I have an application storing its hashed and salted user data in a MySQL database. Users should get authenticated on other systems like XMPP with the same credentials. Since they're properly hashed and salted (each user has its own hash), I see only one way to realize this: A LDAP server that acts as proxy and check the provided bind password against the MySQL database.

LDAPjs would be a library to develop something like that (simplified POC example like this):

function authorize(req, res, next) {
  let isAuthorized = db.checkCredentials(req.identifierValue, req.credentials)
  if (!isAuthorized)
    return next(new ldap.InsufficientAccessRightsError());

  return next();

server.search('o=ldap-proxy', authorize, function(req, res, next) { ... });

Now I could authenticate as cn=exampleUser,o=ldap-proxy and validate those credentials against the MySQL database. Of course this had to be extended so that the application (like XMPP) gets some details about the user like username, email and so on.

I'd prefer some other stack like .NET Core or Python. But LDAPjs is the only one I found so far that gave me events where I could query my MySQL DB. There are other LDAP server libs like ldap-proxy for Python. It seems that they can only load an entire LDIFF, which is not suiteable for a DB with over 10k users. It would also be hard to refresh if users were added/removed. I guess this library is more to act as a proxy behind another LDAP server.


Are there any alternatives to write anything from scatch with LDAPjs? I found out that OpenLDAP supports SQL backends. This seems to be exactly the functionality which I need:

That is, for example, when you (some ISP) have account information you use in an RDBMS, and want to use modern solutions that expect such information in LDAP (to authenticate users, make email lookups etc.)

But it seems to be rarely documentated, I couldn't find much information/articles/tutorials how to specify wich data from the MySQL server got returned on which queries. From the approach it seems better than writing an entire application for that purpose.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.