How to use ldapjs - 10 common examples

function startLdapServer(callback) {
	const server = ldap.createServer();

	const searchConf = Helper.config.ldap.searchDN;
	const userDN = primaryKey + "=" + user + "," + baseDN;

	// Two users are authorized: john doe and the root user in case of
	// advanced auth (the user that does the search for john's actual
	// bindDN)
	const authorizedUsers = {};
	authorizedUsers[normalizeDN(searchConf.rootDN)] = searchConf.rootPassword;
	authorizedUsers[normalizeDN(userDN)] = correctPassword;

	function authorize(req, res, next) {
		const bindDN = req.connection.ldap.bindDN;

		if (bindDN in authorizedUsers) {
			return next();

function authorize(req, res, next) {
  /* Any user may search after bind, only cn=root has full power */
  var isSearch = (req instanceof ldap.SearchRequest);
  if (!req.connection.ldap.bindDN.equals('cn=admin,dc=example,dc=com'))
    return next(new ldap.InsufficientAccessRightsError());

  return next();
}

function authorize(req, res, next) {
  /* Any user may search after bind, only cn=root has full power */
  var isSearch = req instanceof ldap.SearchRequest
  if (!req.connection.ldap.bindDN.equals('cn=root') && !isSearch) {
    return next(new ldap.InsufficientAccessRightsError())
  }

  return next()
}

var config = {
  port: process.env.PORT || 8080,
  ldap_url: yaml_config.ldap.url || 'ldap://127.0.0.1:389',
  ldap_user_search_base: yaml_config.ldap.user_search_base,
  ldap_user_search_filter: yaml_config.ldap.user_search_filter,
  ldap_user: yaml_config.ldap.user,
  ldap_password: yaml_config.ldap.password,
  session_domain: yaml_config.session.domain,
  session_secret: yaml_config.session.secret,
  session_max_age: yaml_config.session.expiration || 3600000, // in ms
  store_directory: yaml_config.store_directory,
  logs_level: yaml_config.logs_level,
  notifier: yaml_config.notifier,
}

var ldap_client = ldap.createClient({
  url: config.ldap_url,
  reconnect: true
});

ldap_client.on('error', function(err) {
  console.error('LDAP Error:', err.message)
})

var deps = {};
deps.u2f = u2f;
deps.nedb = nedb;
deps.nodemailer = nodemailer;
deps.ldap = ldap;
deps.session = session;

server.run(config, ldap_client, deps);

return new Promise((resolve, reject) => {
    const dn = opts.credentials.dn
    const passwd = opts.credentials.passwd
    const client = ldap.createClient(opts)

    function onConnect () {
      client.removeListener('error', onError)
      client.bind(dn, passwd, err => {
        /* istanbul ignore if */
        if (err) reject(new Error(err))
        else resolve(client)
      })
    }

    /* istanbul ignore next */
    function onError (err) {
      client.removeListener('connect', onConnect)
      reject(new Error(err))
    }

this.afterInclude(function(Model, result, records, include, cache){
      var relation = include.relation
      if(!relation || !relation.ldap) return
      if(!result) return

      var type = include.relation.ldap

      if(!Array.isArray(result)) result = [result]

      for(var i = 0; i < result.length; i++){
        var dn = result[i].dn


        if(type === 'children'){
          dn = parseDN(dn).parent()

          if(relation.recursive){
            var found = false
            do{
              if(cache.dn_mapping[Utils.normalizeDn(dn)]){
                found = true
                break
              }
              if(!dn.parent()){
                found = true // actually not, but we stop the loop here...
              }else{
                dn = dn.parent()
              }
            }while(!found)
          }

function authorize(req, res, next) {
  /* Any user may search after bind, only cn=root has full power */
  if (!req.connection.ldap.bindDN.equals(config.admin.username)) {
    return next(new ldap.InsufficientAccessRightsError());
  }

  return next();
}

function listUsers(req, res, next) {
	assert([ 2, 3 ].indexOf(keys(req.rdns).length) !== null);
	assert('teleport' === req.rdns.o);
	assert('users' === req.rdns.ou);
	var layer = req.bindLayer;
	assert(layer);
	// If searching for a specific user
	var uid = req.rdns.uid;

  if ( uid ) {
    req.filter = new ldap.AndFilter({
      filters: [req.filter, new ldap.EqualityFilter({attribute: 'uid', value: uid})]
    });
  }
	
  var resultCount = 0;
  
	function end(err) {
		log.info({requestId: req.logId, command: 'listUsers', resultCount: resultCount}, "Sent %d users", resultCount);
    res.end();
		next(err);
	}

	dataStore.layerUsers(layer).on('user', function(user) {
    var attributes = clone(user);
    // Apply some defaults
    if ( !attributes.uid ) attributes.uid = user.uid;

function listUsers(req, res, next) {
	assert([ 2, 3 ].indexOf(keys(req.rdns).length) !== null);
	assert('teleport' === req.rdns.o);
	assert('users' === req.rdns.ou);
	var layer = req.bindLayer;
	assert(layer);
	// If searching for a specific user
	var uid = req.rdns.uid;

  if ( uid ) {
    req.filter = new ldap.AndFilter({
      filters: [req.filter, new ldap.EqualityFilter({attribute: 'uid', value: uid})]
    });
  }
	
  var resultCount = 0;
  
	function end(err) {
		log.info({requestId: req.logId, command: 'listUsers', resultCount: resultCount}, "Sent %d users", resultCount);
    res.end();
		next(err);
	}

	dataStore.layerUsers(layer).on('user', function(user) {
    var attributes = clone(user);
    // Apply some defaults
    if ( !attributes.uid ) attributes.uid = user.uid;
    if ( !attributes.cn ) attributes.cn = user.uid;

// AD will search and delay an error till later if no password is given
    if (password === '') {
      return callback(new WrongPassword(profile));
    }

    log('Change password for DN "' + profile.dn.green + '"');

    var modification = {};
    if(nconf.get('ENABLE_ACTIVE_DIRECTORY_UNICODE_PASSWORD') === true){
      modification.unicodePwd = Buffer.from('"'+password+'"',"utf16le").toString();
    }else{
      modification.userPassword = password;
    }

    var passwordResetChange = new ldap.Change({
      operation: 'replace',
      modification: modification
    });

    var changeSet = [passwordResetChange];

    if (nconf.get('AUTO_UNLOCK_ON_PASSWORD_CHANGE') === true) {
      var unlockAccountChange = {
        operation: 'replace',
        modification: { lockoutTime: 0 }
      };
      changeSet.push(unlockAccountChange);
    }

    self._client.modify(profile.dn, changeSet, function (err) {
      if (err) {