nestrs-ldap - Nestrs

nestrs-ldap binds as username / password against a directory (ldap3). Ok(()) means the server accepted the bind. Nest’s passport-ldap strategy is the analogue.

Install

[dependencies]
nestrs = "1.3.0"
nestrs-ldap = "1.3.0"

Bind

{username} in bind_dn_template is replaced with the login name:

use nestrs_ldap::{LdapAuthOptions, LdapAuthenticator};

#[tokio::main]
async fn main() -> Result<(), nestrs_ldap::LdapAuthError> {
    let auth = LdapAuthenticator::new(LdapAuthOptions {
        url: "ldap://dc.example:389".into(),
        bind_dn_template: "cn={username},ou=people,dc=example,dc=com".into(),
    });

    auth.authenticate("ada", "s3cret").await?;
    Ok(())
}

From a login handler, map LdapAuthError to 401 when the bind fails:

use nestrs::prelude::*;
use nestrs_ldap::{LdapAuthOptions, LdapAuthenticator};

#[derive(Default)]
#[injectable]
struct AppState;

#[controller(prefix = "/login")]
struct LoginController;

#[routes(state = AppState)]
impl LoginController {
    #[post("/")]
    async fn login(Json(body): Json<serde_json::Value>) -> Result<&'static str, (axum::http::StatusCode, String)> {
        let user = body["username"].as_str().unwrap_or("");
        let pass = body["password"].as_str().unwrap_or("");
        let auth = LdapAuthenticator::new(LdapAuthOptions {
            url: std::env::var("LDAP_URL").unwrap_or_else(|_| "ldap://127.0.0.1:389".into()),
            bind_dn_template: "cn={username},ou=people,dc=example,dc=com".into(),
        });
        auth.authenticate(user, pass)
            .await
            .map_err(|e| (axum::http::StatusCode::UNAUTHORIZED, e.to_string()))?;
        Ok("ok")
    }
}

Prefer ldaps:// in production. This crate uses ldap3 with default TLS features off at the crate level — enable TLS in your deployment (stunnel, ldaps, or a fork that turns ldap3 TLS on) if the directory requires it.

API

Type	Role
`LdapAuthOptions`	URL + bind DN template
`LdapAuthenticator::new` / `authenticate`	Simple bind
`LdapAuthError`	Wraps `ldap3::LdapError`