Best practices for LDAP authentication

Introduction

You will find here some best practices to code LDAP authentication in your applications:

  • Use a filter to recover user DN: do not build DN with a concatenation of login and branch

  • Use service account to query LDAP: some directories will not allow anonymous access

Search and Bind

Here is a standard LDAP authentication workflow:

  1. A bind is done with a Directory Service Account (that has read rights on user entries)

  2. A search is done with the user identifier in the filter, for example:

Search base:

ou=users,dc=example,dc=com

Search filter:

(&(uid=<user identifier>)(objectClass=person))

Search scope:

one

Search attributes:

uid

  1. The DN of the user is found in the result. If more of one entry is returned, or no entry is returned, there should be an error.

  2. A bind is done with the DN found and the password submitted by the user. If the operation fails (error code 49), the password is wrong.