Iskra API Reference
    Preparing search index...

    Class LdapDirectory

    An LDAP directory, Active Directory by default: logins, users, their groups (nested included) and what changed. Every call opens a connection, binds as the service account and closes it when done.

    const ldap = new LdapDirectory({
        url: 'ldaps://dc1.corp.example.com',
        baseDN: 'DC=corp,DC=example,DC=com',
        bindDN: 'svc-app@corp.example.com',
        bindPassword: process.env.LDAP_PASSWORD!,
    });
    const result = await ldap.authenticate(login, password, { groups: 'nested' });
    if (!result.ok) logger.warn('login refused', { reason: result.reason });
    Index
    constructor
    authenticate changesSince findUser findUserByDN groupsOf healthCheck ping search searchPages

    • Checks a login: finds the user with the service account (exactly one match), then binds as that user with password. A refused login is { ok: false, reason }; an unreachable directory throws LdapError. An empty password is refused without asking the server.

      Parameters

      • login: string
      • password: string
      • options: { groups?: false | "direct" | "nested" } = {}

      Returns Promise<AuthResult>

    • The users (or, with filter, other objects) changed since mark, and the mark of the next call. In AD prefer a USN (uSNChanged), which is per domain controller: read changes from one url. A date compares whenChanged (AD) or modifyTimestamp (OpenLDAP) with the app's clock. Deleted objects are not returned.

      Parameters

      • mark: ChangeMark
      • options: { attributes?: readonly string[]; filter?: string } = {}

      Returns Promise<ChangesResult>

    • The user with this login (as authenticate finds it), or null when there is none or more than one.

      Parameters

      • login: string

      Returns Promise<LdapUser | null>

    • The user at this DN, or null.

      Parameters

      • dn: string

      Returns Promise<LdapUser | null>

    • The groups of a user (or of any member, by DN): with nested (the default) also the groups those groups are in. AD resolves them in one search; elsewhere they are followed level by level.

      Parameters

      • member: string | LdapUser
      • options: { nested?: boolean } = {}

      Returns Promise<LdapGroup[]>

    • A check for web-kit's HealthCheckFeature (checks: { ldap: ldap.healthCheck() }): ok with the latency, error with what failed (not the credentials).

      Returns () => Promise<{ details?: unknown; message?: string; status: "error" | "ok" }>

    • Connects, binds as the service account and reads the root DSE: what a health check needs.

      Returns Promise<{ latencyMs: number; rootDSE: LdapEntry; url: string }>

    • A search page by page, on one connection, closed when the iteration ends.

      Parameters

      Returns AsyncGenerator<LdapEntry[]>

    Settings
    Member Visibility

    On This Page
    Constructors
    Methods