenticate successfully against LDAP but the second one can fail during db.updateUser() because it attempts to upsert another user with email: "". Could we either require the configured email attribute before updating the user, omit email when it is absent, or derive a stable fallback that remains unique per user?

dcoric · 2026-04-29T14:47:46Z

+  userDN: string,
+  groupDN: string,
+): Promise<boolean> => {
+  const groupFilter = (ldapConfig.groupSearchFilter || '(member={{dn}})').replaceAll(


nit, non-blocking For broader "generic LDAP" support, groupSearchFilter could also support a {{username}} placeholder in addition to {{dn}}. That would cover schemas such as posixGroup / memberUid without forcing group membership to reference the user DN.

1saac-k requested a review from a team as a code owner April 7, 2026 15:01

1saac-k added 6 commits April 8, 2026 22:54

build: add ldapts and passport-custom dependencies

a8b2bdd

Add ldapts (v8.1.7) for modern LDAP client support and passport-custom (v1.1.1) for custom Passport strategy creation. Signed-off-by: Kwangjin Ko <kyet@me.com>

feat: add ldap authentication type to config schema

4ec8707

Add LDAP auth type definition to config.schema.json and generated TypeScript types with LdapConfig interface. Signed-off-by: Kwangjin Ko <kyet@me.com>

chore: add default ldap config to proxy.config.json

2f496e3

Add disabled ldap authentication entry with sensible defaults for attribute mappings, and group settings. Signed-off-by: Kwangjin Ko <kyet@me.com>

feat: register ldap strategy in passport and auth routes

cb6633f

Add ldap module to passport strategy registry and include it in the list of username/password login strategies. Signed-off-by: Kwangjin Ko <kyet@me.com>

1saac-k force-pushed the add-ldap-auth branch from 75d7651 to 735e842 Compare April 8, 2026 14:04

kriswest mentioned this pull request Apr 20, 2026

20th April 2026 - GitProxy Meeting Minutes #1506

Open

66 tasks

Merge branch 'main' into add-ldap-auth

6219e70

dcoric suggested changes Apr 29, 2026

View reviewed changes

dcoric reviewed Apr 29, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add generic LDAP authentication strategy using ldapts#1496

feat: add generic LDAP authentication strategy using ldapts#1496
1saac-k wants to merge 7 commits intofinos:mainfrom
1saac-k:add-ldap-auth

1saac-k commented Apr 7, 2026

Uh oh!

netlify Bot commented Apr 7, 2026 •

edited

Loading

Uh oh!

linux-foundation-easycla Bot commented Apr 7, 2026 •

edited

Loading

Uh oh!

1saac-k commented Apr 8, 2026

Uh oh!

dcoric left a comment •

edited

Loading

Uh oh!

dcoric Apr 29, 2026

Uh oh!

dcoric Apr 29, 2026

Uh oh!

dcoric Apr 29, 2026

Uh oh!

dcoric Apr 29, 2026

Uh oh!

dcoric Apr 29, 2026 •

edited

Loading

Uh oh!

dcoric Apr 29, 2026 •

edited

Loading

Uh oh!

dcoric Apr 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants


		const searchBase = ldapConfig.groupSearchBase \|\| groupDN;

		try {

Conversation

1saac-k commented Apr 7, 2026

Uh oh!

netlify Bot commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for endearing-brigadeiros-63f9d0 canceled.

Uh oh!

linux-foundation-easycla Bot commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

1saac-k commented Apr 8, 2026

Uh oh!

dcoric left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dcoric Apr 29, 2026

Choose a reason for hiding this comment

Uh oh!

dcoric Apr 29, 2026

Choose a reason for hiding this comment

Uh oh!

dcoric Apr 29, 2026

Choose a reason for hiding this comment

Uh oh!

dcoric Apr 29, 2026

Choose a reason for hiding this comment

Uh oh!

dcoric Apr 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dcoric Apr 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dcoric Apr 29, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

netlify Bot commented Apr 7, 2026 •

edited

Loading

linux-foundation-easycla Bot commented Apr 7, 2026 •

edited

Loading

dcoric left a comment •

edited

Loading

dcoric Apr 29, 2026 •

edited

Loading

dcoric Apr 29, 2026 •

edited

Loading